Tag Info

Hot answers tagged

16

No. While the documentation currently has the following arguably ambiguous statement about what this flag means: Password policy is checked. What it really means, and should say, is that the flag serves two purposes: The password policy might have been checked, but only if (a) the password policy was enabled at the time the password was last ...


3

If you only need to track database access, maybe collecting schema stability locks with extended events is enough. I blogged this idea last week for a totally different reason (tracking unused objects) but the script can be adapted to fit your needs. You can find it here. Basically, it reads an extended events session using the streaming api and then ...


3

Not only is it a best practice, it's mandatory to any major compliance requirements such as PCI V2 & V3, SOX, and almost any auditor will ask about it. Yes, having them on the same network is asking for major problem. Page 5 of the PCI DSS V2: For example, there must be a clear segmentation of functions and segregation of networks with different ...


1

I don't think this is possible for current versions of Oracle. What I understand happens is that Oracle generates an instance-specific salt and adds this to the passwords being hashed using the SHA1 algorithm, the result of which is stored as the hashed password. See for example http://marcel.vandewaters.nl/oracle/security/password-hashes for information ...


1

What if user has login "SCOTT" and password "ScoTt"? Do you still need to find this one? I think what you really need is to set password_verify_function in users profile. See http://docs.oracle.com/cd/E25054_01/network.1111/e16543/authentication.htm#i1007341 for more info.


1

Firebird has had GRANT and REVOKE since its initial version. See the Interbase 6.0 Language Reference, available from http://www.firebirdsql.org/en/reference-manuals/ (near the end of the page). Eg for GRANT: GRANT <privileges> ON [TABLE] {tablename | viewname} TO {<object> | <userlist> | GROUP UNIX_group} | EXECUTE ON PROCEDURE ...


1

I have to say yes. By blocking dev/test you are making sure that application changes are not accidentally updating production data. In many cases sensitive data on dev/test is scrubbed after restore and by blocking you are making certain that no one with access to test can access sensitive data in production. If you are using SQL Server with MSDN licensens ...


1

First let's answer your initial question then your follow up question. I would go further and: change the SQL Server port to a non standard one, turning off the SQL browser service, renaming SA, turning on the firewall on the local machine not to accept any connections on the SQL Server port outside of your internal IPs, and have all of your traffic hit ...


1

Yeah, what the heck is tmp_user? This smells like an attack. And I suspect it was successful. He probably already got in -- all he had to do was to try different flavors of the INSERT based on different versions. The one successful insert would suffice. Then he RENAMEs tables, does damage, rename tables back, DROPs evidence of his naughtiness, and ...



Only top voted, non community-wiki answers of a minimum length are eligible