This quick write up comes courtesy of a tweet by () yesterday morning (Please Note: OH means overheard, meaning that statement is something Jonathan overheard. He鈥檚 WAYYYYY too smart to actually spread something that dumb as valid advice) . Here鈥檚 the tweet:
Ok, so I鈥檝e seen a couple of stupid things written up in the last few days but this one just might take the cake. If you have been a DBA for any amount of time then you鈥檝e more than likely come across a vendor application that uses the 鈥榮a鈥� account for access to the database. I won鈥檛 get into details about the sa (or system听administrator) account here but check out at about it ( as well to learn more).
So what exactly is wrong with that statement in the tweet? Well, as stated by () this morning:
“Ok Jorge, stop making fun of me”. No, as long as you access things using sa for “simplicity” or “optimization” I’m going to beat this over your head like an Acme mallet. Using ‘sa’ account for everything is akin to being handed the keys to the bank and being told “yeah, go ahead and make your deposits and withdrawals from your own account but try not to touch anything else while you’re digging around the vault”. Seriously, I’m not kidding. Handing someone the ‘sa’ account is handing them the keys to your SQL kingdom. Think about it, if you write an application that is accessing your database with FULL admin rights, what if someone performs a attack and drops your production tables for kicks?
Listen folks, I know that security can be a pain but it’s there for a reason. Don’t get lazy and just assume the user needs an admin account to access the database because 9/10 times it doesn’t. You could probably get by fine on creating a new schema with write/read access and maybe EXECUTE stored procedures permissions. In fact, secure yourself from SQL injection attacks by wrapping your code in stored procedures in the first place.
There’s a ton of resources out there to learn how to properly secure SQL Server. Get up to speed by reading up about . There’s also tons of videos and demonstrations out there. Check out the courtesy of() and (). Finally (WARNING: Blatent self-promotion inbound) make sure to check out SQL University’s security week from Semester 1.听Bottom line is if someone tells you “this application needs to run as sa”, have them give you a detailed explanation as to why. Part of your job as a responsible DBA is to protect your data and your听database servers. If they simply don’t know any better then offer to educate them on schemas, security groups,听etc.听听And remember, “because its an optimization” is a stupid answer.