Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Usually in a well controlled environment, Database Admins are granted specific rights like Read, Modify...etc. No one has the right (ANY) to perform on any Database. Certain requirements dictate to give some users (ANY) permission to the Database they work on.

Q: What are the risk associated with the kind of permission given that all logs are maintained and reviewed on a regular bases and granting this kind of permission is well controlled?

share|improve this question

1 Answer 1

It always comes down to the same thing, the principle of least privilege.

Why would you want to give anyone more permissions than necessary to perform his or her job efficiently? It's just unnecessary risk. Sure, you may have logs in place to track all the actions taken by a particular administrator, but who is going to monitor those logs? How will logs help you if a rouge admin steals your confidential data or drop your production database in the middle of the day? Sure, you can track who did what but the damage has already been done.

share|improve this answer
    
Valid point Terry, but as I mentioned, there is a justifiable need for some applications who access the Databases to have the (ANY) privilege. The monitoring team is has a full time job of reviewing the logs and Databases are backed up very regularly with a BCP in place. Question remains: what are the risks? –  AdnanG Aug 19 '13 at 4:02
    
@AdnanG If the app needs full privileges, give it to them. However, I find that to be very unlikely. An application might possibly require full CRUD permissions on one schema, but they most certainly do not need permissions for any other schema. They most certainly do not need to have the permission to grant other database users permissions as well. –  Terry Chia Aug 19 '13 at 5:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.