Voice of the DBA

Author: way0utwest

  • Pride and Security

    Do you love your job? I do.

    The weakest link in most security schemes is the human. We know that there are regular breaches of trust by employees, mistakes made (fat fingers, misconfigurations and more), and supposed favors done by someone with trusted access that send data to criminals. Social engineering, in a variety of forms, preys on the trusting nature of most people to gain unauthorized access, and unfortunately, it often works.

    Part of social engineering is the inherent trust for others that most of us have. Part of it is the desire that most people have to help others. However I think a part of it is also the attitude that many workers have when they aren’t treated well. When employees don’t feel they are a part of the company family and just work for a paycheck, they are less vigilant or caring about safeguarding the digital assets, and sometimes physical assets, of the company.

    If you had more pride in your employer, wouldn’t you be a little more careful in caring for the company and its assets? I think most people would. I don’t have any data on this, but I bet that the companies where people take pride in their work are more secure. Employees probably know more about each other, and problem recognize a larger percentage of the company. Workers will be a little more observant and protective if they feel that the company is “theirs.”

    One of the best things management can do to raise the level of security at the company, and build a better organization, is to ensure they are creating an environment that people enjoy and take pride in. That comes from showing respect, consideration, and fair treatment of all employees. It’s not even that hard to do, just be a decent human that does what’s best for everyone in the company, not just for the CEO.

    Steve Jones

    The Voice of the DBA Podcasts

  • Publishing in the Future

    A few interesting ideas and experiments in this piece on 21st century publishing. I especially like the part about most of the money in publishing going to pay for these advances that aren’t earned back. While publishers make a lot of money (go peruse a few annual reports), there are definitely some issues with money being given to authors for projects that are a complete gamble.

    The idea of shorts, and potentially subscriptions, is something I’ve thought of before. If I could ever get off my duff and do more writing, maybe I’d be able to earn some $$ that way.

  • Creating a Service Master Key in SQL Server

    The basis for all the encryption in SQL Server is the Service Master Key, which is the top of the encryption hierarchy. You can see the image below from Books Online of how this is setup.

    The service master key is automatically created when you create a key that needs it, usually a database master key. So there is no CREATE SERVICE MASTER KEY command.

    This key is encrypted and protected by the Windows DPAPI and the linked to the SQL Server service account. Since it secures all other keys in the encryption hierarchy, if you regenerate it, or restore it, all other keys it protects must be decrypted and re-encrypted. That can be a resource intensive operation, so don’t do that lightly.

    You can regenerate a service master key, and you do that with the ALTER SERVICE MASTER KEY command like this: 

    ALTER SERVICE MASTER KEY REGENERATE

    That’s it. If it works, no errors, no results. If an error occurs, you’d need to deal with it. However this isn’t something you should run often, and if you encounter errors while doing this, I’d suggest you immediately stop, backup all databases and master keys, and then work through the issues.

    In another post, I’ll talk a little about the alterations you can make to the Service Master Key and how to back it up or restore it.

  • The Connections Launch Event

    The SQLServerCentral track at SQL Server Connections

    The Spring SQL Server Connections conference will be one of the launch events for SQL Server 2012, the next version of the platform that we write about every day. This spring SQLServerCentral is sponsoring a track again, with Brad McGehee, Grant Fritchey, and myself speaking in one room. We’re all focusing on SQL Server 2012, trying to get ready to upgrade and use the new features.

    However we’re only a small part of the SQL Server track. SQLskills.com headlines the track, as they have for many years, with Kimberly L. Tripp, Paul Randal, and Jonathan Kehayias presenting some amazing information based on their years of experience (go to one of the SQLskills.com classes if you can). Paul and Kimberly have also invited a number of other great speakers, including Aaron Bertrand, Allen White, Brent Ozar, Glenn Berry, Mike Walsh, and more. These are the people that write many of books, blogs, and articles that you read to learn more about the SQL Server platform.

    The DevConnections conferences are a great place to not only learn about SQL Server, but also learn about all parts of the Microsoft technology stack. There are nine conferences in all taking place at the same time, covering Windows, Visual Studio, Sharepoint, Exchange, and more. There’s even a Cloud Connections, dealing with those issues that you’ll find when working with the Microsoft Azure products.

    It’s still winter in many parts of the US, so schedule your own “spring break” from work and come to Las Vegas this spring. The weather will be great, and you’ll have the chance to learn about all different type of Microsoft technologies and platforms in a fun environment. You can even take in an amazing show one of your nights in town and let your brain relax from all the tech talk during the day.

    Steve Jones

    The Voice of the DBA Podcasts