Default Credentials

Question

Default Credentials

Steve Jones - SSC Editor

SSC Guru

Points: 736150
More actions
January 18, 2021 at 12:00 am

#3831160

Comments posted to this topic are about the item Default Credentials

Viewing 5 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply

David.Poole SSC Guru Points: 75999 More actions · Answer 1

There have been a lot of data breaches due to unsecured ElasticSearch clusters. Whether these are default credentials or no credentials whatsoever I'm not sure.

We have various webhooks to reject any commit that has cloud credentials in it.

I think many systems would benefit from a simple guide to securing that system. If it's not possible to secure it in a simple way then it's a cue to improve the system design.

There are still a lot of tools out there that demand SA login. Some even have checks to make sure they have such elevated privilege. Bowen if you run a profile the actual privilege they use is basically db_datareader/db_datawriter at most

LinkedIn Profile

x SSC-Insane Points: 23660 More actions · Answer 2

Theres a fellow I respect very much, who offers a good case on one possible reason we experience IT failures. Pretty much, the amount of IT work that needs to be done has exceeded our ability to provide a qualified workforce that can get that work done sucessfully. This seems to be pretty much industry wide.

I'm not going to mention this guys name because SSC people don't seem to like him.

Tom Uellner SSCrazy Points: 2995 More actions · Answer 3

David.Poole wrote:

There are still a lot of tools out there that demand SA login. Some even have checks to make sure they have such elevated privilege. Bowen if you run a profile the actual privilege they use is basically db_datareader/db_datawriter at most

Cough, Microsoft Dynamics, cough...

x SSC-Insane Points: 23660 More actions · Answer 4

Tom Uellner wrote:

David.Poole wrote:
There are still a lot of tools out there that demand SA login. Some even have checks to make sure they have such elevated privilege. Bowen if you run a profile the actual privilege they use is basically db_datareader/db_datawriter at most
Cough, Microsoft Dynamics, cough...

With Dynamics AX, you don't even create indexes in SQL anymore if I'm not mistaken, its done in the interface, so I think for that one you're going to want some more privileges.