SQL Server Security Auditing

by Steve Laye 17. February 2009 07:39

A huge amount of time is consumed with reverse engineering database topologies and figuring out where connections are being made to and from, security accounts and credentials, DTS package source and destination, SQL Server Agent jobs etc... Normally when a company experiences strong organic growth the documentation and management of database systems is the least concern at that particular time.  The pain point starts when you need to un-pick an individual database or database server and unravel the relationships both tightly and loosely coupled, and often internal and external to the company.  The cost of getting this process wrong or missing out a key configuration consideration depends on the importance of the databases to the companies’ operations, often a little down time or glitches may be tollerable but not if you're trading millions of USD or GBP each hour.  I’m currently working on the backbone trading systems for a large UK hedge fund and it’s surprising to see just how involved it is to unravel the core business applications and the flow of data between these systems.  Turning on SQL Server profiler for 24 hours just won’t cut it if you’re looking to remove users on your new database server that may have left the company 36 months ago.  The amount of effort and time required is often incomprehensible to management and decision makers (basically most non-technical) and the job of producing awareness of the risks, fighting for time to be allocated to the project and the necessary skilled resources will land on the lap of the consultant.  If you are an external contractor or consultant then you have to wear many hats to satisfy your commercial guys and being the incumbent resource on-site.

Currently rated 4.3 by 3 people

  • Currently 4.333333/5 Stars.
  • 1
  • 2
  • 3
  • 4
  • 5

Tags: , , , , ,

Databases | Database Support | Auditing

About the Author

Symtex is a consultancy and development for many Fortune 100 multi-national clients and smaller SME businesses providing consultancy and database development, software development and business intelligence solutions.

You can visit our corporate website or jump directly to specific areas about

Database Development
Business Intelligence (BI)
Software Programming