Last month, I met with Microsofts James Hamilton, an architect of Microsoft SQL Server, to be briefed on upcoming security changes in the next release of SQL Server, code-named Yukon, which is expected to begin beta testing in the first half of next year.
The most significant security change in Yukon—and one that hadnt been mentioned to the press previously—is that SQL Server will support a declarative security model that provides much finer, more flexible security controls than are possible using the SQL table- and view-based permissions model.
“What were building here is a row-level security,” said Hamilton, in Redmond, Wash. “Every user accessing a table has a predicate assigned to them that controls their access. That predicate gets applied to every query; same thing with an update. Unless youre updating your particular row, it will fail.”
Using this system, users could be restricted so they could access only data rows where, for example, the state column was set to Washington and could update only rows where the city was Seattle.
Oracle9i Enterprise Edition and Sybase Adaptive Server Enterprise databases already support similar extensions to the base SQL permissions system, and its inclusion in the next version of SQL Server will be a major security step forward for that product.
