Security

Keep your orapw password file secure

By Franck Pachot . This is a small demo I did when I've found a database password file (orapw) lying around in /tmp with -rw-rw-rw- permissions, to show how this is a bad idea. People think that the orapw file(…)

Pass Summit 2017: how to bypass SQL Server security

Last Friday I saw a very interesting session in Pass Summit 2017 about how to Bypass, or Ensure, SQL Server security by Matt Martin. Matt explained us how to bypass SQL Server security with the complicity of your SQL(…)

PASS SUMMIT 2017 – SQL Server Security

Today is the first day of the PASS SUMMIT 2017 in Seattle (WA). The weather is cloudy and we have only 11°C… but where is the problem? Everything happens inside! (at the Convention(…)

SQL Server 2016: patching CU with R Services

As a good DBA, I begin to be up to date with all Cumulative Update (CU) by my customers. It is the first time that I run an update for SQL Server 2016 with the CU 3. I(…)

SQL Server 2016: Does Dynamic Data Masking works with INSERT INTO and SELECT INTO commands?

I wonder how works Dynamic Data Masking (DDM) with these two commands INSERT INTO  and SELECT INTO. First, I create a table and add some “sensitive data”: USE [DDM_TEST] GO CREATE TABLE [dbo].[Confidential]( [ID] [int] IDENTITY(1,1) NOT NULL PRIMARY KEY(…)

SQL Server 2016: Does Dynamic Data Masking work with Temporal Table?

In the last IT Tagen 2016, I presented the Dynamic Data Masking (DDM) and how it worked. To add a little fun, I applied the DDM to a temporal table to see if the history table inherits also from(…)

SQL Server 2016: Dynamic Data Masking and database role

Last week, dbi services organized an event named “SQL Server 2016: what’s new?” in Lausanne, Basel and Zurich. I would take the opportunity to say again a big thank you to everyone which joined us. During my session some(…)

Securing your connections to PostgreSQL by using SSL

Security is a big topic today and in the news almost every day. As the database usually holds sensitive data this data must be well protected. In most cases this is done by encrypting critical data inside the database and(…)

AUDIT_SYS_OPERATIONS and top-level operation

By Franck Pachot . SYSDBA is powerful. You should use it only when you need to. And you should audit what is done when connected SYSDBA. This is achieved by AUDIT_SYS_OPERATION. But do you have an idea how much audit(…)

SQL Server 2016: Always Encrypted – part 2

In my last blog post about SQL Server 2016 Always Encrypted, here, I showed how to use this new functionality but also that you have to separate the different execution context with an Application server, a database server and(…)