Security Standards

[krotha]

Hi
We have several servers dev/staging/prod. Right now our client don't have any security policy, so all developers have sa privileges in all servers. I want to revoke sa privileges to all the developers and assign limited privelges. What are the industry standards to follow and what is the best security policy to implement?

Thanks for any help.

 

[mrdenny]

Best policy is that people get the least access that is required to do there job. If they need to be able to create and modify all tables in one database then they get dbo in that database, but not sysadmin on the server.

Denny

--Anything is possible. All it takes is a little research. (Me)