SQL Server vs SQL Server v.Next (SQLServerCentral 2/15/2017)

Click here to subscribe to Sqlservercentral.com

8 years ago

Html
Text

A community of more than 1,600,000 database professionals and growing

Featured Contents

SQL Server vs SQL Server v.Next Compression and its Effects on Performance Extending DevOps practices to SQL Server databases Power BI Custom Visuals Class (Module 37 – Gap Analysis) (From the SQLServerCentral Blogs) DBA 101: What you may be missing with “Missing indexes” (From the SQLServerCentral Blogs)

The Voice of the DBA

What Would Do if Your Company Was Targeted?

Today we have a guest editorial as Steve is out of the office.

Think about what you have in place right now for security and auditing and all the things that go with it, from the load balancer all the way down to permissions on stored procedures. You’ve probably done the easy stuff and some of the hard stuff, and as far as you know, it’s working - your customer data hasn’t been posted for all the world to see.

Now imagine you get an email from your security team stating that they have reason to be believe your company is being targeted and that all precautions should be taken. What do you do next?

To invoke Speed, what do you do?

Part of me says that if there were gaps to be filled it should have been done by now; it’s a little late to require SSL for all traffic or encrypt every laptop (please tell me both are already done!). But practically speaking you can’t just ignore the warning, so what do you do? It’s worth building that list now, before you need it, both of things to do just in case and things that need to be done but haven’t been done yet to time or money constraints (maybe now those will get approved).

As a DBA you might:

Review the list of everyone that is a sysadmin or local admin and remove anyone you can. Change the SA password and require password changes for all Windows accounts that have SQL access. Change all the SQL Service account passwords. Review the logs and make sure whatever auditing you use is working (it captured the password change events for example) and that the logs are being shipped off to a read only repository. Run a full vulnerability scan and fix all the high severity issues, look for recently added ones that might indicate a breach has already happened. Run a virus scan (excluding the MDF/NDF/LDF of course). Test that the monitoring and alerting works by causing multiple failed logins from a temporary account (and then remove it). Review your list of actions to take if errors or other traffic overwhelm your ability to sync to a DR site or exhaust the connection pool.

Then you wait and watch, hoping that you’ve done enough to both stop the attack and to let you see that it was stopped.

This is different than responding to an attack. When you can see the attack you can take immediate steps to fight the problem - blocking an IP range for example. It’s harder when the threat hasn’t materialized yet and you’re trying to be ready for anything.

Have you practiced for an attack? What would you add or remove from the list above?

Andy Warren from SQLServerCentral.com

Join the debate, and respond to today's editorial on the forums

The industry standard tools for comparing SQL Server schemas and data

How do you save time comparing and deploying SQL Server database schemas, create error free deployment scripts in minutes, and fix errors caused by differences between databases? Find out with a free trial.

Question of the Day

Today's Question (by Steve Jones):

One of the things that can be helpful in editing code in SSMS 2016 is highlighting a vertical selection of code. What key combination allows me to highlight a box of code, as shown below? ( I have highlighted "Customer" below)

Think you know the answer? Click here, and find out if you are right.

We keep track of your score to give you bragging rights against your peers.
This question is worth 1 point in this category: Management Studio (SSMS).

We'd love to give you credit for your own question and answer.
To submit a QOTD, simply log in to the Contribution Center.

Securing SQL Server - Written by Denny Cherry, a Microsoft MVP for the SQL Server product, a Microsoft Certified Master for SQL Server 2008, and one of the biggest names in SQL Server today, Securing SQL Server, Second Edition explores the potential attack vectors someone can use to break into your SQL Server database as well as how to protect your database from these attacks. In this book, you will learn how to properly secure your database from both internal and external threats using best practices and specific tricks the author uses in his role as an independent consultant while working on some of the largest and most complex SQL Server installations in the world. This edition includes new chapters on Analysis Services, Reporting Services, and Storage Area Network Security.

Get your copy from Amazon today.

Yesterday's Question of the Day

Yesterday's Question (by Steve Jones):

The Database class in SMO represents a SQL Server database. Which of these things is not possible with this class?

Answer: You can do all of these things with the database class.

Explanation:

Actually, all of these things and more can be done with the Database class.

