Problems displaying this newsletter? View online.
SQL Server Central
Featured Contents
Question of the Day
Redgate Database Devops
The Voice of the DBA

Would a Duress Password be a Good Idea?

Today we have a guest editorial from Andy Warren as Steve is out of town. This editorial was originally published on 21 Apr 2015.

We put a lot of effort into security. We require strong passwords, we require frequent password changes, and more often than we used to we add two-factor/multi-factor authentication to the mix. That’s on top of the firewalls, proxies, and the VPN, and maybe intrusion detection and some others too. We know that malware is a constant threat and so we put a lot of effort into vulnerability scans and virus scans. You might argue we need to do more, or do some stuff differently, but we are at least trying to block the most common attack types.

What about the less common attacks though? Imagine a made-for-TV scenario where a sysadmin goes out for lunch and a stranger sits down across from them and asks for their domain admin password. Laughable right? Unless they show evidence of a real threat, perhaps to a family member. Imagine that’s you at lunch, what do you do? Short of national security it’s a no brainer, you give them the password. Then what?

All manner of bad things. One would guess they would immediately create a new login for themselves and plant one or more pieces of malware, at least one of which would be dormant for a while. They take what they can find, or they vandalize, or both. Would we know such an attack was in progress? Or do we find out only once you break free, do your best Die Hard moves to rescue the hostages, and call in to the NOC to have your account shut down? Shutting down the account is the obvious move once the attack is known, but it’s no guarantee that the attack stops – it’s just a miserable scenario.

That makes me wonder if it’s time to borrow an idea from the world of physical security – duress codes. Many alarm systems are configured so that if the duress code is entered the alarm appears to be deactivated but still signals the monitoring center. We could do the same thing for the passwords for key personnel, letting them configure a second password that would be a minor variation of the first – maybe one letter switched from lower to upper case. When activated not only could it send the secret alert, it could activate additional defensive measures – perhaps imposing a bandwidth policy to slow the attacker down and limit what they can steal, or activating additional logging, or with more effort sandboxing them so that the changes they try can’t reach the real domain.

The real challenge is trusting what the response will be if you use the duress code. If it’s going to lock your account immediately you might decide to not use it to protect the hostages.

Andy Warren

Join the debate, and respond to today's editorial on the forums

Redgate University
 Featured Contents

Getting Started with SQL Server on Google Cloud Platform

blakemcneill from SQLServerCentral

Learn how you can create a SQL Server instance in the Google Cloud Platform.

SQL Change Automation 4.0: Collaborative Database Development Across Visual Studio and SQL Server Management Studio

Additional Articles from Redgate

SQL Change Automation's Development component for developing new databases and modifying existing databases, using migrations, now integrates directly into SQL Server Management Studio as well Visual Studio. It allows teams to collaborate effectively during development, regardless of their preferred IDE, and in a way that integrates easily with common build/integration servers and release management tools.

How to Use SQL Audit and Azure Log Analytics to Comply with Audit Rules

Additional Articles from SimpleTalk

You can use SQL Audit to record changes to security, access to tables, and more to help you meet compliance requirements. In this article, Joshua Feierman explains how to set up the audit and collect the data in Azure Log Analytics when running SQL Server in an Azure VM.

Are you making the most of your Redgate Tools?

Press Release from Redgate

Whether you are a long time Redgate customer or have recently made a purchase you can find helpful and easy to follow video courses on Redgate University. With the brand-new look and the recently added courses you will soon be getting the most from your Redgate tools.

From the SQL Server Central Blogs - Check Query Progress with Live Query Stats

matthew.mcgiffen 73574 from Matthew McGiffen DBA

This is something I touched on back in 2017 a little after the Live Query Statistics feature was introduced with SQL 2016, but I was using the functionality this...

From the SQL Server Central Blogs - SQL Server Statistics Health Reminder

SQLEspresso from SQLEspresso

I’ve written about statistics in SQL Server a few times now. Through conversations  I am reminded that not everyone keeps their table statistics up to date. Keeping your statistics...


 Question of the Day

Today's question (by Evgeny Garaev):


Stretch Database limitations

What could prevent you from creating a Stretch-enabled table?

Think you know the answer? Click here, and find out if you are right.



 Yesterday's Question of the Day (by Steve Jones - SSC Editor)

The Python Identity Matrix

I want to create an identity matrix for some data science work that looks like this:

1, 0, 0
0, 1, 0
0, 0, 1

I have run this code:

import numpy as np

What is the way that I can create an identity matrix in this shape as an array to use in a neural network?

Answer: np.eye(3)

Explanation: The numpy function eye() will create the identity matrix with 1s on the diagonal. Ref: numpy.eye() -

Discuss this question and answer on the forums




Database Pros Who Need Your Help

Here's a few of the new posts today on the forums. To see more, visit the forums.

SQL Server 2017 - Administration
Stored Procedure - I have a table: Named  HighScores "INSERT HighScores VALUES ('Bob', 2500, '2 Jan 2013 13:13'), ('Jon', 1500, '2 Jan 2013 13:15'), ('Amy', 3500, '2 Jan 2013 13:18')" I want to create a stored procedure that would: The score must show the TOP 5 or so people. Show your position on the high score board Show […]
After 2014 to 2017 Upgrade, table unused space growing massively. - I have a database that we recently upgraded from SQL 2014 to SQL 2017. The application against the data are working fine, but we started to notice database file growth. After investigating, many tables are exhibiting a behavior where the unused_space is growing massively compared to the time before the upgrade, and I cannot figure […]
SQL 2017 Automatic Tuning (issue?) - Hello, This past summer we migrated to OS 2019 and SQL 2017.  I have the automatic tuning feature enabled for the DB in question and all has been fantastic until this morning.  Each morning index maintenance (Ola Hallengren) runs with rebuilding statistics option.  Once load began, (~ 5,000 users) massive blocking began (LCK_M_X) slowing down […]
SQL Server 2017 - Development
Using a CTE in a subquery - I have been tasked with identifying a set of users in one of our databases.  The following code should be reasonably self-explanatory: --There are 1,360 Users SELECT COUNT(*) AS NumUsers FROM Users; -- Use a CTE to identify all Users who are linked to Actions - there are 82 of these ;WITH ActionCentreUsers AS ( […]
Getting a result set from temp tables - So I have 5 queries . Each query fills a different temp table.  For each table the first two columns will be named (GovState, FirmID) . A third column will also exist. It will be named differently depending on the temp table. ("CountOfPolicies", "CountOfQuotes", etc)  This column will normally show a count of something. I […]
SQL Server 2016 - Administration
AlwaysOn 2 Nodes Next to Zero Downtime with SQL Edition Upgrade - I'll attempt to be as specific as I can with this question. I've been tasked with setting up AG's on our SQL Servers. We have a customer who provides translation services for medical facilities so downtime is hard to come by. I need to upgrade our SQL Server version from Standard Edition to Enterprise so […]
question on locking ? - Hi All, Heard about readers can also block writers. Can anyone provide a demo example to prove this? I was under the impression that only writers can block readers. Secondly, will INSERT block a SELECT ? Thanks, Sam  
SSIS catalog deployment from source server to target - powershell - I am looking for a good solution for automating the deployment of SSIS packages through environments. Right now the deployment is very manual but I am hoping to find a powershell script that will copy packages from source to target servers (including all configurations and environment variables). Does anyone have any suggestions? I have found […]
SQL Server 2016 - Development and T-SQL
how to call same logic using different parameter in if then else stored procedur - ALTER PROCEDURE [dbo].[employee] @isemployee int AS IF (@isemployee = 0) BEGIN DECLARE @Email Varchar (100) DECLARE @Name Varchar (100) SELECT @Email = text from dbo.emailtable WHERE email = 'XXX' SELECT @Name = name from dbo.nametag where refer = 'HJJ' SELECT @Name as NAME, @Email as EMAIL, '' as Test1, '' as Test2 END ELSE BEGIN […]
SYMMETRIC KEY Incorrect syntax near 'TRIPLE_DES' - Hi All   I'm using SQL2016 I'm having an issue with a piece of code generated in SQL2008 Sample code below This returns Incorrect syntax near 'TRIPLE_DES'. So, looking around, it appears as though TRIPLE_DES has been deprecated Is there an obvious replacement for TRIPLE_DES here? CREATE SYMMETRIC KEY [My_SYMMETRIC_Key] AUTHORIZATION [dbo] WITH ALGORITHM = […]
SQL 2012 - General
DB digram, Standard reports to use. - Hi, Please let me know.. DB Diagram: SSMS is not helping with so many tables and huge DB. Please advise if there are other ways which can be helpful to generate or create DB diagram. The goal is to understanding the tb lvl relationship and what is the MASTER table and get better understanding. 2. […]
XML Data singleton value not fixed???? - Hi Hope to explain this correctly I have some XML data that can vary on singleton value So in the example below I want to list the "Company" along with the "Service"  but [1] may be any value('Mental Health', Substance Abuse etc..)If the User entered Mental Health first it would be [1] if they enetered […]
SQL Server 2012 - T-SQL
Recursive function parent-child in t-sql - I have two tables and I want to do a recursive query in order to get a final table with a parent-child relationship and a column saying if it has childs. My idea was to join both tables and use a use CTE (the query give me an error I attach it) and an image […]
Security (SS2K8)
Remote Server calls failing since recent Windows update - Has anyone else had issues with linked servers, remote calls, double-hops, etc, since the July, August, or September 2019 Windows updates? We know the cause is in there somewhere, as we have re-imaged a PC to pre-July updates and everything works. As soon as the updates are applied, ka-blooey. We can't control the updates (and […]
Anything that is NOT about SQL!
SQL Licencing and a move to Opensource RDBMS' - Good day Quite a number of our larger clients are contracting us to assist them with migrating from SQL Server to other opensource RDBMS'. Their motivation is simple: Microsoft licencing is becoming way too expensive and is corroding their bottom line. This is a very similar to what happened a few years ago when companies […]


RSS FeedTwitter

This email has been sent to {email}. To be removed from this list, please click here. If you have any problems leaving the list, please contact the This newsletter was sent to you because you signed up at
©2019 Redgate Software Ltd, Newnham House, Cambridge Business Park, Cambridge, CB4 0WZ, United Kingdom. All rights reserved.


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -