One other way to help minimize an attack is have the userid ONLY have access to what it needs to do. For instance, don't assign it 'sa' rights or 'ddladmin' rights.... if so an attack could do a lot of harm.