Re: Third party access to SQL

Dan
Although the IT folks are stakeholders, they don't always have the final
say about such matters in the real world. A DBA can voice concerns but,
at the end of the day, it is a management decision as to whether or not
Best Practices are followed.

Oh,how true it is



"Dan Guzman" <guzmanda@xxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:BE6DF1B2-9302-4757-918C-D84C3F4856C0@xxxxxxxxxxxxxxxx
I am sure that they shouldn`t be doing any work on tables structure, sp`s
etc on a live database. That work should be tested, scripted etc and then
run
on in a controlled environment by my company.

If this is the case, then why would the third party request sysadmin
access to the production environment? Why do they need access to the
production environment at all? I think you need a clear understanding of
the third party roles, responsibilities and expectations before you can
setup the appropriate permissions (minimal level of required). This is
particularly true of customized solutions.

When working with third party solutions, don't assume that Best Practices
like a formalized testing and promotion process are followed. I've seen
external vendors develop applications ad-hoc in the live production
environment (if it works it's production, otherwise it's just
development). Although the IT folks are stakeholders, they don't always
have the final say about such matters in the real world. A DBA can voice
concerns but, at the end of the day, it is a management decision as to
whether or not Best Practices are followed.

--
Hope this helps.

Dan Guzman
SQL Server MVP
http://weblogs.sqlteam.com/dang/

"Simon" <Simon@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:EA19B1A7-3304-4C88-B92A-EF9866029166@xxxxxxxxxxxxxxxx
We have a hosted SQL server with various internal applications on it. It
has
been decided by on high that the same server will also have a database
from a
third party on the server. The third party have asked for full system
admin
rights on the SQL server.

Obviously I am not going to grant that access level as it gives them full
control on the box. From my viewpoint read and write access to the data
can
be tolerated but anything else will be denied. Would you consider this
standard and is there any documentation with recommendations for control
of
external suppliers ?

I am sure that they shouldn`t be doing any work on tables structure, sp`s
etc on a live database. That work should be tested, scripted etc and then
run
on in a controlled environment by my company.

Anyone have any advice ?

Thanks

SI



.

Relevant Pages

  • REWARD: Fix our SQL Server connection for $150 (CAPA)
    ... We can connect to SQL Server 2000 just fine in our ... Development environment: ... The code below shows the connection string we are using for the development ... In the production environment, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Recordset.AddNew and the recordset objects data retaining
    ... I am in an environment where bulk insert isn't an option--even though the ... underlying database is SQL server, I am using a third party OLE DB provider-- ... > insert(assuming you are using SQL server) or DTS. ...
    (microsoft.public.data.ado)
  • curious problem in production
    ... I am getting an exception from sql server being ... When I run the same code on the my development machine into the SAME ... if it fails in calling the production environment. ... RPC:Completed declare @P1 bigint ...
    (microsoft.public.dotnet.framework.aspnet.webservices)
  • curious problem in production
    ... I am getting an exception from sql server being ... When I run the same code on the my development machine into the SAME ... if it fails in calling the production environment. ... RPC:Completed declare @P1 bigint ...
    (microsoft.public.sqlserver.server)
  • curious problem in production
    ... I am getting an exception from sql server being ... When I run the same code on the my development machine into the SAME ... if it fails in calling the production environment. ... RPC:Completed declare @P1 bigint ...
    (microsoft.public.sqlserver.programming)