Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 

Don't Accept Defaults

By Steve Jones,

Do you know the default users and passwords on Oracle databases? They're identified in the documentation for some versions, with the admonishment that these values should be changed. I've used those defaults on more Oracle databases than I care to count. SQL Server learned from this and there is no default username and password enabled on new SQL Server instances in recent versions. However, if you enable mixed mode authentication, please make sure you set a password.

There are numerous defaults that developers create for their software. In many cases, these are chosen to make setup easier on the user. However all too often the defaults are not set to the values that users would prefer, or what are the most secure settings. Sometimes vendors even changes the defaults during an upgrade to make them worse. If you are not careful, you might even end up exposing data you never expected to expose, as security researchers found at Amazon S3.

These days it seems to be more and more important that system administrators, especially database administrators, do not blindly accept defaults. They must be more concerned with security than ease of setup and use since the many data breaches make the news and I'm sure it won't be long before we see administrators getting terminated for not paying enough attention to configuration settings. With templates and tools being used for quickly creating new virtual machines, one poor security setting could be replicated to a large number of systems.

There are some good tools available for SQL Server, including PBM, which is built into all modern versions and editions. There are settings to force password changes and ensure compliance with your company policies. There's no excuse these days for not having servers that are configured correctly, using the defaults only when they are appropriate.

Steve Jones


The Voice of the DBA Podcasts

No podcast today due to technical issues. We will return with our podcasts tomorrow.

Total article views: 80 | Views in the last 30 days: 1
 
Related Articles
FORUM

Passwords

Storing passwords securely

FORUM

security setting

change default security setting

ARTICLE

Changing SQL Server Passwords

SQL Server 2000 does not have the best or most secure password mechanism. In fact it does a pretty p...

FORUM

sql 2005 security question

default service accounts weak password status

FORUM

SQL Server Security Model

SQL Server Security Model

Tags
editorial    
 
Contribute

Join the most active online SQL Server Community

SQL knowledge, delivered daily, free:

Email address:  

You make SSC a better place

As a member of SQLServerCentral, you get free access to loads of fresh content: thousands of articles and SQL scripts, a library of free eBooks, a weekly database news roundup, a great Q & A platform… And it’s our huge, buzzing community of SQL Server Professionals that makes it such a success.

Join us!

Steve Jones
Editor, SQLServerCentral.com

Already a member? Jump in:

Email address:   Password:   Remember me: Forgotten your password?
Steve Jones