3

I work with Database Administration and one of my roles is to make the environment safe. But on every company I've worked, there is a "star employee" - A guy that is a Dev normally, with little knowledge of database administration ( these guys knows how to code, but they knows very little about "database administration" ).

So every time I try to reorganize logins, users, limit their powers I face the

"noooo Mr. StarLight NEEDS sysadmin on EVERYTHING.".

I keep saying it's useless because he doesn't know what to do. I for sure will give him total access to all databases and features, but seems it's not enough.

In this last company, I just don't care anymore. I give sysadmin to whoever my boss asks because I'm tired of this same history. Don't get me wrong, I send an email pointing everything that can happen and how this is bad, but well I need a Job and not a fight.

How can I deal with this? Should I call these star guys and politely ask them to not mess around, and should I "teach" them how to properly use sysadmin powers if needed?

11

It seems that your organization lacks a very crucial process - information handling and security.

Given that you are in charge of managing the database, it's your responsibility to keep it sanitized. The responsibility is not only limiting the access, it also involves keep the database organized and running (and up to some extent, ensuring that the knowledge of risks associated with improper access is circulated properly).

You can bring this to the notice of your superiors, but don't approach them with a complaint. Rather, prepare a document / presentation mentioning the pitfalls / downsides of having the administrator access to random users. That way, you can show them the problem and the associated cost to recover from an accidental misuse. Then. leave it to their judgement.

Also, you can take some examples (not to name and shame, some practical cases but anonymously), where a privileged access was requested for some work, but how that work can be done without the need of providing the access to the end users, for example: a ticketing system where end users can raise tickets for the actions needed to be performed by admins, and you (and anyone else in the admin team) can get the work done. That way, the advantage is twofold:

  • There's a log for every request made (and approvals, as applicable)
  • There's a guarantee that the critical changes will only be performed by the specialists, not by anyone else.

Even after this attempt, the superiors / management fails to see / address the problem, you don't need to feel obliged. If you see that this open-to-all sort of access is creating a recurring problem - you need to find an organization where a systematic process if honored and followed.

| improve this answer | |
  • 2
    Best answer, So I won't bother. GREAT analysis – Old_Lamplighter Dec 9 '19 at 12:46
4

I honestly think you are already doing your part by giving access to whoever your boss asks and creating a (virtual) paper trail to cover your ass.

You mentioned that in these emails you even mention which problems may arise due to this. So, obviously, your boss knows that this is problematic but he just doesn't care. So keep doing what you're doing, at least regarding this.

Maybe you could ask your boss for a few hours a week/month to actually teach your peers stuff related to what they have access.

| improve this answer | |
2

The question in your title is,

How to deal with the “star” coworker?

I'm going to frame challenge that question. The best way to handle this is to not deal with "star" coworkers. Instead, solve the problem (which you clearly know about) before it gets to that point:

  • When you are interviewing for new DBA positions, as questions about things you care about. If you consider it important that an organization has good rules about data access, you can ask in interviews what the potential employer's policies are like. This will help you rule out employers who run their shops like the wild west.
  • Once you've been hired into a new job, you can begin setting yourself up for success before it gets to the point of dealing with a star coworker. Talk to your boss about security policy. Review anything in writing that they have. If there is nothing in writing, but there seems to be a generally understood policy, write it down and provide it back to your boss for review. Get things defined ahead of time, as a first priority.
  • If the policies don't seem to jibe with what you were told during your interview, or they simply don't exist at all, work with your boss to consider how to add an appropriate level of formality. Keep in mind that security protocol is sometimes a new concept at some employers. They may need to take baby steps - in other words, if they are starting with nothing, you may be best off trying to establish a very simple baseline policy, rather than diving in heads-first with a complex structure.
  • Once "the rules" are in place and agreed to, you have your safety net. When the request comes for Mr. Star Employee to get full access to that new server, you can just follow the agreed process to handle the request. If the company's management pushes for an exception for Mr. Star Employee, just follow the process for exceptions - or, at least, confirm everything in writing with the appropriate leadership copied in.

In short, agreeing to policy before it's needed reduces the intensity of the conflict you're suffering from. It gives you a rulebook to play by - a rulebook that your leadership is aware of and has agreed to.

And, at the end of the day, it's important to also consider your job role. While you may be "responsible" for the systems you are running, it's important to understand the context of that responsibility. In other words, there is often a difference between setting policy and implementing policy. I mention this because it sounds like you want to be involved in both, but your bosses have only included you in the implementing part. Again, getting things sorted before there is an urgent request is a good thing, but - at the end of the day - if your responsibility is implementation, you can rest on the fact that you're essentially just doing your job by granting the requests you've received.

| improve this answer | |
-1

Depending on the law or regulations in Brazil there might be restrictions to give access like this, like it is restricted by GDPR. This might be a good ground that management will understand if you make clear what the outcome would be if something goes wrong. You could reject the request by stating the laws/regulations. If insisted you require a signed document that makes clear you acted upon request of management even though noting it is not within the law (in case this is even allowed by the law, might not be the case). If they have to sign a document like this they might start to think about what it actually means they are doing.

In addition, even if Brazil does not have a specific regulation for this. If your company has clients (or wants them) in foreign countries with such a law or regulation it might still apply.

| improve this answer | |
  • 1
    It is tagged as Brazil As far as I know there were plans to create a GDPR-like thing there, but I don't how it is right now, nor how hard it is about this kind of stuff. – undefined Dec 9 '19 at 12:52
  • Hmm didn't see this before. Anyway I see for example this in a news article from this year: On August 14, Brazilian President Michel Temer signed into law the new General Data Privacy Law (Lei Geral de Proteção de Dados Pessoais or “LGPD”) (English translation), making Brazil the latest country to implement comprehensive data privacy regulation. Might be worth checking, probably it is compatible with GDPR and thus has almost the same rules. – steros Dec 9 '19 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .