Category: Security Pitfalls

• OPEN SYMMETRIC KEY – Avoid the NULL Ciphertext Trap

  

  2014-07-11 - Cryptography, General, Security, Security Pitfalls, T-SQL Statements

  Don’t get caught in this nasty trap that will cause all your encrypted data to be wiped out. Discover how to use the OPEN SYMMETRIC KEY statement correctly to protect yourself (and your data) from this ugly surprise.

  [more…]

• The Ownership Chaining Quandary or How to Circumvent an Explicit DENY

  

  2014-03-16 - General, Security, Security Pitfalls

  Ownership chaining is a powerful tool for permission management. However, in some situations it can be misused to gain unauthorized access to a securable. Read on to see this in action.

  [more…]

• An implicit user creation has failed.

  

  2014-03-10 - General, Security, Security Pitfalls

  The error message “An implicit user creation has failed.” indicates that SQL Server tried to create a user automatically and failed. Read on to see when and why this happens.

  [more…]

• CONTROL SERVER vs. sysadmin – Differences when Creating a Schema

  

  2014-03-07 - CONTROL SERVER vs. sysadmin, General, Security, Security Pitfalls

  The CONTROL SERVER privilege and a membership in sysadmin are supposed to be equivalent. However, there are substantial differences, e.g. securable ownership. Read on to see what happens when a schema is created by a login with CONTROL SERVER permissions.

  [more…]

• The Unexpected Security Implications for Role Owners

  

  2014-03-03 - General, Security, Security Pitfalls

  In SQL Server a server or database role can have an owner specified. Are you aware of the security implications of specifying a role owner? Read on to find out now.

  [more…]