• We regulate who has access to the servers but they generally have highly privileged access.
• We utilize SQL Authentication heavily.
• We utilize Window Authentication with some SQL Authentication.
• We utilize Windows Authentication ONLY.
• We assign fixed server and database level roles to individuals / security groups.
• We authorize service accounts and security groups only. No explicit access to any individual. This helps us maintain security based on the role an employee holds.
• We utilize user defined roles and handle the assignment of those roles in database projects. Users are added and removed from security groups to account for change.
• We go granular in all cases. Explicit object level permissions applied where needed and only when needed.
• Wait why would they need to access the server if they weren't a sysadmin?

View Results