Press "Enter" to skip to content

Category: Security

Avoid using sysadmin Accounts for Linked Servers

Published 2025-04-01 by Kevin Feasel

Denny Cherry shares sound advice:

When setting up linked servers, the selection of the accounts that are used for the linked server logins should have the lowest permissions needed to get what the users on the source side of the linked server need to do. Over time, this will mean changing the permissions of the linked server or even setting up multiple linked servers that all point to the same target server so that different applications don’t have permission to access each other’s databases over the linked server. The one thing that you never want to do is to use a login for the linked server that has sysadmin rights on the target instance, especially if that linked server is available for everyone on the server to use.

Click through to understand why.

Comments closed

CIS Benchmarks for PostgreSQL

Published 2025-03-26 by Kevin Feasel

Elizabeth Christensen reviews some security guidance:

The Center for Internet Security (CIS) releases security benchmarks to cover a wide variety of infrastructure used in modern applications, including databases, operating systems, cloud services, containerized services, and even networking. Since 2016 Crunchy Data has collaborated with CIS to provide this security resource for those deploying Postgres. The output of this collaboration is a checklist for folks to follow and improve the security posture of Postgres deployments.

The PostgreSQL CIS Benchmark™ for PostgreSQL 17 was just recently released.

Click through for more information on the CIS, as well as a link to the benchmark PDF and some tips around it.

Comments closed

Digital Signatures on SQL Server Stored Procedures

Published 2025-03-17 by Kevin Feasel

Rick Dobson signs a procedure:

This tip introduces the basics of digital signatures based on self-signed certificates for selected T-SQL objects (stored procedures, functions, and triggers) with T-SQL samples. Learn how to detect what happens to a digital signature when a stored procedure is accidentally altered by a database administrator or intentionally modified by a bad actor.

Click through for the process.

Comments closed

Using the Entra ID Powershell Module

Published 2025-03-13 by Kevin Feasel

Patrick Gruenauer checks out a new module:

The new PowerShell Entra ID Module is a powerful tool designed to streamline the management and automation of Microsoft Entra resources. This module is part of the Microsoft Graph PowerShell SDK and offers a range of functionalities to enhance administrative tasks.

One of the key benefits of the Microsoft Entra PowerShell module is its focus on usability. Unlike MS Graph, the module is more user-friendly to operate. Let’s dive in.

Click through for a demonstration of what you can do with it.

Comments closed

Object-Level Security in Power BI Desktop

Published 2025-03-06 by Kevin Feasel

Nikola Ilic locks things down:

You’ve heard about the Oblect-level security feature in Power BI, but you’ve also heard that you CAN’T configure it directly from the Power BI Desktop? And, that you must use an external tool, such as Tabular Editor, to configure and manage OLS.

Well, this is not the case anymore! With the new TMDL view in Power BI Desktop, you can define Object-level security directly in the Power BI Desktop.

Read on for a tutorial on what it takes to implement object-level security.

Comments closed

Microsoft Fabric Permissions Models for Sharing Data with End Users

Published 2025-02-24 by Kevin Feasel

Jon Vöge builds a list:

Consider the following scenario:

  • I am building a data platform on Microsoft Fabric, using Lakehouses as the primary storage engine.
  • My end users need to consume data from the data platform as users of Power BI reports which connects to data from the Lakehouses, as developers of ad hoc models and report using data from the Lakehouses, and through ad hoc SQL queries on the Lakehouses.
  • I want to use DirectLake for Power BI reports to take advantage of frequency data ingestion and transformation, and improve the actionability of my reports.
  • My data is sensitive, and users, regardless of whether they consume reports or develop their own, need to be restricted by Row Level Security to only see some of the data.

Read on for eight different approaches to the problem and Jon’s thoughts on each approach.

Comments closed

The Challenge of TDE in PostgreSQL

Published 2025-02-24 by Kevin Feasel

Bruce Momjian shares an update:

I first blogged about Transparent Data Encryption (tde) in 2019, which was more thoroughly analyzed in a blog post in 2023. An email exchange in December 2024 summarized the most up-to-date status of this feature:

When I started focusing on tde, it was going to require changes to buffer reads/writes, wal, and require a way to store secret keys. I thought those changes would be acceptable given tde’s security value. Once file I/O changes were required, I think the balance tilted to tde requiring too many code changes given its security value (not policy compliance value).

Read on for Bruce’s take now. Coming from the SQL Server world, where TDE has been in the product since 2008, I generally agree that there are better ways to ensure regulatory compliance. It’s not like TDE is actively harmful or anything, but considering that all of the relevant keys and certificates need to be on the local server to begin with, this prevents a limited number of situations from exposing your data, and there tend to be less resource-intensive alternatives for those situations.

Comments closed

Backup to URL via Managed Identity in SQL Server 2022

Published 2025-02-18 by Kevin Feasel

Joey D’Antoni doesn’t trust user logins:

Backing up databases to the cloud is not a new thing. Microsoft introduced the BACKUP TO URL functionality to SQL Server 2012 SP1 CU2. I’m not going to tell you how long ago. Still, it wasn’t last month, and Microsoft recently celebrated the 15th anniversary of Azure so that you can get an idea. When the feature started—it was minimal; you could only backup a database of up to a single terabyte and couldn’t stripe over multiple files. Additionally, you had to use the access key to the storage account, which gave complete control over the storage account—that wasn’t a good thing.

Read on for a quick overview of the feature and guidance on how it all works.

Comments closed