asked on

Security on SQL Databases: should general users have access?

We have a company live SQL DB, it's written almost constantly and contains very sensitive information.
The SQL admin in here lets users run live queries against the live DB. The run them from both Crystal reports and
the SSMS from their local machines. IS this safe to do. Are there any negatives?

We do have replication setup to another SQL server so is it better to run all queries against that?

SOLUTION

Ryan Chong

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

Vikas Garg

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

wannabecraig

ASKER

HI,

Thanks, are there any security issues?

Vikas Garg

HI,

Since both are SQL server so security wise you can set at both as per the need.

However if you have different server for reporting then if something happens to the reporting server your Live Application server will remain Strong, Steady and Secured.

wannabecraig

ASKER

So the only negative impact is performance? No other possible damage?

Zberteoc

"So the only negative impact is performance? No other possible damage?"

Yes, possible other damage! For instance a wrong query that will delete all rows in a table! NEVER let general users run ad-hoc queries from SSMS against a live production database!

ASKER CERTIFIED SOLUTION

Ryan Chong

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial