PERMISSION LEVEL FOR PROGRAMMERS

Question

Post reply

PERMISSION LEVEL FOR PROGRAMMERS

vavadie

Old Hand

Points: 300
More actions
October 21, 2003 at 10:16 am

#160038

Does anyone give programmers permissions to do export\import table transfers to a production server?
It appears that my company wants to allow them to bypass the dba. Is the ddladmin the best level of security before opening up to sa? I am against this move and have no say.

Viewing 9 posts - 1 through 8 (of 8 total)

You must be logged in to reply to this topic. Login to reply

Frank Kalis SSC Guru Points: 111183 More actions · Answer 1

This topic has been discussed several times here. So when you do a search you will find some threads on this.

Common opinion was not to give programmers permissions to production servers, if I recall right.

When our intranet server is up again , I will post the links to the threads I mentioned above.

Frank

http://www.insidesql.de

--
Frank Kalis
Microsoft SQL Server MVP
Webmaster: http://www.insidesql.org/blogs
My blog: http://www.insidesql.org/blogs/frankkalis/[/url]

Frank Kalis SSC Guru Points: 111183 More actions · Answer 2

http://qa.sqlservercentral.com/forum/topic.asp?TOPIC_ID=14368&FORUM_ID=61&CAT_ID=5&Topic_Title=Bad+practices&Forum_Title=Anything+that+is+NOT+about+SQL%21

http://qa.sqlservercentral.com/forum/link.asp?TOPIC_ID=16123

HTH

Frank

http://www.insidesql.de

Edited by - Frank Kalis on 10/22/2003 02:32:25 AM

--
Frank Kalis
Microsoft SQL Server MVP
Webmaster: http://www.insidesql.org/blogs
My blog: http://www.insidesql.org/blogs/frankkalis/[/url]

vavadie Old Hand Points: 300 More actions · Answer 3

Thanks for the links but I have already read them using the search. It does not address my questions specifically.

Frank Kalis SSC Guru Points: 111183 More actions · Answer 4

Well, db_ddladmin also include the DROP statement permission AFAIK. I'm not sure if this is what you or your company wants on a production server.

Frank

http://www.insidesql.de

--
Frank Kalis
Microsoft SQL Server MVP
Webmaster: http://www.insidesql.org/blogs
My blog: http://www.insidesql.org/blogs/frankkalis/[/url]

Sopheap Suy SSCertifiable Points: 7893 More actions · Answer 5

vavadie,

If you really do have no say, then say nothing. At the same time don't give any more permission then what they already have. Just told them that programers already has the permission to perform his duty as a programmer. Anything beyond this point is not a no no. If they are really pushing it hard then you just have to tell your company that those programmers are held personally liable for anything that happen on your server, and you are no longer on leach if the web pages/application no longer work because of missing data, missing stored proc, views or table ... etc.

mom

K. Brian Kelley SSC Guru Points: 114532 More actions · Answer 6

I disagree with say nothing. Use the opportunity to educate (in a gentle and calm manner) the risks. Do a risks versus functionality trade-off. Let them know, based on your understanding, what the developers actually need and recommend giving them no more. Cite the Principle of Least Privilege. Provide references to where such topics are discussed.

Then let management decide. You've offered your input and made them aware of what the issues are. If they feel it is in the best interest of the business to allow such access, they've done so with the information they need to make the decision. This protects you.

Later on, if there is a security breach and it is related to the elevated permissions, no one can point the finger at the DBA and ask, "Why didn't you tell us this was possible?" Also, should an outside audit agency come in and flag the permissions, again they can't come back and say, "Why didn't you tell us?" Or at least, if they do, you can provide the evidence that shows what you told them and when.

K. Brian Kelley

http://www.truthsolutions.com/

Author: Start to Finish Guide to SQL Server Performance Monitoring

http://www.netimpress.com/

K. Brian Kelley
@kbriankelley

vavadie Old Hand Points: 300 More actions · Answer 7

gee mom, I had I'd known you were into SQL I would have called you direct. I know you say not to get involved and not say anything but you have to stand up for what is right, then wash your hands when something goes wrong because you are no longer held accountable. It's just a sad situation when Managers compromise.

So they have ddladmin premissions until I come up with another way around these imports.

Thanks again for all of your suggestions.

Sopheap Suy SSCertifiable Points: 7893 More actions · Answer 8

vavadie,

How did you take your approach? I want to learn from you too.

I was grumbling yesterday...so my response was a bit not too well. Brian was right though.

If you think you know me personally, go ahead I'll take your call any time as long as it's before 9:00 PM and after 6:00 AM 🙂 or i'll be grumbling at you.

mom