zsafakhah (9/4/2012)
Dears All,thanks for you comments.
My Company bought a accounting software which need "sa" user for config software and need x-cmdShell sp for some actions.
i am DBA of my company and could not accept this because its had high risk.
what can i do for this action?
best regards,
zohreh
There are only four things you can do.
1. Refuse to use it and demand a refund.
2. Do like Clare did and refuse to use it until they change it (beware of liars if they still use xp_CmdShell because there aren't many folks that know how to properly implement it without using "SA").
3. Do a deeper dive and find out how "SA" is being used and whether it is restricted to just "admin" functions and then protect the "admin/SA" password for it like you would for any other server. Also, test the software for SQL Injection to make sure that no outsiders can get in as "SA".
4. Set it up as the only application on a highly protected server in its own domain so that when someone does break into it, you can minimize the damage. That's provided that the information isn't sensitive. If the information is sensitive, then only options 1 and 2 are the right way to go. Since this is "accounting software", I'm thinking this is going to be anything but insensitive information.
In all cases, keep managemment informed and warned about just exactly what can happen if the "SA" user is hacked including the lawsuites that can occur by private citizens if private or other sensitive information is picked up by a hacker... externally or internally. It CAN be a cause of the whole company shutting down and that's not the worst case.
--Jeff Moden
Change is inevitable... Change for the better is not.