Back when I was working on a master\u2019s degree, one of our professors told us a story about a colleague who learned how to navigate the Unix system. She was so thrilled about learning this new skill that, in her exuberance, she stumbled upon some hidden human resource files containing confidential information. Eventually, an administrator realised that the woman had located these files and told her \u201cyou can\u2019t do that.\u201d Well, she could and did do that. Even though the files were hidden in the hopes that people wouldn\u2019t find them, they were not secured. Security by obscurity doesn\u2019t work because someone will eventually find what you are trying to hide if they are motivated and put enough effort into it.<\/p>\n
On the other hand, there is the problem of showing resources to people when they don\u2019t have rights to them. Nothing is more annoying than clicking on a link and then being told that you do not have permission to view the resource. It would have been better if you hadn\u2019t known about it at all.<\/p>\n
In a Windows shop, administrators control what people can do and access by using Active Directory ACLs (access control lists), group membership, and Group Policies. Security in AD can get complicated quickly. To ensure administrators follow the principle of least privilege, proper planning and assigning rights to groups instead of to individual users are essential. I\u2019ve not been an AD administrator, but from a user perspective, it seems to do a good job of both securing and hiding resources.<\/p>\n
SQL Server doesn\u2019t always hide what you shouldn\u2019t see. Say an account only has SELECT permission on one table in one database on a server. The account can view all the databases when using SSMS, even those where they can\u2019t connect. After connecting to that one database, they only see the one table in SSMS, but querying other tables returns an error message stating that SELECT permission is denied. A different message appears when attempting to query a nonexistent table. While the specific messages are useful for troubleshooting permissions problems, they give too much information to someone with evil intentions.<\/p>\n
Once security has been figured out, it easy for organisations to enable self-service for things like business intelligence or even provisioning virtual machines. It\u2019s essential, however, that the user is not overwhelmed with too many choices. Having too much from which to choose wastes time and can be quite frustrating.<\/p>\n