Every so often I run into a fellow DBA or database developer who isn't crystal clear on how file/folder and share permissions play together. If you're an MCSE or an experienced system administrator, this should be old hat for you. However, given...
2009-07-21
2,545 reads
Recently, a fellow DBA showed me a set of documentation on a commercially available product. This is a product people pay money for to license and use. It's not an in-house developed application or a community released free sample.
2009-07-17
2,589 reads
When it comes to securing a system, it's important to understand how it might be attacked. That's what surface area is all about. The surface area is the parts of the system which are exposed. For instance, in the case of a default instance of...
2009-06-10
1,874 reads
Whenever I do a security presentation, I make sure to cover the Principle of Least Privilege. And when I do I boil it down to this very simple definition: Giving the rights to do the job. No more. No less.
2009-06-04
1,912 reads
On a couple of recent webcasts, I pointed out the folks were running with the local Administrator account. To start this out, I'm not a big fan of security by obfuscation. Security by obfuscation (not code obfuscation, but security by obscurity, if...
2009-06-02
2,556 reads
One of the main defenses touted against SQL injection attacks is to use proper parameterization at the application layer. But while this gets most of the cases, there are clearly examples where this alone fails. For instance, consider the stored procedure...
2009-05-20
3,948 reads
This is spurred on by a comment a pen tester made. He was referring to a particular technology and said something to the effect of, "What do you expect? It's 30 year-old technology." I was stunned when the comment was relayed to me. My response...
2009-05-13
2,363 reads
In my security presentations, another basic I talk about is defense-in-depth. The idea here is to produce multiple layers of protection against a particular attack. For instance, imagine malicious code against your home computer. This is a case where...
2009-05-05
1,971 reads
In the course of giving my security presentations over the past year, I've learned that quite a few folks have never seen the C-I-A triad before. The C-I-A triad stands for...
2009-04-27
4,580 reads
In a previous blog post on Detecting When a Login Has Implicit Access to a Database, I mentioned that having CONTROL SERVER rights means having implicit rights into the databases. Robert Davis posted a comment asking if there was a difference with respect to explicit permissions between being a member of the sysadmin fixed server role and having CONTROL SERVER rights.
2009-03-16
3,550 reads
By Steve Jones
dorgone– adj. wondering if you could slip away from an event or group conversation...
By ReviewMyDB
Many of us use AI the same way every single day. Open a tab....
By SQLPals
SQL Server Transaction Log Forensics: Preserving Evidence During an Incident SQL...
Comments posted to this topic are about the item Make It Routine
Comments posted to this topic are about the item Finding Gaps in Sequential Data...
Comments posted to this topic are about the item Negative and Positive Numbers
If I want to know whether a number of negative, positive, or zero, what is the easiest way to get this in T-SQL?
See possible answers