In IT security, we spend so much time trying to protect servers and computers on the wire (or on wireless) that we look at OS patches, firewalls, anti-malware, etc., to protect our systems. We typically assume our physical security is sufficient. But...
2009-07-27
855 reads
Every so often I run into a fellow DBA or database developer who isn't crystal clear on how file/folder and share permissions play together. If you're an MCSE or an experienced system administrator, this should be old hat for you. However, given...
2009-07-21
2,545 reads
Recently, a fellow DBA showed me a set of documentation on a commercially available product. This is a product people pay money for to license and use. It's not an in-house developed application or a community released free sample.
2009-07-17
2,589 reads
When it comes to securing a system, it's important to understand how it might be attacked. That's what surface area is all about. The surface area is the parts of the system which are exposed. For instance, in the case of a default instance of...
2009-06-10
1,874 reads
Whenever I do a security presentation, I make sure to cover the Principle of Least Privilege. And when I do I boil it down to this very simple definition: Giving the rights to do the job. No more. No less.
2009-06-04
1,912 reads
On a couple of recent webcasts, I pointed out the folks were running with the local Administrator account. To start this out, I'm not a big fan of security by obfuscation. Security by obfuscation (not code obfuscation, but security by obscurity, if...
2009-06-02
2,556 reads
One of the main defenses touted against SQL injection attacks is to use proper parameterization at the application layer. But while this gets most of the cases, there are clearly examples where this alone fails. For instance, consider the stored procedure...
2009-05-20
3,948 reads
This is spurred on by a comment a pen tester made. He was referring to a particular technology and said something to the effect of, "What do you expect? It's 30 year-old technology." I was stunned when the comment was relayed to me. My response...
2009-05-13
2,363 reads
In my security presentations, another basic I talk about is defense-in-depth. The idea here is to produce multiple layers of protection against a particular attack. For instance, imagine malicious code against your home computer. This is a case where...
2009-05-05
1,971 reads
In the course of giving my security presentations over the past year, I've learned that quite a few folks have never seen the C-I-A triad before. The C-I-A triad stands for...
2009-04-27
4,580 reads
By Kevin3NF
Everything in SQL Server is waiting for something…this is by design. And most people...
By DataOnWheels
Hey fellow data friends! Wow, March was an absolutely crazy month (in the best...
We value your privacy. This policy explains what personal data we collect and why. What...
Comments posted to this topic are about the item The Subtle Differences Between COALESCE...
Comments posted to this topic are about the item SQL Server Collations
Why would using variables in place of hard coded numbers impact a query's performance? ...
At what levels can we set the collation in SQL Server 2022?
See possible answers