Every so often I run into a fellow DBA or database developer who isn't crystal clear on how file/folder and share permissions play together. If you're an MCSE or an experienced system administrator, this should be old hat for you. However, given...
2009-07-21
2,545 reads
Recently, a fellow DBA showed me a set of documentation on a commercially available product. This is a product people pay money for to license and use. It's not an in-house developed application or a community released free sample.
2009-07-17
2,589 reads
When it comes to securing a system, it's important to understand how it might be attacked. That's what surface area is all about. The surface area is the parts of the system which are exposed. For instance, in the case of a default instance of...
2009-06-10
1,874 reads
Whenever I do a security presentation, I make sure to cover the Principle of Least Privilege. And when I do I boil it down to this very simple definition: Giving the rights to do the job. No more. No less.
2009-06-04
1,912 reads
On a couple of recent webcasts, I pointed out the folks were running with the local Administrator account. To start this out, I'm not a big fan of security by obfuscation. Security by obfuscation (not code obfuscation, but security by obscurity, if...
2009-06-02
2,556 reads
One of the main defenses touted against SQL injection attacks is to use proper parameterization at the application layer. But while this gets most of the cases, there are clearly examples where this alone fails. For instance, consider the stored procedure...
2009-05-20
3,948 reads
This is spurred on by a comment a pen tester made. He was referring to a particular technology and said something to the effect of, "What do you expect? It's 30 year-old technology." I was stunned when the comment was relayed to me. My response...
2009-05-13
2,363 reads
In my security presentations, another basic I talk about is defense-in-depth. The idea here is to produce multiple layers of protection against a particular attack. For instance, imagine malicious code against your home computer. This is a case where...
2009-05-05
1,971 reads
In the course of giving my security presentations over the past year, I've learned that quite a few folks have never seen the C-I-A triad before. The C-I-A triad stands for...
2009-04-27
4,580 reads
In a previous blog post on Detecting When a Login Has Implicit Access to a Database, I mentioned that having CONTROL SERVER rights means having implicit rights into the databases. Robert Davis posted a comment asking if there was a difference with respect to explicit permissions between being a member of the sysadmin fixed server role and having CONTROL SERVER rights.
2009-03-16
3,550 reads
By DataOnWheels
I have been asked many times about how the name “Data on Wheels” came...
Fabric inbound network protection involves two tenant-level controls: Private Link and Block Public Internet...
Most apps that call an LLM send every request to the same model. That...
WhatsApp:0838-3161-8008 Jl. Raya Bekasi No.B-C Km.19 No.30, RT.1/RW.6, Wil, Kec. Pulo Gadung, Kota Jakarta...
WA CS (08218154392)Jl. Raya Serang Km. 24, Kp. Cariu, RT 003/001, Talagasari, Kec. Balaraja,...
WA CS (08218154392) Jl. Kisamaun No.57, RT.001/RW.006, Sukasari, Kec. Tangerang, Kota Tangerang, Banten 15118
Where do I check for the existence of a Database Master Key (DMK) in SQL Server 2025?
See possible answers