Brian Kelley

Brian Kelley is an author, columnist, and Microsoft SQL Server MVP focusing primarily on SQL Server security. He is a contributing author for How to Cheat at Securing SQL Server 2005 (Syngress), Professional SQL Server 2008 Administration (Wrox), and Introduction to SQL Server (Texas Publishing). Brian currently serves as an infrastructure and security architect. He has also served as a senior Microsoft SQL Server DBA, database architect, developer, and incident response team lead.

Interests: Chess, Reading, Soccer (Football), Baseball, Animals, Theology

All authors

Balancing Priorities

by Brian Kelley

Databases – Infrastructure – Security

This one isn't a technical post, but it's entirely appropriate to those of us in the IT field. Today was a...

2009-06-02

772 reads

Why I Say Something about Running as Administrator

by Brian Kelley

SQLServerCentral.com

Blogs

On a couple of recent webcasts, I pointed out the folks were running with the local Administrator account. To start this out, I'm not a big fan of security by obfuscation. Security by obfuscation (not code obfuscation, but security by obscurity, if...

★ ★ ★ ★ ★ ★ ★ ★ ★ ★

You rated this post out of 5. Change rating

2009-06-02

2,556 reads

Security Basics: Understanding the Surface Area

by Brian Kelley

Databases – Infrastructure – Security

When it comes to securing a system, it's important to understand how it might be attacked. That's what surface area...

2009-06-01

1,323 reads

Security Basics: Applying the Principle of Least Privilege Properly

by Brian Kelley

Databases – Infrastructure – Security

Whenever I do a security presentation, I make sure to cover the Principle of Least Privilege. And when I do...

2009-05-29

3,154 reads

Why I Say Something about Running as Administrator

by Brian Kelley

Databases – Infrastructure – Security

On a couple of recent webcasts, I pointed out the folks were running with the local Administrator account. To start...

2009-05-28

2,157 reads

Catalog view: sys.tcp_endpoints

by Brian Kelley

Databases – Infrastructure – Security

I was playing around with the endpoint catalog views this afternoon just looking at ways to do poor man's configuration...

2009-05-27

2,821 reads

Speaking at Augusta Developer's Guild

by Brian Kelley

Databases – Infrastructure – Security

Tomorrow night, May 28th, I'll be speaking the Augusta Developer's Guild. This is a make-up from earlier in the year...

2009-05-27

1,379 reads

SQL Injection - Why I Don't Think Parameterization is Enough

by Brian Kelley

SQLServerCentral.com

Blogs

One of the main defenses touted against SQL injection attacks is to use proper parameterization at the application layer. But while this gets most of the cases, there are clearly examples where this alone fails. For instance, consider the stored procedure...