只读 SQL 帐户：你能做什么？
背景：我不是专业工程师。我在一个政府单位工作，我几乎是我们小组中的技术量化数据人员。
我想从不同的 IT 部门请求一个 sql 数据库帐户，这样我就可以直接提取数据，而不需要向任何人请求。我只想拥有只读权限。有些栏目也将受到限制，因为它们包含与我无关的个人信息。
我将在我自己的计算机上使用 Python 脚本中的数据库帐户从他们的数据库中提取数据。
我担心的是他们的安全问题。恶意 IT 人员可以利用只读 SQL 帐户合理地执行哪些操作？ 数据基本上只是人口统计数据。假设帐户可访问的数据并不完全敏感，但也不应该自由分发，并且在任何情况下都不应该被篡改。我对互联网安全的熟悉度几乎为零。
据我所知，对于网页来说，SQL 凭据隐藏在 PHP 中，因此您不能仅以用户身份查看源代码。但如果账户是只读的，是否存在安全问题呢？我不希望该组织遭到黑客攻击。我不知道 DBA 最佳实践。
谢谢！
*为了清晰起见进行了编辑
Context: I am not a professional engineer. I work for a government unit and I am pretty much the tech-quant-data guy in our little group.
I want to request for an sql database account from a different IT unit so I can pull data directly without requesting from anyone. I only intend to have read-only privilege. Some columns will also be restricted as they contain personal information that I have no business having.
I will be using the database account in Python scripts probably in my own computer to pull data from their databases.
My concern is regarding security on their end. What can a malicious IT person reasonably do with a read-only SQL account? The data is fundamentally just demographic stats. Assume that the data accessible to the account are not exactly sensitive, but should also not be freely distributable, and should also under no circumstance be tampered with. I have near zero familiarity with internet security.
I understand that for webpages, SQL creds are hidden in PHP so you can't just look at the source as a user. But does the security concern exist if the account is only read only? I don't want the organization to be hacked. I don't know DBA best practices.
Thanks!
*edited for clarity
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论