Editorials

Surprise Users in Your Database?

Webcast: Tools for SQL Server Backup Heroes
Recent trends in the database industry have lead to a number of challenges for managing SQL Server. Most databases grow in size over time. Regulatory requirements mandate maintaining certain amounts of data online. Users also want to see more of their data. And the number of users for database applications grows over time as users discover where relevant data is located. To address these challenges, DBAs and other IT professionals must look to new technology to continue to perform their jobs effectively and in the same amount of time. In this session, we’ll explore the challenges of increased storage and consolidation, log shipping, clustering and other solutions to help the true heroes of SQL Server meet the test.

> Register Now
> Webcast date/time: 6/10/2009 at 12:00pm Noon Pacific

Featured Article(s)
The Dynamic Tally or Numbers Table
Comparision of different methods of creating a dynamic tally or numbers table.

SQL Server Video Program
(133) SelectViews: Proof: Chris Shaw talks to himself(!) plus interview with Paul Nielsen, Brent Ozar and Encryption. Information about the upcoming vWorkshop, tips, experiences and more.
[Watch the Show]

Previously:
[Watch] Snapshots as Backups? David Penton, Keeping Customers, Database Inventory and More
[Watch] Christopher Regan, Donald Belcham, John Welch
[Watch] Herve Roggero, Jason Strate, and TJ Belt

We’re Establishing a User Panel – Interested?
We’re looking for only about 30 people that may be interested in joining our user panel. This panel will help review some ideas, thoughts and approaches to different features here at SSWUG.ORG. Active participation will be a maximum of 1 online meeting per month to review ideas and membership and/or vConference attendance will be provided as our thanks. If you’re interested, please send a note to me here and let me know the following in order to be considered:

– Are you currently a full, paying member of SSWUG.ORG?
– Have you attended a SSWUG.ORG vConference?
– Are you a full-time or part-time database professional?
– Where are you located (Country)? Timezone?
– Do you use SKYPE?

** There are no right answers, these just help us understand how best to possibly work with you.

Send in your request here.

Surprise Users in Your Database?
I was reading an ad (!) for Cyber-Ark – they make some interesting and good points about security in the multi-page spread. Specifically, they’re talking about users, accounts, logins and such. I must admit, it had me thinking about all of the sort-of stealth accounts that we all probably have on our systems, and wondering about a commonly-cited best practice.

The unknown accounts come many times from applications. You install the application, it needs DBO-type access to run setup scripts and get things going. Once the application is up and running, it maintains that access level, perhaps even adding other accounts for specific operations. This suggests, strongly, that you need to be auditing the logins for your applications and making sure you’re well-aware of what’s accessing your system, what it does and that it does what you expect.

The commonly-cited best practice I’ve often wondered about is not allowing hard-coded application passwords. I see this all the time – that the application logins need to not be coded to include the passwords in the application. I’m not sure what the suggestion is though – can you imagine all of your users needing to have the login for the application? I could make the case that they should be prompted for, and login with, their user name and password specifically. That username and password is granted appropriate rights, permissions and access for the application. Yes, I do understand that approach. But what happens with applications that are doing non-user-interaction stuff? How can you possibly avoid having the user names and passwords coded for the application? Seems counter-intuitive to the point of "ah, the heck with it, I’ll ignore the loophole."

Featured White Paper(s)
Protecting Microsoft SQL in Physical and Virtual Environments
If you are involved with managing Microsoft SQL Server applications, youll want to download this paper to learn: – The pri… (read more)