Suppose you found some malicious code on your system. Maybe it's a login that didn't below at the sysadmin level, or maybe a stored procedure that might disable a trigger, make a change, and re-enable the trigger. What do you do?

Suppose you stumbled upon a strange stored procedure in one of your databases. It wasn't something you had coded, and it appeared to be altering permissions, maybe adding a login, or even querying sensitive data. What do you do?

The easy answer is to delete the procedure and go on about your day. Some of you might save a copy of the code, along with its permissions and make a note to check the system a week or two later and see if it needed to be there.  However I'm not sure that is the best action to take.

If you are unaware of the origins of code, it can be detrimental to your system if you remove object. A legitimate stored procedure might cause application errors, which can result in some type of discipline. At the very least, managers might be upset with you for taking action without understanding the consequences.

I think a different approach might be better. Set up auditing or tracing, focusing on the code and documenting any actions. I would talk to security people and potentially initiate lower level tracing of the network to determine who is making use of this code. If it's truly malicious code, it's not necessarily your job to stop someone. Setting up the honeypot, documenting actions, and then allowing someone else to determine the final action might be the best way to deal with the situation.

Steve Jones

The Voice of the DBA Podcasts

• Windows Media Podcast - MB WMV

  

• iPod Video Podcast - MB MP4

  

• MP3 Audio Podcast - MB MP3

  

The podcast feeds are available at sqlservercentral.mevio.com. Comments are definitely appreciated and wanted, and you can get feeds from there. Overall RSS Feed:

or now on iTunes!

Today's podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

You can also follow Steve Jones on Twitter: