Today we have another installment in what is known as TSQL Tuesday. This month we have an invitation and topic given to us by the infamous Kenneth Fisher ( blog | twitter).
Today, the invitation is for us to share our stories on how we like to manage security. Or at least that is the request that was made by Kenneth. I am going to take a bit of a twist on that request. Instead of sharing how I like to manage security, I am going to share some interesting stories on how I have seen security managed.
Let’s just call this a short series on various case studies in how to manage your security in a very peculiar way. Or as the blog title suggests, how to manage your security as an afterthought.
Case Study #1
We have all dealt with the vendor that insists on the user account that will be used for their database and application be one of two things. Either it needs to be sa or needs to be a member of the sysadmin fixed server role. The ensuing discussion with those vendors is always a gem. They insist the application will break, you as the diligent DBA prove otherwise, and then the senior manager sponsoring the application comes around with a mandate that you must provide the access the vendor is requesting.
Those are particularly fun times. Sometimes, there is a mutual agreement in the middle on what security can be used and sometimes the DBA just loses.
But what about when it is not a vendor application that mandates such relaxed security for their application and database? What if it happens to be the development group? What if it happens to be a developer driven shop and you are the consultant coming in to help get things in order?
I have had the distinct pleasure of working in all of those scenarios. My favorite was a client that hosted ~700 clients, each with their own database. There were several thousand connections coming into the server and every single connection was coming in as ‘sa’. Yes, that is correct. There were no user logins other than the domain admins group on the server – which was also added to the sysadmin security role. That is always a fun discussion to start and finish. The look of color disappearing from the clients’ eyes as the realize the severity of the problem.
Please do not attempt this stunt at home.
Case Study #2
In a similar vain, another one that I have seen far too often is the desire to grant users dbo access within a database. While this is less heinous than granting everybody sysadmin access – it is only a tad better. Think about it in this way – does Joe from financing really need to be able to create and drop tables within the accounting database? Does Marie from human resources need to be able to create or drop stored procedures from the HR database? The answer to both should be ‘NO’.
In another environment, I was given the opportunity to perform a security audit. Upon looking over things, it became very clear what the security was. Somebody felt it necessary to add [Domain Users] to the dbo role on every database. Yes, you read that correctly. In addition to that, the same [Domain Users] group was added to the sysadmin server fixed security role. HOLY COW!
In this particular case, they were constantly trying to figure out why permissions and objects were changing for all sorts of things within the database environment. The answer was easy. The fix is also easy – but not terribly easy to accept.
Please do not attempt this stunt at home.
Case Study #3
I have encountered vendor after vendor that has always insisted that they MUST have local admin and sysadmin rights on the box and instance (respectively). For many this is a grey area because of the contracts derived between the client and the vendor.
For me, I have to ask why they need that level of access. Does the vendor really need to be able to backup your databases and investigate system performance on your server? Does that vendor need, or are they even engaged, to troubleshoot your system as a whole? Or, do they just randomly sign in and apply application updates without your knowledge or perform other “routine” tasks unknown to you?
I have seen vendors change permissions and add back door accounts far too often. They seldom if ever are capable of providing the level of support necessary when you are stuck with deadlocks by the second or blocking chains that tie up the entire server. In addition, they are generally unavailable for immediate support when a production halting issue arises in their application – or at least not for a few hours.
This is specifically in regards to application vendors. They are not your sysadmin and they are not your DBA. If they must have RDP access or access to the database – put it under tight control. Disable the account until they request access. Then a request can be made and a note documented about why the access is needed. Then the account can be enabled, monitored and disabled after a specified amount of time.
Please do not attempt this stunt at home.
This also changes when that vendor happens to be providing you IT functionality and is not specifically tied to an application. Those relationships are a bit different and do require a little more trust to the person who is acting on your behalf as your IT staff.
Conclusion
I have shared three very dangerous stunts that are sometimes portrayed to be done by professionals. Do not try this in your environment or at home. It is dangerous to treat security with so little concern. Security is not some stunt, and should be treated with a little more care and attention.
If you find yourself in any of these situations, an audit is your friend. Create some audit process within SQL Server or on the Local server to track changes and accesses. Find out what is going on and be prepared to act while you build your case and a plan for implementing tighter security.
