Voice of the DBA

Author: way0utwest

  • Physical Security

    Think your office is secure? You have guards during the day checking badges, you have key card systems to control and audit access and alarms set at night. You don’t worry if you have various system names or passwords scribbled on scratch paper. After all, who would target your office?

    You never know. With the large number of people working in technology, there are bound to be a few people with less than prefect morals. The turnover of employees in technology can be high, and it might not be as easy to recognize an outsider as you think.  Even in companies that only have 50 or so employees, it’s easy to assume the person you see in the company is new hire, contractor, or other individual that has reason to be there.

    Especially if that person gets into your locked server room because they’ve hacked the alarm or key card system. At the Black Hat conference, hackers demonstrated how they can get past many alarm systems and talked about their methods for cloning RFID cards by walking near someone. The fact that these technologies are available, relatively cheap, and can be implemented by people that have some knowledge of the systems means we have to be more careful than ever about the physical security of our systems.

    Be aware of the authorized users that can physically access systems. Ensure that you don’t have passwords or other critical information easily available, and encrypt your systems. Even if someone breaks into your data center, they won’t want to spend a lot of time there. If someone can easily get information, or copy files, they will. Adding a few security hurdles to bypass might mean the difference between keeping control of your data and losing it.

    Steve Jones

    Video and Audio versions

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

    Follow Steve Jones on Twitter to find links and database related items and announcements.
    Steve Jones Windows Media Video ( 14.4MB) feed

    MP4 iPod Video ( 17.5MB) feed

    MP3 Audio ( 3.5MB) feed

    Feeds are available at iTunes and Mevio

    To submit an article, rant or editorial,
    log in to the Contribution Center

  • Backup Your Certificate for TDE

    If you’ve enabled TDE, you need to be sure you have a copy of the certificate that protects the Database Encryption Key (DEK). If you follow my instructions, then you have one.

    If you didn’t make a backup, or you have just discovered a TDE database, make one now, and secure the password you use with your DR materials (off site).

    How do you make a backup? That’s easy. Use the BACKUP CERTIFICATE command. Here’s the command I use in demos:

    USE master
;
go
BACKUP CERTIFICATE TDEPRimer_CertSecurity
 TO FILE = 'tdeprimer_cert'
  WITH PRIVATE KEY (
               FILE = 'tdeprimer_cert.pvk',
               ENCRYPTION BY PASSWORD = 'AStr0ngB@ckUpP@ssw0rd4TDEcERT%')
;
go

    

    

    

     
    

    The certificate for TDE is in master, so you must make sure you’re in master for the backup. The TO FILE option lets you choose the file path. By default, this will be in the DATA folder for your instance, but you can choose other locations. You can give an extension if you like. This file is the certificate (public).
    

    There is a private key portion of the certificate, which is backed up with the “WITH PRIVATE KEY” portion of the command. This is where you specify the password and provide the protection for your certificate.
    

    You will need this password on restore, so keep track of it.
    

    
			
    
		
    
		
	
  • 
		
		
    
			
			
    Decisions, Decisions. Fall Events
    
			
    I was looking over my travel calendar this fall, and I’m somewhat amazed at the variety of events that are being held for SQL Server professionals. There are a number of SQL Saturdays, and if you can attend those, I’d highly urge you to do so. Most are free, or perhaps cost you a lunch fee, but they are great chances to see SQL Server presentations, network with colleagues, and get inspired with new ways to work with SQL Server. They take a day out of your life (they’re usually on Saturday) and there’s no break from work, but they price is right.
    

    However if you want something a little more exotic, or with a few more frills, you’ve got some great choices out there. I’m listing a few that I’m attending, and I hope to see some of you at one of these events.
    

    

    SQL in the City
    

    I list this one first because these events are sponsored by Red Gate Software, my employer, and they’re a lot of fun. They are also the right price: free.
    

    Like some of the paid conferences, Red Gate does a great job with amenities and food. The locations are nice, and even though it’s a one day event, it’s a lot to absorb in one day. This fall we have 3 large events, and 2 (possibly 4) smaller, seminar events taking place in the US. We’d love to have you attend SQL in the City if you can. The locations we’ve picked this year are:
    

      

    • San Diego – A seminar event, with the DBA Team, on Friday Sept 20, 2013.
      • 

    • Denver – A seminar event on development, on Friday, Sept 27, 2013.
      • 

    • Pasadena – A large event, on Wednesday, Oct 9, 2013.
      • 

    • Atlanta – A large event, on Friday, Oct 11, 2013.
      • 

    • Charlotte – A large event, on Monday, Oct 14, 2013.
      • 

    

    We’ll talk about some real world issues you face, and give you possible solutions. We do show Red Gate tools, but that’s because they’re the quickest way to show you a solution to a problem.
    

    Register today if there’s a SQL in the City event you can come to.
    

