Awhile back I heard a few DBAs discussion the need for securing and auditing their installations. In one case, a DBA was saying that they needed to ensure certain actions were monitored, or that another employee was made aware of the action. The DBAs felt that having a two-factor authentication system, whereby two people would have to enter a password to approve an action, was a good idea. That sounds like a great idea to me.
I think back in my career to jobs I've had, and I wonder how many times I've made changes to a system, fundamental changes like disabling or enabling auditing of something, changing a service account, adding or removing sysadmins or something else. All of these changes arguably could affect the stability of the instance. And in many cases I did them quickly because of some need I thought I have.
I wonder how many times I remembered making the changes a day later. Probably not as often as I should have, and I know there were times when we had issues with a server because of a change that I, or someone else, made and didn't document the action or remember making the change.
Having a second person need to approve an action, even if they don't understand it, means that someone else is aware of what happened. They become living documentation and can bring it up if there are issues. Isn't that the point of documentation? Making someone else aware of what happened?
In SQL Server 11, this might even be easy to implement. Use two Service Broker Queues, build an interface in there for SSMS, require two sysadmin accounts to approve an action before the item would make it through both queues and be executed.
I don't know how often I'd want this done, but I can see that having two people approve something could be a good control point to ensure that we don't have a rouge administrator. It might even cut down on hacking attempts since a single account, even a sysadmin, couldn't alter some things on the system. Like adding a new sysadmin.
Steve Jones
The Voice of the DBA Podcasts
The podcast feeds are available at sqlservercentral.mevio.com. Comments are definitely appreciated and wanted, and you can get feeds from there.
You can also follow Steve Jones on Twitter:
Overall RSS Feed:
or now on iTunes!
Today's podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.
I really appreciate and value feedback on the podcasts. Let us know what you like, don't like, or even send in ideas for the show. If you'd like to comment, post something here. The boss will be sure to read it.
