accessing sql server (via sql authentication)

weve recently had a security audit that identified weak passwords associated with mssql authentication accounts. I wondered, how could an insider exploit those and access the database, would they need admin (OS) rights on the server, or are there tools on a standards windows 7 machine that they could use to access the server via the SQL account.
LVL 3
pma111Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

geek_vjCommented:
SQL Authentication doesnt need the user to access SQL Server from OS level. Thats the reason it is more risky where as windows authentication is more secured as it passes through stages of authentication (including Kerberos authentication from Windows level)

SQL Authenticated user is a stand alone user and doesnt have any association with OS level groups/users/administrators.

Using the sql authenticated user, anyone can directly access the database from anywhere through the network if the user is having sufficient access.

So, it is recommended to disable SQL authentication on a production server (unless the application is a heterogenous application)

Hope this helps!
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Chris MangusDatabase AdministratorCommented:
To piggyback on the first comment, a user with the proper username and password could easily create an ODBC connection to the database and use the tool of their choice to access the data...MSAccess, MSExcel, vbscript, VB.NET, etc.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft SQL Server

From novice to tech pro — start learning today.