Blog

• CRYPT_GEN_RANDOM: Generating Cryptographically Secure Random Numbers in T-SQL

  

  2014-03-17 - Cryptography, General, Security

  While not perfect, the T-SQL function CRYPT_GEN_RANDOM() generates cryptographically secure random number values using the Windows Crypt-API. Read on to get all the details on how to use it and when to avoid it.

  [more…]

• The Ownership Chaining Quandary or How to Circumvent an Explicit DENY

  

  2014-03-16 - General, Security, Security Pitfalls

  Ownership chaining is a powerful tool for permission management. However, in some situations it can be misused to gain unauthorized access to a securable. Read on to see this in action.

  [more…]

• The Ownership Chain – How the Securable Owner affects Permission Enforcement in SQL Server

  

  2014-03-14 - General, Security

  The ownership chain enables us to setup guarded access in SQL Server. Guarded access means to grant securable access only through a procedure or view. That module can then be used to enforce additional security requirements. Read on to see how the ownership chain makes this possible.

  [more…]

• The Row Header (A Storage Wednesday Post)

  

  2014-03-12 - General, Series, SQL Server Internals, Storage Wednesday

  The row header contains metadata describing the row. It contains information about the row type, the column count and a NULL-bitmap. Read on to get all the details.

  [more…]

• An implicit user creation has failed.

  

  2014-03-10 - General, Security, Security Pitfalls

  The error message “An implicit user creation has failed.” indicates that SQL Server tried to create a user automatically and failed. Read on to see when and why this happens.

  [more…]

• Pseudo Random Number Generators

  

  2014-03-08 - Cryptography, General, Security

  While we can capture true randomness, for typical applications we need a faster way to produce random numbers. Read on to see how in those cases a Pseudo Random Number Generator or Cryptographically Secure Pseudo Random Number Generator can be used.

  [more…]

• CONTROL SERVER vs. sysadmin – Differences when Creating a Schema

  

  2014-03-07 - CONTROL SERVER vs. sysadmin, General, Security, Security Pitfalls

  The CONTROL SERVER privilege and a membership in sysadmin are supposed to be equivalent. However, there are substantial differences, e.g. securable ownership. Read on to see what happens when a schema is created by a login with CONTROL SERVER permissions.

  [more…]

• Random – What does that actually mean?

  

  2014-03-06 - General, Security

  Random numbers or random number sequences are widely used in our lives (e.g. encryption). But, what makes a random number actually random? Read on to find out.

  [more…]

• Finding table pages with DBCC IND (A Storage Wednesday Post)

  

  2014-03-05 - General, Series, SQL Server Internals, Storage Wednesday

  Are you trying to use DBCC PAGE and need a way to find all pages that belong to a table? That is exactly what DBCC IND can help with. Read on to get all the details.

  [more…]

• Who is the Default Owner of your Database and Server Objects?

  

  2014-03-04 - General, Security

  When a new securable is created and an owner is not specified, a default owner is set. What server or database principal is used for the owner by default? Read on to find out now.

  [more…]