Allowing users to access only the data they are authorized to access.
12
votes
1answer
746 views
MySQL : Why are there “test” entries in mysql.db?
Recently, I posted an answer to a question about mysql.db.
Then, I got to thinking I should ask everyone this question:
I have noticed for years that upon installation of MySQL 5.0+, mysql.db is ...
48
votes
5answers
3k views
Do stored procedures prevent SQL injection?
Is it true that stored procedures prevent SQL injection attacks against PostgreSQL databases? I did a little research and found out that SQL Server, Oracle and MySQL are not safe against SQL injection ...
10
votes
2answers
220 views
forensically deleting/updating data
I have a need to forensically remove data from oracle. If I just delete it, my understanding is the data will still actually be in the data file until that space is reused. I'm not concerned about the ...
6
votes
2answers
154 views
Limit connection rights on SQL Server
I have an app to deploy in production that uses 'honor system' security. That is, all users connect to the DB using a SQL user/passwd credential and the app manages permissions itself. The latter part ...
1
vote
2answers
4k views
Grant create permission on a specific schema in Oracle 11g
I have two users A and B. I want to grant B the permission to create, drop, etc. all tables in A's schema. As far as I can see, I can grant B full access to all schemas not a specific one. Is this ...
9
votes
3answers
12k views
How do I assign an entire Active Directory group security access in SQL Server 2008?
I would like to use integrated security with my internal application which is all on a domain. Unfortunately, I've never been able to get this to work well. I would like to assign an entire Exchange ...
5
votes
1answer
166 views
Map Oracle roles to Active Directory groups?
Is there any built-in way to map Oracle database roles to Microsoft Active Directory groups?
0
votes
1answer
2k views
Set permissions on all objects for SQL users
I have a procedure that loops through all objects in the database and assigns them proper permissions to that object. I want to know if there is a better way to do this? I use a model database to ...
8
votes
1answer
251 views
Column level security
I am in need of a solution to hide specific columns in a table. We have people who need to build reports against this database and specifically some of these tables with confidential information but ...
4
votes
4answers
668 views
SQL Server script to delete accounts no longer in Active Directory
We have a SQL Server 2000 that will shortly be migrated to SQL Server 2005. It has years of Windows Authentication accounts created that no longer exist in Active Directory, which prevent the Copy ...
1
vote
1answer
169 views
How to do MySQL User Accounting
I can't seem to find any information on this anywhere. I found a question here called Monitor MySQL activity per database? but that's not quite the answer either.
I'd like to be able to log the ...
14
votes
7answers
2k views
Why is it a bad practice to allow everyone to use the sa login?
Even Microsoft discourages the use of SQL Server authentication mode, but our applications require it.
I've read that it's a best practice to not let users use the sa login directly, instead using ...
9
votes
2answers
2k views
How do you reset the sa password?
I lost the sa password on a machine, and when I log in to the machine directly using an account in the admin group, SQL Server Management Studio will not allow me to log in using Windows ...
10
votes
2answers
252 views
Understanding MS SQL Server encryption and backups
So I was asking in chat about how secure SQL Server backup files are.
I'm told that if an attacker has access to the .bak file unencrypted that they can have access to the data.
So lets look at ...
2
votes
3answers
137 views
Working Linked Server Query fails in sp_send_dbmail
Take the following example:
EXEC msdb.dbo.sp_send_dbmail
@recipients = 'me@whatever.co.uk' ,
@query = 'SELECT TOP 10 * FROM LINKEDSERVERA.DATABASE.dbo.TABLE' ,
@attach_query_result_as_file = N'True' ...
2
votes
1answer
188 views
Understanding SQL Server encryption (by password)?
After asking this I still have a question.
A company need to store sensitive data. Please let's not talk about certificate right now.
A DBA does the following :
CREATE SYMMETRIC KEY ...
14
votes
6answers
251 views
Securing DB passwords
Looking at the structure of most PHP/MySQL-based websites I've seen, it appears that it's not terribly difficult to discern the database password if you dig a bit, as there's invariably a setup or ...
5
votes
5answers
886 views
What security threats does the SA account and other known account names pose to security?
Does an known account name like sa, pose a security threat to database? When using windows authentication on SQL Server does it impose the same password policy(if it was set to say account lockout ...
1
vote
2answers
473 views
Any security related reasons to prefer Windows Authentication over Sql Server Authentication?
This is a rather short question:
When using Microsoft SQL Server (version 2005 and newer), are there any security related reasons to prefer Windows Authentication over SQL Server Authentication?
...
-4
votes
2answers
461 views
How database administrators can see my requests to SQL Server?
I'm a SQL Server 2008 user. I have access to some tables. I need to request few columns from table as I usually do. But I need to do it once (for example) in 5 seconds and system administrators ...
9
votes
2answers
1k views
Security for Application Developers doing PL/SQL work in Oracle
How do you handle the lack of Schema level privileges in Oracle? Oracle’s security architecture works well for applications that only need object level privileges and it works well for DBAs that need ...
6
votes
3answers
368 views
Restrict access for Windows administrator
As the SQL Server best practices says, "Windows Authentication mode is more secure than SQL Authentication". And now I want to know: is there a way to protect SQL Server from user with Windows ...
5
votes
1answer
77 views
SA permissions issues with many nested objects
I have a broker application that's relatively complicated.
Today, after I made some changes, I started getting the error:
The server principal 'sa' is not able to access the database 'XYZ' under ...
5
votes
2answers
113 views
Most effective way to determine the minimum set of permissions for user
I have a database that an application connects to using db_owner permissions.
How do I effectively determine the minimum set of requirements actually needed by this user (application) to run without ...
4
votes
1answer
105 views
Security Question involving Sys tables
We have an application user which has been given read write to the appropriate databases. This user has the ability to query the sys tables by default. I've also heard that there are times when this ...
4
votes
2answers
644 views
Does the PCI standard forbid the use of Windows Authentication?
We currently use Mixed Mode for our SQL Server Authentication. I've tried to convince our DBA to allow us to use Windows Authentication so we can use Team Foundation Server, however he absolutely ...
3
votes
2answers
128 views
SQL 2005 Permission Precedence
Very simple question -
I have two database roles (Basic, Admin). Say I explicitly deny the Basic role from deleting from table A and grant that to the Admin role. If I am a user who is in both ...
3
votes
1answer
643 views
SQL: transfer database schema
If i want to transfer schema ownership to another schema i know that i need to use something like:
ALTER SCHEMA destinationschema TRANSFER sourceschema.objectname;
But how is it different from:
...
2
votes
0answers
33 views
Server permissions of an activation stored procedure of a Server Broker queue
I have a stored procedure that queries the sys.dm_exec_requests view. In the stored procedure the view only returns one row, while the stored procedure needs to see all of them. The MSDN article on ...
2
votes
2answers
822 views
How to set Password for sqlplus /as sysdba
I am new to Oracle. I would like to know how to set login password for sqlplus / as sysdba in oracle 11g.
I want to set the password for my next login, i dont want to login as sqlplus / as sysdba ...
2
votes
1answer
738 views
Security permission to only read SSAS Cube with Excel
I have an SSAS database set up on a SQL Server 2008 server. I have a Role set up with a group of users that I want to be able to access the Cubes in that database. I set up "Read definition" and ...
2
votes
2answers
796 views
Best practices to secure mysql
I don't have that much knowledge about mysql and i would like to secure a MySQL server.
We have a few VPS running around the world (6 currently) and they all need to store information in our mySQL ...
0
votes
2answers
425 views
Secure way to connect: Windows Authentication or SQL Server Authentication and why?
Which is the best way to create a connection string for SQL Server?
Should I be using a trusted connection string (windows authentication) or an untrusted connection string (sql server ...
