I have a couple SQL Server Express Databases which are accessible through a number of asp.net/IIS websites plus Remote Desktop (me only). The web sites use integrated security and I have one user account that I use. The problem is the logs show almost continuous attempts at failed logins. These occur every 5-10 seconds or so, from one IP for about 5 minutes, then the IP changes. The user name being attempted is usually 'sa' or some variation (I don't have an 'sa' user). I have blocked several hundred of these IPs using Windows Firewall, but they just keep coming. This results in huge log files and I guess a lot of bandwidth being used. So my question: Do I have enough security in place that I don't have to really worry about this - or is there something more I should be
The failed logon attempts mean that someone/something at least has access to the IP/Port and your server might be facing the internet.
It's not the failed logon attempts that you should worry about as much as the successful ones you might not notice.
You are also exposing yourself to DoS attacks and increasing the attack surface unnecessarily.
Get your SQL Server behind a firewall right now. I thought we learned that after Slammer