Elam, Debbie
DElam at jenkens.com
Thu Dec 9 07:37:02 CST 2004
I have encountered this too. I had to put together a temporary repository for HR data once. The HR people carefully gave me fake data at first to test so there would be no privacy violations. I told them their diligence was admirable, but useless. I could not administer the system without having access to the data in it anyway. To make it even worse, I had only recently been hired after one of the shortest hiring cycles ever seen. (Told the job existed and had an interview scheduled the next morning, hired that afternoon) This company keeps the payroll computer off of the LAN for just this reason though. Debbie -----Original Message----- From: Mark Breen [mailto:mark.breen at gmail.com] Sent: Thursday, December 09, 2004 1:39 AM To: dba-sqlserver at databaseadvisors.com Subject: Re: [dba-SQLServer] Who's using my db? Hello Jim, If I understand Christopher correctly (and sorry to all if I do not), he is talking about a sys admin person going in using EM or SQL Analyser and reading raw tables. Of course this person has rights to do anything on the SQL server (from a technical perspective) but morally they do not have rights to read the data. This raises a whole other question: Companies employ senior managers to look after highly confidential issues, such as HR or other sensitive and then they employ young guys and gals to be sys admins, paid Euro 25k per annun and the young guy or gal had rights to the entire network. This is wrong, but what are the alternatives? Some young guy comes in off the street, joins the IT department to just install PCs and has access to confidential data. More rights that senior managers in the company. My gripe is not with the unfairness to the senior manager, what I am concerned with it that the industry seems to have overlooked this front door access that we give to this select group of employees without concern to normal security issues. What do you all think On Wed, 08 Dec 2004 18:10:10 -0800, Jim Lawrence (AccessD) <accessd at shaw.ca> wrote: > Hi Christopher: > > Is it not possible to have the data on the SQL only accessed through SPs or > views. In each of these SPs there would be a function call that would write > a record of it's access to a transaction log table. This technique is done > through all POS systems to track the users, access dates, times and any > changes made to the invoice records. > > It all depends on your permissions on the BE. > > Jim > > > > > -----Original Message----- > > From: Mackin, Christopher [mailto:CMackin at quiznos.com] > > Sent: Tuesday, December 07, 2004 10:57 AM > > To: dba-sqlserver at databaseadvisors.com > > Subject: [dba-SQLServer] Who's using my db? > > > > Does anyone have any suggestions on how to track/view a log of users > > that have accessed information on the Server and specifically at the > > Database level? > > > > There are users authorized to view a particular db with confidential > > information, and I need to verify that no other users are accessing this > > data. In this situation it's rather complex because security keeps out > > the majority of people, but there are certain people with the sa > > password and admin rights on the server that should not be looking > > either. > > > > Thanks in advance, > > Chris Mackin > > _______________________________________________ > dba-SQLServer mailing list > dba-SQLServer at databaseadvisors.com > http://databaseadvisors.com/mailman/listinfo/dba-sqlserver > http://www.databaseadvisors.com > > _______________________________________________ dba-SQLServer mailing list dba-SQLServer at databaseadvisors.com http://databaseadvisors.com/mailman/listinfo/dba-sqlserver http://www.databaseadvisors.com - JENKENS & GILCHRIST E-MAIL NOTICE - This transmission may be: (1) subject to the Attorney-Client Privilege, (2) an attorney work product, or (3) strictly confidential. If you are not the intended recipient of this message, you may not disclose, print, copy or disseminate this information. If you have received this in error, please reply and notify the sender (only) and delete the message. Unauthorized interception of this e-mail is a violation of federal criminal law. This communication does not reflect an intention by the sender or the sender's client or principal to conduct a transaction or make any agreement by electronic means. Nothing contained in this message or in any attachment shall satisfy the requirements for a writing, and nothing contained herein shall constitute a contract or electronic signature under the Electronic Signatures in Global and National Commerce Act, any version of the Uniform Electronic Transactions Act or any other statute governing electronic transactions.