So new customers still need to apply SP3 as a separate installation, but you’re making it readily available on the same distribution media?
Yes. In addition, the release-to-manufacturing (RTM) install will remove the Slammer vulnerability so that, out of the box, you can deploy and know that your system won’t get hit by Slammer before you apply the service pack or any of the security bulletins. But the install will include only that additional fix. Again, we highly recommend that customers test and deploy SP3 on all their SQL Servers.
In terms of dollars spent, we’ve heard that 25 percent of Yukon's cost relates in some way to enhancing security. What are you doing in Yukon to improve SQL Server’s security?
We’re disabling network access by default and disabling the User Datagram Protocol (UDP) instance resolution service that listens to port 1434 by default. Multiple instances will still work; they just won't be visible to strangers scanning your network. We’re also instituting the principle of least privilege, role-based security, and secure defaults.
We’ll help administrators use best practices by defaulting to the highest level of security possible and guiding them to grant additional privileges as needed. Role-based security makes administering security privileges easier than assigning specific privileges to each user. Secure defaults, such as turning off network access and defaulting to Windows Security rather than mixed mode, also help encourage best practices.
Why does SQL Server use its own encryption algorithms? Shouldn’t you be leveraging the services offered by Windows? Will Yukon do this?
SQL Server, in general, uses encryption algorithms supported by the underlying operating system, and all new features depend on OS-supplied encryption. For historical reasons, some features have depended on weaker mechanisms, but we’re committed to moving these to OS-supplied mechanisms as aggressively as possible.
Microsoft has consistently argued that with SQL Server’s ease of use and management, companies can and should have their DBAs focus more time on business issues than on traditional DBA activities. Then comes a security problem like Slammer, and most organizations complain that they just don't have the staff to keep up with the constant flow of software patches. How does Microsoft reconcile these two scenarios?
You’re right. Microsoft’s goal is to automate the routine, tactical tasks that DBAs must accomplish in an effort to free them up for more strategic work. Although manageability tools are a strength of SQL Server, we know that we have to do a better job of patch management. Microsoft’s principle is to be proactive in issuing patches as we discover vulnerabilities. The key will be to make these patches easier for customers to understand and deploy while minimizing downtime.
We’ll continue to build on the security tools and the installer we released, and we want to continue the dialog with customers about how to help them with patch management, which is an issue across the industry. This is a huge priority for us, and you have my commitment that we will make it better.
End of Article
Prev. page
1
2
3
4
[5]
next page -->
