Voice of the DBA

Category: Blog

  • The Principle of Least Privilege

    One of the tenets of good security is that no person or process is granted more rights than it needs to accomplish a task. This is the Principle of Least Privilege, and is designed to ensure that your system is as secure, stable, and predictable as possible.

    For a SQL Server instance, this means that unless a person or process needs to perform instance level changes (configuration, patching, etc.), then they should not have instance level privileges. If a process accesses data in a database, there is no need to grant sysadmin privileges, even if they do need db_owner privileges.

    Many software packages require sysadmin access be granted, often without any justification. Developers build software as a sysadmin on their own workstation, or on a development server. They often don’t understand or realize that less privileges will still allow their software to work. As a result we find software running under elevated privileges, which can be a security risk if there are bugs or injection holes in the software.

    It’s hard to make changes later on, and it can be frustrating to argue with vendors that their software doesn’t need elevated privileges. The best way to combat this is to educate yourself and any developers you know about security.

    Adding login or user accounts does not require sa privileges. The securityadmin and db_securityadmin roles can be used. The rights to create objects in a database can be handled with granular permissions in a schema, or with the db_ddladmin role instead of db_owner.

    Work with limited rights when you can, and help other learn how to work with the minimum they need and we’ll all be more secure.

  • Annual Email Pruning

    Like most of us, I get a lot of email. I get subscribed to various services from different ads, events, etc. throughout the year. That’s fine. I understand how marketing works, and the reason that I get some free services, or some lower cost events is because of the marketing that comes through email newsletters or other information. The reason SQLServerCentral was able to grow and survive was because of marketing, and our email newsletter, which I’m thankful so many of you subscribe to on a daily basis.

    I like to think that the SQLServerCentral newsletters are interesting and worth your time to glance at. I don’t expect most of you to read them every day, but I do think that it must be interesting more often than not for your to keep subscribing. I know the Database Weekly ones are, and I hear from more than a few of you if we ever end up forgetting to send one out.

    Over the last few weeks, I’ve undertaken an annual tradition of weeding out some of the email advertisements I get. As new mail arrives in my inbox. I make a quick evaluation of whether or not I’ve been reading the other mail from this particular sender and if it’s valuable. If not, I’m unsubscribing.

    I do this periodically on Twitter as well, cleaning out my timeline if I find someone posting in there things that aren’t interesting enough for me to continue following them.

    Time is one of my most valuable resources. I’m willing to give vendors and people a chance to prove that they add something to my workday, but if they don’t, then I let them go.

    BTW: If there are things you’d like to see improved at SQLServerCentral or Database Weekly, let our webmaster know or post a note in the forums.

  • The First Event of 2013 – SQL Saturday #183 – Albuquerque

    I’ll be delivering the Modern Resume presentation at SQL Saturday #183 in Albuquerque, NM on February 9, 2013. I got my acceptance today and replied that I’ll be there.

    This is the first SQL Saturday in New Mexico, which is a little exciting. I’ve been there a few times since my brother used to live there and thought it was a neat city. I’m looking forward to going back and wandering around for an afternoon before the event.

    If you’re anywhere nearby, register and come to the event. It should be a lot of fun.

  • You Need to Manage Passwords

    I saw a note this week from CNet about a system built to crack passwords (also on ArsTechnica). It reminded me of the story of the guy that cracked Googles DKIM key at 512bits. Not insignificant, until you get to the point of renting that power from AWS for tens of dollars.

    Here’s a great comic on the subject of passwords: Password Strength. It’s got some good advice, but there’s more to it than just having a good strong password. You need to manage your passwords, as in you need to have lots of them.

    Doubt that? Here’s a good piece from Troy Hunt.

    You need a password manager. Whether you use 1Password, KeePass, or PasswordSafe (my choice), choose one and set the defaults to something long. I’ve been using 12characers, but I’ve moved to 16 for my passwords. All of these work cross platform, and you can sync your files between devices.

    One more thing: you need to rotate passwords. Not just on your password manager, but on your various sites. If someone gets a copy of your password manager file, then it’s just a matter of time before they can crack it. Within months, they could have all the passwords in your file if they were determined.

    Lots of passwords I’m not overly worried about, but some I am. Banks, mail, a few of my profiles, these are important to me, and so I rotate the password periodically on them, using new passwords from my manager.

    Security is hard, and passwords aren’t going away anytime soon. Tell your friends, family, and make sure they all consider using some type of password manager and improving their security.