It's easy and all too common to see the auditing team as adversaries. All the information they want takes time to gather, all the rules and procedures they want added just slow things down, and far too often it feels like we're trying to pass the test rather than really be secure. Sound familiar?
There isn't a magic answer that makes it all painless, but there are ways to make this process easier, less frustrating, and more effective. It starts with understanding that in general everyone wants the same thing - a documented and sound approach for conducting business in a way that guarantees we stay secure and available. There are a lot of options for getting there, but they require a higher level conversation than you might be used to or expect. The auditing team may not be experts in every bit of technology - sometimes they prescribe solutions because we demand it, sometimes because they think they are supposed to! We'll talk about all of this in the context of SQL Server including what we can do with the tools in the box and places where third party tools can really make a difference.
Andy Warren is a SQL Server consultant and trainer based in Orlando, FL. Focusing on administration, performance tuning, and SQL Server patterns and practices, he’s been a SQL Server MVP since 2008. Andy served two terms on the PASS Board of Directors, was a founding principal in SQLServerCentral, and created both the SQLSaturday and SQLRally event models.
Topics: Database Compliance, Database Security Products: SQL Compliance Manager