2

I work for a small-ish company that currently allows almost everyone to access production databases and run SQL queries (it's a "culture" thing). I need to sell the C-Suite on why this is a bad idea but I am having trouble coming up with all of the reasons why they should disallow that access. Any help here is appreciated.

  • 4
    I mildly recommend creating a read-only copy for ad-hoc queries, so as to avoid resistance to your eventual proposals. – davecb Dec 12 '17 at 20:40
  • @davecb That will forestall the worst of the potential problems (bad query, dropping tables, alteration of data). It won't help with confidentiality, but that's a different beast. I like the idea of taking this piecemeal - if OP tries to do too much too soon, they'll run into a lot of resistance. – baldPrussian Dec 12 '17 at 21:08
5

Just about any one piece of data from this document should be sufficient:

http://pages.clearswift.com/rs/591-QHZ-135/images/Clearswift_Insider_Threat_Index_2015_US.pdf

The kicker for me: roughly 75% of all data breaches start internally, with a large chunk of those being accidental breaches as a result of employee mistakes.

The more employees who have access to your data, the more space there is for accidents to happen. Not just the "accidentally drop database" type of accidents (which baldPrussian discusses on in his answer), but the "took a picture at work, posted it on facebook, and didn't notice that my monitor in the background was display the production database password" kind of mistake.

I once had an employee post a video to facebook from his office, and in it his camera panned nice and slow across his monitor, showing all the code he had been actively working on at that moment. Fortunately it was just front-end javascript and had no access credentials in it, but I nearly had a heart-attack.

Mistakes like that happen. If it hasn't happened yet, consider yourself lucky. But it will happen, because we are all human. The only question is how much it will cost your company. Accidentally drop your database? If you have a current backup you may only lose a few hours of work: relatively cheap. Disgruntled employee with full access to your production database? Who knows how much that one will cost.

You can talk to Uber about the cost of these things. Their recent data breach was effectively caused by giving too many people access to their production systems. The direct cost in dollars will likely be very large, and many years before they are done paying for it. The legal ramifications will also take years to work out, and no one will be able to measure the loss of reputation from all of this.

Audit Trails!

h/t to baldPrussian Another big downside of giving everyone direct database access is the complete lack of accountability it creates. Above, I focus on the fact that accidental data breaches from employees are a thing. Unfortunately, intentional data breaches from employees are also a thing. They are less common than accidental breaches, but they do happen. The problem with everyone getting full database access is that if data gets leaked, stolen, or maliciously modified, your chances of properly identifying the problem employee are substantially decreased.

Summary

Having worked predominantly for and with small businesses, I know that there is very much an attitude of trust. When everyone knows everyone (and knows their kids by name), everything starts from the perspective of "This is a good person. I don't have to worry about them. Let's let them have access so they can do their job easier". I'm sure this is how your company approaches the problem. They are operating from a position of implicit trust. As a result, I think your best bet is to focus on the potential damage done by accidental mistakes. The issue is not that they can't trust their employees, but their employees are people and make mistakes just like the rest of it. The more people you have who have direct access to the center of your business, the more likely it is that someday someone will do something that will accidentally nuke your business. Again, this stuff happens. If you need another example, just ask Pixar:

https://thenextweb.com/media/2012/05/21/how-pixars-toy-story-2-was-deleted-twice-once-by-technology-and-again-for-its-own-good/

  • 2
    I'd add that in small companies, the database administrator is usually also "sa" with the default password, which is also shared among everyone wanting access. Have fun with that audit trail... – baldPrussian Dec 12 '17 at 22:12
5

Because if you don't set up rights EXACTLY right, your users are 2 mouse clicks away from dropping the main table of your database.

You probably have confidential/proprietary data in there that not everyone needs rights to.

A poorly-written query will give a cartesian product, dragging performance down for all users. (I've seen this repeatedly)

Production data needs to be protected against accidental alteration. You may have confidentiality, HIPAA and/or SOX compliance issues if you don't protect that data from accidental access/alteration.

Adding based on a comment I made below...

It's important that changes to data can be audited and tracked. Generally in small companies, there is one account for access to the database and that account is shared. I've even seen where that shared account was the sa account! When accounts are shared, the only thing that you know is that data was changed and when, but there's no way of proving conclusively who is accountable for the change.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.