I work for a small-ish company that currently allows almost everyone to access production databases and run SQL queries (it's a "culture" thing). I need to sell the C-Suite on why this is a bad idea but I am having trouble coming up with all of the reasons why they should disallow that access. Any help here is appreciated.
Just about any one piece of data from this document should be sufficient:
The kicker for me: roughly 75% of all data breaches start internally, with a large chunk of those being accidental breaches as a result of employee mistakes.
The more employees who have access to your data, the more space there is for accidents to happen. Not just the "accidentally drop database" type of accidents (which baldPrussian discusses on in his answer), but the "took a picture at work, posted it on facebook, and didn't notice that my monitor in the background was display the production database password" kind of mistake.
Mistakes like that happen. If it hasn't happened yet, consider yourself lucky. But it will happen, because we are all human. The only question is how much it will cost your company. Accidentally drop your database? If you have a current backup you may only lose a few hours of work: relatively cheap. Disgruntled employee with full access to your production database? Who knows how much that one will cost.
You can talk to Uber about the cost of these things. Their recent data breach was effectively caused by giving too many people access to their production systems. The direct cost in dollars will likely be very large, and many years before they are done paying for it. The legal ramifications will also take years to work out, and no one will be able to measure the loss of reputation from all of this.
h/t to baldPrussian Another big downside of giving everyone direct database access is the complete lack of accountability it creates. Above, I focus on the fact that accidental data breaches from employees are a thing. Unfortunately, intentional data breaches from employees are also a thing. They are less common than accidental breaches, but they do happen. The problem with everyone getting full database access is that if data gets leaked, stolen, or maliciously modified, your chances of properly identifying the problem employee are substantially decreased.
Having worked predominantly for and with small businesses, I know that there is very much an attitude of trust. When everyone knows everyone (and knows their kids by name), everything starts from the perspective of "This is a good person. I don't have to worry about them. Let's let them have access so they can do their job easier". I'm sure this is how your company approaches the problem. They are operating from a position of implicit trust. As a result, I think your best bet is to focus on the potential damage done by accidental mistakes. The issue is not that they can't trust their employees, but their employees are people and make mistakes just like the rest of it. The more people you have who have direct access to the center of your business, the more likely it is that someday someone will do something that will accidentally nuke your business. Again, this stuff happens. If you need another example, just ask Pixar:
Because if you don't set up rights EXACTLY right, your users are 2 mouse clicks away from dropping the main table of your database.
You probably have confidential/proprietary data in there that not everyone needs rights to.
A poorly-written query will give a cartesian product, dragging performance down for all users. (I've seen this repeatedly)
Production data needs to be protected against accidental alteration. You may have confidentiality, HIPAA and/or SOX compliance issues if you don't protect that data from accidental access/alteration.
Adding based on a comment I made below...
It's important that changes to data can be audited and tracked. Generally in small companies, there is one account for access to the database and that account is shared. I've even seen where that shared account was the sa account! When accounts are shared, the only thing that you know is that data was changed and when, but there's no way of proving conclusively who is accountable for the change.