Security Basics: Understanding the Surface Area
When it comes to securing a system, it's important to understand how it might be attacked. That's what surface area...
2009-06-01
1,349 reads
Brian Kelley
- Interests: Chess, Reading, Soccer (Football), Baseball, Animals, Theology
Security Basics: Applying the Principle of Least Privilege Properly
Whenever I do a security presentation, I make sure to cover the Principle of Least Privilege. And when I do...
2009-05-29
3,163 reads
Why I Say Something about Running as Administrator
On a couple of recent webcasts, I pointed out the folks were running with the local Administrator account. To start...
2009-05-28
2,179 reads
Catalog view: sys.tcp_endpoints
I was playing around with the endpoint catalog views this afternoon just looking at ways to do poor man's configuration...
2009-05-27
2,844 reads
Speaking at Augusta Developer's Guild
Tomorrow night, May 28th, I'll be speaking the Augusta Developer's Guild. This is a make-up from earlier in the year...
2009-05-27
1,390 reads
SQL Injection - Why I Don't Think Parameterization is Enough
One of the main defenses touted against SQL injection attacks is to use proper parameterization at the application layer. But while this gets most of the cases, there are clearly examples where this alone fails. For instance, consider the stored procedure...
2009-05-20
3,948 reads
Sick? Stay home!
Yesterday I did something I wouldn't have thought of doing a year ago: I stayed home. When I woke up,...
2009-05-19
860 reads
SQL Injection - Why I Don't Think Parameterization is Enough
Note:Since there have been several comments on this, I'm using parameterization at the application layer in the security sense of...
2009-05-15
2,710 reads
Rant: Is It an Effective Control or Not?
This is spurred on by a comment a pen tester made. He was referring to a particular technology and said something to the effect of, "What do you expect? It's 30 year-old technology." I was stunned when the comment was relayed to me. My response...
2009-05-13
2,363 reads
Rant: Is It an Effective Control or Not?
This is spurred on by a comment a pen tester made. He was referring to a particular technology and said...
2009-05-05
1,257 reads
Blogs
Experimenting with CHOOSE: #SQLNewBlogger
By Steve Jones
I was looking over the CHOOSE() function while editing an article at SQL Server...
Fighting Procrastination?
By Brian Kelley
Here is another short video (~ 15 minutes). This is by the author of...
A Fun Prize at the PASS Data Community Summit
By Steve Jones
I had a briefing for the 2026 PASS Data Community Summit, which is just...
Forums
SQL Server 2025 Server-level Roles
Comments posted to this topic are about the item SQL Server 2025 Server-level Roles
Stairway to DAX and Power BI - Level 29: The DAX Combine & Aggregate Functions
Comments posted to this topic are about the item Stairway to DAX and Power...
AI Is Improving Security
Comments posted to this topic are about the item AI Is Improving Security
Question of the Day
SQL Server 2025 Server-level Roles
In SQL Server 2022+, what does the ##MS_DatabaseConnector## role allow?
See possible answers