Brian Kelley

Brian Kelley is an author, columnist, and Microsoft SQL Server MVP focusing primarily on SQL Server security. He is a contributing author for How to Cheat at Securing SQL Server 2005 (Syngress), Professional SQL Server 2008 Administration (Wrox), and Introduction to SQL Server (Texas Publishing). Brian currently serves as an infrastructure and security architect. He has also served as a senior Microsoft SQL Server DBA, database architect, developer, and incident response team lead.

Interests: Chess, Reading, Soccer (Football), Baseball, Animals, Theology

All authors

Speaking at Augusta Developer's Guild

by Brian Kelley

Databases – Infrastructure – Security

Tomorrow night, May 28th, I'll be speaking the Augusta Developer's Guild. This is a make-up from earlier in the year...

2009-05-27

1,377 reads

SQL Injection - Why I Don't Think Parameterization is Enough

by Brian Kelley

SQLServerCentral.com

Blogs

One of the main defenses touted against SQL injection attacks is to use proper parameterization at the application layer. But while this gets most of the cases, there are clearly examples where this alone fails. For instance, consider the stored procedure...

★ ★ ★ ★ ★ ★ ★ ★ ★ ★

You rated this post out of 5. Change rating

2009-05-20

3,948 reads

Sick? Stay home!

by Brian Kelley

Databases – Infrastructure – Security

Yesterday I did something I wouldn't have thought of doing a year ago: I stayed home. When I woke up,...

2009-05-19

840 reads

SQL Injection - Why I Don't Think Parameterization is Enough

by Brian Kelley

Databases – Infrastructure – Security

Note:Since there have been several comments on this, I'm using parameterization at the application layer in the security sense of...

2009-05-15

2,699 reads

Rant: Is It an Effective Control or Not?

by Brian Kelley

SQLServerCentral.com

Auditing

This is spurred on by a comment a pen tester made. He was referring to a particular technology and said something to the effect of, "What do you expect? It's 30 year-old technology." I was stunned when the comment was relayed to me. My response...

★ ★ ★ ★ ★ ★ ★ ★ ★ ★

You rated this post out of 5. Change rating

2009-05-13

2,363 reads

Rant: Is It an Effective Control or Not?

by Brian Kelley

Databases – Infrastructure – Security

This is spurred on by a comment a pen tester made. He was referring to a particular technology and said...

2009-05-05

1,243 reads

Security Basics: Defense-in-Depth

by Brian Kelley

SQLServerCentral.com

Blogs

In my security presentations, another basic I talk about is defense-in-depth. The idea here is to produce multiple layers of protection against a particular attack. For instance, imagine malicious code against your home computer. This is a case where...