Last week, dbi services organized an event named “SQL Server 2016: what’s new?” in Lausanne, Basel and Zurich. I would take the opportunity to say again a big thank you to everyone which joined us. During my session some questions concerning the new functionality Dynamic Data Masking were asked. In fact data are masked for some roles and not for…
Security is a big topic today and in the news almost every day. As the database usually holds sensitive data this data must be well protected. In most cases this is done by encrypting critical data inside the database and decrypt only when requested. But this is not all: When a client reads the data it is decrypted inside the…
By Franck Pachot . SYSDBA is powerful. You should use it only when you need to. And you should audit what is done when connected SYSDBA. This is achieved by AUDIT_SYS_OPERATION. But do you have an idea how much audit log will be generated? Note that in 12c, AUDIT_SYS_OPERATION=true is the default. The documentation says: AUDIT_SYS_OPERATIONS enables or disables the…
In my last blog post about SQL Server 2016 Always Encrypted, here, I showed how to use this new functionality but also that you have to separate the different execution context with an Application server, a database server and a security server to avoid that certificate will be available for all users and break the segregation. Let’s see how to…
One of the top new features of SQL Server 2016 is the Always Encrypted functionality. Always Encrypted provides that data, store in a database, remains encrypted the all times there are in the database. There is a complete separation between persons who own the data and person who manage it. Only persons who own the data can see plain text…
By Franck Pachot . When you create a DBaaS on the Oracle Cloud services you have to provide an administration password in the database configuration form. You do not need a password to connect to the VM. You use SSH key for it: on creation you provide the public key that will allow you to connect as the oracle user…
Last week I visited the Oracle University Event “Expert Summit 2016” in Berlin, Germany. Besides the nice location in the Adlon Kempinski hotel, close to the Brandenburger Tor, I saw very interesting presentations from Jonathan Lewis (Database Troubleshooting and Tuning) and Pete Finnigan (Oracle Database Security Audit Training). The training from Pete was about how to do a database security…
A customer asks me to find all sql logins enabled on servers where windows authentication only is enabled. The goal is to clean sql logins on all servers through the CMS (central management server). In some cases, sql logins are created even if the authentication is set to “Windows authentication only mode”. I think that this query is interesting and…
The just released version of EDB Postgres Advanced Server 9.5 introduces profiles very much the same as in Oracle. Lets have a look at it. As in Oracle there is a default profile: (enterprisedb@[local]:5445) [postgres] > x Expanded display is on. (enterprisedb@[local]:5445) [postgres] > select * from edb_profile; -[ RECORD 1 ]———–+——– prfname | default prffailedloginattempts | -2 prfpasswordlocktime |…
In PostgreSQL every database contains the public schema by default. Every user that gets created and can login is able to create objects there. Here is a little demo: I’ll create a new user named u1 which is allowed to login. No additional privileges are granted: postgres=# create user u1 login password ‘u1’; CREATE ROLE postgres=# c postgres u1 You…
This blog post will probably not concern customers where either password policy change rules are not defined for service accounts or Kerberos authentication is not used. But I’m sure that the number of these customers has decreased over at least the last decade. By the way, this is what I can notice at different customer places. But before beginning with…
This blog is a part of the series “SQL Server 2016 – Security: Dynamic Data Masking“. I remember you my different logins used to connect to AdventureWorks: sql login u1 with the db_owner role –> No masking sql login u2 with the db_datareader role –> masking The Data Types used are: xml, date, datetime and varbinary. I run this query…
