In the "Acknowledgements," lead author Chip Andrews writes "I wanted this book to give security and database professionals the same readability, reference ability, and red-eyed wonder that 'Hacking Exposed' gave me a few years back." My favorite aspect of the HE line was the material's ability to explain attack and defense concepts while illuminating the internal operation of victimized systems. SSS follows this lead by devoting entire chapters to SQL Server components, like Network-Libraries (ch. 4) and Authentication and Authorization (ch. 5). My favorite sections appear in chapter 7, where the authors describe novel ways to leverage SQL Server's "C-2 auditing" features for purposes of intrusion detection.

SSS dispenses an immense amount of useful advice, whether it's a whole chapter on secure installation (ch. 3), best practices found in most chapters, or the appendices on stored procedures and integration with other Microsoft technologies. The only downside I found appears in chapter 2, where SQL samurai David Litchfield uses language outside the realm of most readers' understanding. For example, "the import address entry for GetProcAddress() in sqlsort.dll shifts by 12. With no SQL Server service pack, the address of the entry is at 0x42AE1010, and on SP1 and SP2, it is at 0x42AE101C" (p. 29). The uninitiated should skim this chapter and trust the authors when they claim SQL Server can be attacked by multiple means.

SSS is a must-buy if you operate SQL Server. It's the manual Microsoft forgot to ship.