Beyond a Normal Report
Have you ever beat your head against the wall trying to get yet another report built for users – or, if you’re using a report, trying to get just a little more information out of that report? Use the right tools to build the reports in the first place and you can empower your users to run their own what-if scenarios, drill down into data and a whole lot more. Check out Business Objects – they have some really solid tools you can use to provide a much more compelling reporting toolset for your applications. Get more information here.
Web Application and Desktop Access Controls with SQL Server
Paul: "We use a similar approach for most desktop applications (we don’t develop web apps).
A role is created for a particular application and windows users that use the application are added to this role. All access to the database is via stored procs and only execute permission on the required procs is granted to the role, rather than the individual windows users. The gotcha in this is that if any procedures use sp_executeSQL, then just granting execute permission will not work , you will need to grant the appropriate permission on the underlying tables. We only use sp_executeSQL for certain selects that can have many parameters where it means that the code is a lot easier to maintain than having several slightly different stored procedures, but it’s all a balance."
This is one of the key defenses as you build your applications, whether they’re web-based applications or desktop applications. If you can put up fences around your access points – control what permissions, rights and access levels they have, you’ll take a big step to protecting your systems. If you’ve locked things down this way – if someone does try to use that database connection in ways you don’t want (read as: Injection), you can know that it won’t execute, won’t have the impact.
I still suggest you put things in place to prevent the access the bad guys need in the first place, but this is just one more layer in having appropriate security in place.
Featured White Paper(s)
Top Ten Steps to Secure Your SQL Server
In most organizations today, business critical and confidential data increasingly resides in Microsoft SQL Server databases. … (read more)
MS SQL Server – An Overview
Whether you’re running a small business that’s ready to take the next step in its growth or an SMB that’s ready to “grow into… (read more)