Voice of the DBA

Author: way0utwest

Data Masking for Convenience

I was at Microsoft in Redmond recently and heard an interesting comment from a SQL Server developer. I was debating the data masking feature with a friend, and we were torn on the value of this for various situations we’d each encountered in the past. There are some restrictions, and it doesn’t seem that data masking is really offering a lot of security.

The Microsoft developer, however, noted that this isn’t really a high security feature. It’s a developer feature. The design of data masking is to prevent that same code from being rewritten over and over by application developers. The use case is really to help with systems that might read some data, like those that print off part of an account number, ID number, credit card number, etc.

If you read up on the restrictions, this makes sense. If you are just trying to make development more convenient, the feature makes sense. I hadn’t thought about that use case, but the more I consider this, the more I’m sure that data masking does remove a bunch of code that developers might be re-implementing themselves, perhaps with highly variable levels of quality. It also removes the chance that application developers will accidentally pull sensitive data to a client and (poorly) implement mask replacement there.

I think this feature is being mis-marketed a bit, really to increase sales to executives and management. I’m sure there isn’t anything we can do about that, but I’d love to see technical documents and information about this for developers and DBAs. Give us a more realistic use case and give us better guidance. I think if we got that for many features, there might be more positive responses and great interest from technical professionals to the changes in the SQL Server platform.

Steve Jones

The Voice of the DBA Podcast

Listen to the MP3 Audio ( 2.3MB) podcast or subscribe to the feed at iTunes and LibSyn.

September 23, 2015
Everyone is a Target

There was a piece in Dark Reading about a security researcher being targeted by a hacking group. While this is more political, this does raise some questions about how hackers might target our systems in the future. It just might be through personalized attacks against anyone that has privileged access.

In this case, hackers learned who researchers were and made repeated attempts to personally craft phishing attacks against specific people. However since many hackers communicate with each other, and could easily turn from political goals to economic ones, I’d be concerned about how this might affect data professionals in the future.

We know that social engineering works. While many of our customers and clients do have access to large amount of data and are perhaps easier targets, I would still expect to see attacks against a data professional that manages lots of data. Especially if the individual might have access to high profile data, or multiple companies as a consultant.

Targeted attacks against individuals could be a concern for many of us. We are usually more conscious of phishing and social engineering, but we’re not invulnerable. Many of us need to practice good security habits, being careful how we access privileged information, and perhaps even finding ways to do so only through containers or virtual machines that may protect us against some of the malware that could slip past us.

Security is a pain, it’s annoying, it can slow us down, and it is hard to adhere to best practices consistently and constantly. However we need to be careful and vigilant against the regular stream of attacks that will likely continue for the foreseeable future.

Steve Jones

The Voice of the DBA Podcast

Listen to the MP3 Audio ( 2.2MB) podcast or subscribe to the feed at iTunes and LibSyn.

September 23, 2015
Trying Spoon

I ran into Kenji Obata of Spoon earlier this year and we ended up chatting about their technology. If you’ve never heard of them, they use container technology to allow applications to run on a Windows host, but separated from each other. The concept is similar to Docker, but Spoon is more client focused. They’ve expanded their offering to Turbo, which is a more client focused offering that I think some of you might be interested in.

I’ll talk about Spoon as the containers, but Turbo is the same technology and idea here.

As an example, you can run Spoon containers on your host machine that allow you to have IE7, IE8, and IE9 all at the same time. At the same time, connecting to the same website so you can see how things render. In fact, their Browser Sandbox has all sorts of choices, all of which can be completely contained and running together.

There’s a lot more you can do, but I wanted to get you started with a quick post on how you can use this with SQL Server.

A SQL Server SSMS Container

Browse over to Turbo.net and you’ll see a text box asking you what you might want to run. Type in SQL Server, and you’ll get some choices.

I’ve got SQL Server 2014 on my laptop, but not SQL Server 2012. Imagine I want to see how SSMS 2012 might compare to SSMS 2014.

I run the SSMS 2012 image. Turbo.net wants me to log in, and you can quickly create an account. They do charge for the service, but you can try it out for free. An account gives you the capability to save your images and restart them later with the saved settings and configuration for the future. You do need to download a small runtime if you haven’t done that in the past.

I’ll see a small pane pop up on the website as the image downloads. This doesn’t require me to acknowledge anything, no UAC, no admin privileges.

In a few minutes, I’ll get SSMS popping up. I can connect to my local 2014 instance and run the SSMS 2012 alongside the 2016CTP I have installed.

Many of you will say, Steve, you can run two instances of SSMS now. That’s true, but I have to install them both on my machine. This doesn’t require an install. It’s inside a container, that hasn’t affected my machine, other than to put a container file on my machine. I can see these from the command line:

My SSMS container is running. If I close it, then the container will stop running.

If I then restart it from the command line ( I could use the web), my local container file will restart.

I could achieve some separation here from my local machine. With a subscription, I can save my image file, altering it to include plugins (like SQL Prompt), licenses, settings for my CMS or other servers, etc. When I restart, then I have a separate sandbox running SSMS.

Amazing Possibilities

I use Spoon/Turbo right now to run multiple instances of Chrome. I have 4 GMail accounts and I don’t want to sign in/out of each one, so I have each container configured with a different account, and I can work with all of my various accounts at the same time.

I could see this providing quick Express access to a private database in a container. I could have a container that connects to my system with privileged accounts, providing some separation from my host OS in case of a malware attack.

There’s a container with Chocolatey in there as well, so you can easily install whatever inside a container and save it off for later use.

I’m sure there are other possibilities, and I plan to keep experimenting to see what else I can do with the Spoon/turbo containers that will give me flexibility across machines, require less resources than VMs, and provide the separation from host machine dependencies.

September 23, 2015
Data Sprawl

When I was starting in the computer industry, it seemed that we had many choices for platforms, but once we had decided on a direction, the companies I worked for standardized on those systems. It seemed that there was less interoperability between vendors, or even subsets of products from those vendors.

That’s changed and these days I see products from different hardware vendors, different OSes, different development languages, even different database platforms being co-mingled and mixed throughout all sizes of companies. I see developers moving from Windows to OSX to Unix without a blink and data professionals going from SQL Server to MySQL to Hadoop easily.

Well, maybe not easily. Certainly there are challenges in learning how MySQL operates differently from SQL Server, which is a long way from the import and processing of data in NoSQL systems. However I do see some SQL Server professionals rising to the challenge and learning to work with these disparate technologies.

It seems to me that many of us in the future will need to develop multiple skill sets with different technologies just to be effective. Many of our companies will continue to deal with more data sprawl as not only will data be stored in RDBMSs and Excel, but we’ll get cloud services, NoSQL systems, and more that contain sets of data our organizations want to combine together.

We have seen XML and Hadoop integration in the SQL Server platform, with both R and JSON coming in SQL Server 2016. While I don’t know that any of these will come to dominate data analysis, I do think that it will behoove data professionals to be sure they keep their ability to learn sharp by experimenting with new technologies and growing their skills. Your company might not use Hadoop (or any new tech), but if you don’t learn about it, you won’t know if it meets a need you have.

However, even if you don’t decide to use the technology, the effort spent learning about it will not be wasted. Your brain will be more flexible, and you’ll have less anxiety if you’re asked to take a look at a new technology, maybe graph databases, something that is probably wildly different from anything you’ve ever used.

Steve Jones

The Voice of the DBA Podcast

Listen to the MP3 Audio ( 2.6MB) podcast or subscribe to the feed at iTunes and LibSyn.

September 22, 2015