Who is allowed Raw Database Access?

[Al_Rel-EZ_Al]

Hi guys. In an age where everything is stored electronically, databases drives virtually every aspect of a business. Which is why I believe that this is a particular area Change Managers should be extremely strict about.

In a client of mine, due to the nature of 'urgent fixes', at times Developers are given Production DB access to either,
1) query, simulate the issue or
2) fix it directly QUICK QUICK!

Such practice has eventually given the rise to some of our BAs even having direct access to PROD too!

It is a shocker I know!!!

I often think about the risks involved, as sometimes these changes to the PROD environment do not go through proper CM processes and even though each step taken may be written down somewhere ... there could have been accidental mistakes resulting in enormous cost to recover or fix corrupt data etc, or worst, the organisation very well could have been defrauded through some form of embezzlement un-beknown to them.

As I think about this, I decided to take the step further, even people in Production Support or DBAs at the end of the CM process, even them having direct prod access could be a risk to a business. Often a CR would have been created, gone through the cycles, and then it is up to Prod support to execute the final steps in Prod. Who is to say that they would not do something outside the realms of the CR as they perform the execution?

I think the solution is in Software Automation which is why I have put together my Software. Because Software Automation will be able to track the changes, and even automate the change deployment! Which is what my tool does for DBs.

But I wanted to know from this forum, what are permissible buffers organisations are willing to accept to allow individuals to have direct raw database access?

I have often heard the saying, "If you can't trust them doing the job, you can't trust anyone"... and with Billions of Dollars worth under management... I kind of NOT want to trust anyone. Any thoughts?
_________________
Al_RelEZ_Al

[UKVIKING]

First

Quit doing sales in this forum. You have already posted more than once about your application.

Second.

This can be easily controlled by proper ITIL oriented, SOX oriented, CoBIT orient Change Management and Release Management process

Instead of tryign to sell them a tool, have them change their processes so things like this does not happen

It does not happen where I am or have been as this is the first thing I try to control
_________________
John Hardesty
ITSM Manager's Certificate (Red Badge)

Change Management is POWER & CONTROL. /....evil laughter

[ITILadmin]

I have edited his post and a final warning has been sent. Some vendors never seem to get that this sort of thing actually damages them rather than helps them.