Shortly our development team will be moving an existing SQL Server 2008R2 instance into our Production environment. Ahead of this I have been asked to review all the code on it for anything malacious (e.g. wiping their own order history from the sales database).
This has come out of the blue and I'm not sure it's particularly physically feasible but I'm willing to give it a good go, at least from the SQL side of things. The question is, where can code exist? My draft list is
- Stored Procedures
- Functions (all)
- Table Triggers
- Assemblies (shouldn't be any by our developers)
- Rules (shouldn't be any by our developers)
- System Database versions of the above, modified by users
- SSIS Packages
- Server Triggers
- Unexpected LinkedServers
- SQL Agent Jobs
- SQL Agent Alerts