Browse by Tags

• /3gb
• 2000
• 2005
• 2008
• 3gb
• access
• access denied
• application
• area
• ASP.NET
• audit
• australia
• authentication
• awe
• blocking
• cache
• cdc
• certificate
• client
• clr
• clustering
• code camp
• community
• compliance
• components
• computing
• configuration
• connect
• copy
• Cyberspace
• database design
• database list
• date formats
• dbcc
• dbo
• defrag
• disable
• Disaster Recovery
• disks
• distributor
• dmv
• does not
• dynamic sql
• edition
• encryption
• enhancement
• enterprise
• environment
• error
• error log
• exists
• failover
• fragmentation
• Hardware
• high availability
• high cpu
• http
• impersonate
• index
• index maintenance
• indexes
• injection
• Installation
• instances
• Integration
• kba
• kerberos
• login
• management
• Management Studio
• memory
• Microsoft
• pae
• patches
• performance
• query
• replication
• sa
• server
• showcontig
• sp_help_revlogin
• SP3
• spindle
• SQL Server
• SQL Server 2005 SP3
• SQL Server 2008
• SQL Server Agent
• ssas
• ssis
• ssl
• ssma
• SSMS
• ssrs
• start
• statistics
• surface
• table
• tsql
• vista
• windows

• Bad habits to kick : ignoring the principle of least privilege

  In my last post in this series , I talked about "blind SQL Server installs" and some of the potential consequences of making uninformed choices during setup (or of just accepting all of the defaults). Today I wanted to touch on security a bit. I frequently...( Read More... Posted Saturday, February 13, 2010 1:36 AM from Aaron Bertrand | (Comments Off) Filed under: security, sa, clr, permissions, dbo, xp_cmdshell, principle of least privilege

• Using sa as owner for jobs and databases

  This blog is not about avoiding logging in using the sa login. Hopefully we all know about this, and work towards avoidning this practice. Instead I want to talk about using sa, but not to login (authenticate), but as owner for jobs and databases. I want...( Read More... Posted Wednesday, December 30, 2009 5:19 PM from Tibor Karaszi | (Comments Off) Filed under: security, SQL Server Agent

• Fifth pillar - Secure

  As I have mentioned in all of the previous posts, basic functionality is the foundation of any system. So it goes without saying that if you have just implemented a payroll system, everyone is getting paid.  To meet the basic bar that EVERYONE agrees...( Read More... Posted Wednesday, October 07, 2009 9:52 AM from Louis Davidson | (Comments Off) Filed under: security, SQL Server, database design, Pillars

• SQL Server Agent jobs and user contexts

  In what user context does a job run? I recently found myself in a forum discussion and gave my stock reply, later realizing that I haven't actually tested this for a long time (I used to demo this in class during 6.5 courses - when we actually had time...( Read More... Posted Saturday, September 19, 2009 6:57 PM from Tibor Karaszi | (Comments Off) Filed under: security, SQL Server Agent

• At the user group...auditing and sys.fn_get_audit_file

  I really enjoyed speaking at the Portland SQL Server User Group meeting last night about SQL Server security...and I have an update. We were talking about the supposed inability of auditing to audit usage of sys.fn_get_audit_file, the system function Read More... Posted Saturday, July 25, 2009 9:38 AM from Bob Beauchemin's Blog | (Comments Off) Filed under: security

• For shared SQL Server providers : hiding your list of databases from customers

  In a shared SQL Server hosting environment, there are several problems that can arise when you let your customers use Management Studio to connect and administer their databases. In the typical case, you give them a single SQL Authentication username...( Read More... Posted Monday, July 20, 2009 1:26 AM from Aaron Bertrand | (Comments Off) Filed under: security, SSMS, Management Studio, shared hosting, database list

• Connect Digest : 2009-07-18

  I missed last week because I was having fun up in Canada... mostly without any kind of computer access at all. It was a nice break, but now I'm back in the thick of things again. So this week, I am going to try to beef it up a bit to compensate for last...( Read More... Posted Sunday, July 19, 2009 12:54 AM from Aaron Bertrand | (Comments Off) Filed under: security, Open Table, SSMS, statistics, connect, cdc, Management Studio, index maintenance, paths, date formats

• At the Portland SQL Server User Group this month

  This month I'll be presenting a session for the Portland SQL Server User Group. I'll be discussing and demonstrating the new security features in SQL Server 2008 with a post-talk Q&A about SQL Server security in general. I've also got Read More... Posted Thursday, July 09, 2009 3:58 AM from Bob Beauchemin's Blog | (Comments Off) Filed under: security

• Looking for security vulnerabilities in database code

  I've always been concerned with security and I've always stressed the importance of auditing the REAL user context not just the current user (see this post on EXECUTE AS and auditing). So, I generally try to avoid using dynamic string execution Read More... Posted Wednesday, July 01, 2009 1:34 AM from Kimberly L. Tripp | (Comments Off) Filed under: security, SQL Server 2008, SQL Server 2005

• Connect Digest : 2009-05-10 : please vote!

  Sorry I'm a day late on this one; yesterday I was fully engulfed by Resource Governor stuff and a filter refreshing problem at work, and then last night I spent the entire evening away from a computer (for the first time in what seems like ages). Anyway, Read More... Posted Monday, May 11, 2009 2:20 AM from Aaron Bertrand | (Comments Off) Filed under: security, SSMS, connect, encryption

• SQL Resources for Compliance

  Author : Denny Lee Reviewers : Prem Mehra, Kevin Cox With the terabytes of data that are being stored today - truly representing the data explosion that we've always talked about - it's becoming more and more difficult to provide an audit trail or utilize Read More... Posted Thursday, April 16, 2009 7:06 AM from Microsoft SQL Server Development Customer Advisory Team | (Comments Off) Filed under: security, compliance

• More updates for SQL Server 2005 Service Pack 3

  As promised, upon return from a trip to the frozen tundra of Northern Ontario, I am posting the latest updates from last week's release of SQL Server 2005 Service Pack 3. For those who have been waiting to test the service pack until the post-SP3 cumulative Read More... Posted Wednesday, December 24, 2008 6:13 AM from Aaron Bertrand | (Comments Off) Filed under: security, patches, service pack 3, SQL Server 2005 SP3, SP3

• Troubleshooting login problems

  I've been learning a few things about troubelshooting login problems over the last few months. I first want to say that I've learned most of this through other blogs, comments etc. At the end of this blog post you will find an URL list where you can look Read More... Posted Wednesday, December 17, 2008 9:10 PM from Tibor Karaszi | (Comments Off) Filed under: security, troubleshooting

• Very important SQL Server update

  There is a patch available for four elevation of privilege vulnerabilities recently discovered in SQL Server. From http://www.microsoft.com/technet/security/bulletin/ms08-Jul.mspx : This security update resolves four privately disclosed vulnerabilities. Read More... Posted Wednesday, July 09, 2008 7:32 AM from Aaron Bertrand | (Comments Off) Filed under: security, Vulnerability, patches

• Call a spade a spade! (SQL injection, or IIS vulnerability?)

  In a recent blog post, Dancho Danchev mis-labeled a recent IIS vulnerability as a " massive SQL injection attack ." Let's be honest here. Yes, this alert needs attention. But is is not a new SQL injection vulnerability. It is simply an exploit in IIS Read More... Posted Sunday, April 27, 2008 2:06 AM from Aaron Bertrand | (Comments Off) Filed under: security, sql injection