I've just discovered a computer serving sensitive data from MS SQL Server that appears to have virtually no security protection. I would like to protect this box as quickly as possible.
My problem is that I'm a Linux admin with no experience of Microsoft databases helping out in an remote office with no IT staff. (Also the installation is in Spanish so please forgive me if I'm mangling any names).
So I found a program called SQL Server Enterprise Manager (There's no version number in the 'about' dialog, but the copyright in the help files says '1988-2000') which lets me read all the data, create accounts and change passwords of any existing accounts. It doesn't ask me for a password.
How can I close this gaping hole in security?
Does this situation suggest the existence of other vulnerabilities that I should check for?