Ref: Database Class - https://msdn.microsoft.com/en-us/library/microsoft.sqlserver.management.smo.database.aspx

Stairway to Server Management Objects (SMO) Level 3: The Database Class - http://www.sqlservercentral.com/articles/Stairway+Series/143969/

» Discuss this question and answer on the forums

Database Pros Who Need Your Help

Here's a few of the new posts today on the forums. To see more, visit the forums.

SQL Server 2016 : SQL Server 2016 - Administration

xp_cmdshell File Copy Failing - "Access Is Denied" - 2 New Windows Servers 2016 running SQL 2016 Standard. No Active Directory. Logged on as my local account (in Windows Administrator...

Re-installing a SQL Server Instance - Hi, I have a need to completely uninstall and re-install SQL Server from several servers but I'd like to preserve as...

SQL Server 2016 : SQL Server 2016 - Development and T-SQL

Running date update - Hi all, I can't think of a fast way of doing this. I would like a query which updates a...

Query never completes with CXPACKET waits - Hi, I have a query that runs in under 40 minutes on our test server but never completes on the production...

SQL Server 2014 : Administration - SQL Server 2014

Multiple Files & disks - One of our production DB is very new and growing at a rate of 8GB per month which is in...

Unexplained jump in Backup File - I hope somebody here can help with this one, it's driving me mad. Up until 1 week ago, our full daily...

Flipping between SIMPLE and FULL recovery mode - Hi, DBA's out there in the big wide world just need some insight I am a SQL Developer (DBA light) and...

Massive disk vs. multiple disks? - In the "old days" is was common for MDF/NDF files of large databases or MDFs of different databases to be spread...

Performance improves after reboot - I am an ETL Developer who was asked to look at SQL Server performance problem. We have two DBA's but they're...

SQL Server 2014 : Development - SQL Server 2014

Slow query performance advice - I've got this slow running query that performs very poorly, or at least that's what my SQL Server monitor is...

Help with Instead of Trigger - I wanted to Validate the code againt the look up table before i insert into a Base table. I have two...

SQL Server 2012 : SQL 2012 - General

PowerShell script to Automate monitor SQL Server error log - Hello Friends, I hope everyone doing well

Latency issues in Transactional Replication - Hi, We have two SQL server 2012 bidirectional transactional replications working correctly. Instance A (active) <-> Instance B (passive - not in use) Instance...

SQL Server 2012 : SQL Server 2012 - T-SQL

Read multiple .sql files having issues with .cmd script :( - Hello, this is part 2/2 of my goal, so i have created a write part and it writes to a share...

Remove partitioning - We have a large table where development created a partitioned unique non-clustered index years ago. The table itself shows as...

Create CSV file using xp_cmdshell - Good day all, I am trying to run a script that will, using xp_cmdshell, create a CSV file. When I did...

Query fills tempdb after upgrade from 2005 to 2012 - Just a quick post before I go to bed for the night... We migrated one of our databases from 2005 to...

SQL Server 2008 : SQL Server 2008 - General

How can i create only 1 Column header per group in SSRS 2008 report - I want to create a group of values with only 1 column header in a SSRS 2008 report In other words...

SQL Server 2008 : T-SQL (SS2K8)

Formula/T-SQL to convert number to time - Hello, This actually may be more of a math problem than anything else.... apologies if inappropriate. We have an application that uses...

SQLServerCentral.com : SQLServerCentral.com Announcements

FAQ: Using the new forum Software (Jan 2017) - After we completed the forum upgrade on Jan 12, 2017, quite a few things changed, so this thread is a...

This email has been sent to newsletter@newslettercollector.com. To be removed from this list, please click here.
If you have any problems leaving the list, please contact the webmaster@sqlservercentral.com.

This newsletter was sent to you because you signed up at SQLServerCentral.com.
Feel free to forward this to any colleagues that you think might be interested.
If you have received this email from a colleague, you can register to receive it here.

Share on

Other newsletters from Sqlservercentral.com

A Trigger... just not that kind Sqlservercentral.com
23 hours ago
Configuring Maintenance Plans in SQL Server (20 24-02-21) Sqlservercentral.com
Last Friday at 08:17
How to Resolve SQL Server Database Stuck in Rec overy Pending State (2025-02-19) Sqlservercentral.com
Last Wednesday at 08:13

More newsletters from Sqlservercentral.com

A community of more than 1,600,000 database professionals and growing

Featured Contents

The Voice of the DBA

What Would Do if Your Company Was Targeted?

Featured Contents