Allowing users to access only the data they are authorized to access.
3
votes
3answers
2k views
SQL Server: does ddladmin rights contain datareader and datawriter rights to the database?
Does db_ddladmin fixed database role include db_datareader and db_datawriter rights, so that you don't have to grant those rights explicitly?
6
votes
2answers
252 views
How can I secure my database code?
We have a lot of proprietary database code that is simply encrypted using the "WITH ENCRYPTION" option. Unfortunately, this is a very weak method of securing database code.
Is there any better way ...
7
votes
1answer
1k views
Understanding SQL Server permissions
I am rooting around in SQL Server Management Studio against my instance of SQL Server 2008 R2 Express Edition. I am trying to understand how the permissions work.
What I can see is (via the ...
3
votes
2answers
928 views
Role db_ddladmin not working properly on SQL Server 2008
I want to allow certain user to create/modify objects on a database(tables, views, sp's, functions, schemas etc) and don't want to give db_owner.
I thought I could do it with the db_ddladmin role, ...
1
vote
1answer
196 views
SQL Server Schema Security
My company uses a multi-tenant database (one database, all tables have a customerID field).
We are in the process of setting up a data warehouse and giving clients direct access. Our initial ...
8
votes
4answers
260 views
What would I need to do to make sure my DB policies have to pass a security audit?
I have an audit coming up, and I was wondering what physical, electronic, and logical access controls an auditor would look for when auditing a database for an ERP system. I'm really new to this ...
2
votes
3answers
749 views
SQL Server Permission Denied Error When I'm DBOwner?
So I created an account, gave him dbcreator and securityadmin privileges and then through that account tried to run CREATE TABLE on a database that I had created and now owned, but was getting a ...
5
votes
1answer
752 views
Using integrated security over VPN
We've got a client that we're going to allow to use one of our applications. Staff on site regularly connect to our network via VPN. The .Net application that connects to the SQL Server uses ...
3
votes
1answer
643 views
SQL: transfer database schema
If i want to transfer schema ownership to another schema i know that i need to use something like:
ALTER SCHEMA destinationschema TRANSFER sourceschema.objectname;
But how is it different from:
...
9
votes
3answers
286 views
Any pointers on reducing my privileges in production but not making my job excessively difficult
Running SQL Server 2005 and 2008 on Windows 2008 R2.
We're going to be reducing privileges in production for developers - and I'd like to do the same for myself as a DBA, limiting rights to ...
2
votes
2answers
566 views
Is encrypted database possible?
I'm not a DBA but I've been asked to see if we can encrypt the data in sql server such that the admin, despite having access to SQL Server won't be able to see the data but application would still be ...
1
vote
1answer
3k views
tsql to find users and database level permissions mapped to a certificate
On SQL 2005 and above, how can I find users and database level permissions mapped to a certificate?
Story behing this:
I copied a database from SQL 2005 to SQL 2008. It had a certificate inside the ...
2
votes
2answers
3k views
How do I fix a login timout in SQL Server 2005 when using a linked server and a stored procedure called from a SQL Agent Job?
I have a sql agent job running on ServerA. This job executes a stored procedure ServerA.DatabaseA.dbo.SPROC_A, inside this SPROC there is a query that selects data from ...
5
votes
2answers
3k views
The SELECT permission was denied on the (View) object after explicit grant select on view to user
I have a database with a View Named '1098Statement'
We are doing testing for an application with user name 'appuser'.
I have tried the following solutions to granting select on the view and keep ...
5
votes
1answer
340 views
How can I make the audit system create new audit files if they already exist?
I am trying to make my audit files easier to read, I have audit trail configured as xml,extended. The problem is that if my server gets busy and reuses the pids - the logs are being appended to the ...
19
votes
4answers
5k views
Why is OS authentication considered poor security for Oracle databases?
Oracle is deprecating OS authentication according to the Oracle Database Security Guide, which says
Be aware that the REMOTE_OS_AUTHENT
parameter was deprecated in Oracle
Database 11g Release ...
5
votes
5answers
886 views
What security threats does the SA account and other known account names pose to security?
Does an known account name like sa, pose a security threat to database? When using windows authentication on SQL Server does it impose the same password policy(if it was set to say account lockout ...
9
votes
2answers
1k views
Security for Application Developers doing PL/SQL work in Oracle
How do you handle the lack of Schema level privileges in Oracle? Oracle’s security architecture works well for applications that only need object level privileges and it works well for DBAs that need ...
4
votes
2answers
331 views
different login credentials based on user
I run a PHP symfony-framework web app for my company and it uses a single database login for all connections, whether the user is an admin or a client.
I know that higher security systems often use ...
14
votes
6answers
251 views
Securing DB passwords
Looking at the structure of most PHP/MySQL-based websites I've seen, it appears that it's not terribly difficult to discern the database password if you dig a bit, as there's invariably a setup or ...
