Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 

Worst Practices - Blank Passwords

By Steve Jones,

Worst Practices - Using Blank Passwords

Introduction

Passwords are a tough topic. They are often abused, shared, written down, or made amazingly simple by way too many people. Even those who make an attempt to create difficult passwords, often find themselves unable to work with passwords that are too complex and not remembered, causing them to soon change back to easily remembered passwords.

And yet passwords are the weakest link in most environments (after people).

We all know that having a password gives access to our SQL Servers. Yet, too often we setup blank passwords in development, QA, even production systems rather than setting even a minimal password. I'm not sure if we can't get creative, or take a minute to set something up and let the appropriates users know, or that we don't care, but it's a bad practice to get into, and without a doubt, a worst practice in SQL Server. Like most other poor practices, once you engage in this one, it's hard to go back.

Keep in mind that the data on a server is the critical fact. So development and test data are not that important, right?

But how often is a development or test system "refreshed" from the production system. You might trust the "HR" developers, but if you've got blank passwords, you never know when the "Tools" developer might decide to take a look at the test system to see if anyone left the salary information lying around.

Another thing to keep in mind is that if you are like me, you may lose track of what data is being stored on your servers. Not that you don't know what a database is used for or what tables are there, but users have a way of finding creative storage means for their data. And you might find that the data being stored in your tables is more important that initially spec'd and needs to be secured. Having a blank password doesn't change this, but it certainly makes it easier for any user, authorized or not, to get access.

However, is setting a standard password for user accounts any better? Arguably it's not because this become well known and more widely distributed than one can imagine. Whether you choose a standard like "12345" or set the password to the same as the login name, these don't provide much security at all.

However, something is always better than nothing and provides some protection in case your firewall is incorrectly configured or is taken down or something changes.

Do yourself a favor and avoid this worst practice by setting a password on all accounts.

Conclusion

So what should you do?

Well in a network position, we used to reset passwords and choose easy ones, but keep changing them. So I might set a password to "12345" for Andy, if Brian called next, I'd probably set "24680" or something like that. On a network, however, you can force the user to change the password immediately. SQL Server, at least as of v2000 (we'll see about Yukon), you cannot do this.

I'll look at some alternatives in another article to keep an eye on your users and their passwords.

As always I welcome feedback on this article using the "Your Opinion" button below.

Steve Jones
©dkRanch.net January 2003
Return to Steve Jones Home
Total article views: 5356 | Views in the last 30 days: 2
 
Related Articles
FORUM

Password change

Password change

FORUM

change password

change password

ARTICLE

Changing SQL Server Passwords

SQL Server 2000 does not have the best or most secure password mechanism. In fact it does a pretty p...

FORUM

Best practices Password Change - SQL Failover cluster (3 or 4 node cluster)

Best practices Password Change - SQL Failover cluster (3 or 4 node cluster)

BLOG

PowerShell – Change SQL Server Login Password

Here’s a quick post detailing a PowerShell script that can be used to change the password for a SQL ...

 
Contribute

Join the most active online SQL Server Community

SQL knowledge, delivered daily, free:

Email address:  

You make SSC a better place

As a member of SQLServerCentral, you get free access to loads of fresh content: thousands of articles and SQL scripts, a library of free eBooks, a weekly database news roundup, a great Q & A platform… And it’s our huge, buzzing community of SQL Server Professionals that makes it such a success.

Join us!

Steve Jones
Editor, SQLServerCentral.com

Already a member? Jump in:

Email address:   Password:   Remember me: Forgotten your password?
Steve Jones