    DevConnections
    

    devconnectionsI have spoken at and enjoyed the DevConnections events for a few years. This fall the event returns to the MGM in Las Vegas from Sept 30 – Oct 4, 2013. There’s a great lineup of SQL Server speakers, of which I am one. There’s a lot to do, a lot to learn, and a lot of fun to be had in Las Vegas. With the schedule, this is a perfect event to attend and add in a weekend vacation with family.
    

    One of the great things about this event is that there are 5 conferences taking place together, and with your registration, you can attend any session in any one of them. This is a great event for those of you that don’t just work with SQL Server.
    

    If you’ve never been, consider coming to DevConnections this fall.
    

    SQL Intersection
    

    sql-int-centerSQL Intersection is a new event, managed by SQLskills. I spoke at the event this part spring, and I enjoyed it. Like DevConnections, the event takes place in Las Vegas, located in the MGM Grand from Oct 27-30. The speakers are selected and invited, and there are some very popular and talented speakers in this group. I’m honored to be a part of the event. I think you’ll get a ton of SQL Server knowledge here that you can apply back at work.
    

    There are 5 events taking place at the same time, so if you are interested in learning more about development, cloud computing , Sharepoint, or Azure, this might be a good choice for you. It’s also a fantastic time to take an extra day or two in Las Vegas. Halloween is truly a spectacle in that city.
    

    Take this letter to your boss, then register, and I hope to shake your hand when you come. If you use “Jones” as a registration code, you’ll get $100 off, and I get some credit Winking smile
    

    The PASS Summit
    

    passsummit2013This year the PASS Summit returns to the East Coast, to Charlotte, NC from October 14-18, 2013. The first day of pre-cons overlap with our SQL in the City event. This is the most popular, and largest, SQL Server only event in the world. There is a ton of networking that takes place, and it’s a great time to get to know other people in the community.
    

    There are a ton of sessions, too many in fact. Buy the DVD of the sessions since you’ll miss more than you attend. You can register today, and if you’re there early, look for me on Tuesday. I won’t be speaking at the Summit this year, but there are lots of other great speakers that you’ll enjoy.
    

    The Conference Argument
    

    I’ve got a busy fall. In addition to the events above, I have a few SQL Saturdays to attend and skiing to get in. I won’t be at SQL Live 360, but that’s another event you might consider attending. I’d love to speak there, but I need a break. Perhaps in 2014.
    

    I love attending these events, and I’d recommend them over a specific training class. Here’s why.
    

    If you aren’t self-motivated, you’ll waste a lot of time and not get much out of a conference. It’s easy to go to some sessions, or sit by the pool all day. However I’d argue that most of the people who aren’t looking to drive their career won’t get a lot our of week long class either.
    

    If you are motivated, you can learn the JIT skills from a book, by yourself, or with a relatively inexpensive class like the ones Pluralsight offers. However, at a conference, you’re the person that will network with others, talk about your problems, and get some inspiration or potential solutions from those conversations. You’ll also get new ideas and inspirations from many of the sessions. You’ll recharge better than you do from a class, and most people seem to come back to work more excited about SQL Server than when they left.
    

    If you’re a person that wants to move forward and are motivated enough to do so, consider attending one of these events this fall.
    

    
			
    
		
    
		
	
  • 
		
		
    
			
			
    Cool Projects
    
			
    I had a conversation recently with a developer that was working on a rather neat problem. This had to do with a financial system and it involved some complex calculations and real time interactions with a variety of systems. It was important for their company, and a lot of pressure was on this developer to not only deliver this software quickly, but also to have it perform at a very high level. This particular person was using Red Gate’s ANTS Performance Profiler to dig into their code, feeling pressure to make it as efficient as possible.
    

    However this person was also enjoying themselves. It was a challenge, and it was a cool project.
    

    I know this community is made up of people working in all sorts of industries, in a variety of roles. We develop many different kinds of software. Some may be for employers, some may be for ourselves, some may be for a side business, but  across that spectrum of work, there are some interesting applications.
    

    What cool things are you working on?
    

    It might not be software. Perhaps you’re working on an interesting data application, like a super collider. Maybe you work on some gaming software, or you manage a system that makes people’s lives better, easier, or even possible. I’m sure more than a few of you work on some real time systems, which have all kinds of data challenges.
    

    Let us know this week what type of interesting work you’re doing.
    

    Steve Jones
    

    


    


    Video and Audio versions
    

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.
    

    


    

Follow Steve Jones on Twitter to find links and database related items and announcements.

    
    

    

    


    
Steve Jones
Windows Media Video ( 16.1MB) feed
    

    MP4 iPod Video ( 13.4MB) feed
    

    MP3 Audio ( 3.3MB) feed
    

    Feeds are available at iTunes and Mevio
    

    To submit an article, rant or editorial,
    
log in to the Contribution Center