Voice of the DBA

Author: way0utwest

  • A Welcome Intruder

    Have you every tried to get past your own security?

    One of the things that many large companies do is hire companies to evaluate their security. This often involves some sort of test of the security systems by an individual whose experise is breaking into companies. There are some experts who study the techniques used to break security, but I suspect that often former hackers/crackers are hired because they have practical experience breaking into systems.

    However for most companies, the security is only examined when there is an actual issue. I know most IT people that manage web systems are told about security lapses when the site si defaced, or when your data is discovered posted in some other location.

    This Friday I wanted to ask this question:

    How many of you have attempted to penetrate your own systems?

    You could do it yourself or get a friend to try, but have any of you actually performed some type of penetration test and what did you do? I typically haven’t at most of my jobs, but I have spent time thinking about how I would penetrate the systems and then made an effort to close any holes.

    My feeling is that most of the data breaches or losses occur because of attacks against the weakest links in the security system: humans. Social engineering, which taking advantage of most people’s good nature and desire to help others, is usually the biggest problem. Theft of laptops is also an issue, but I think the targeted attacks specifically aimed at your company is fairly rare. The exception would be SQL injection attacks, which spring up constantly at site after site, mostly because of poor development practices.

    We can get better at securing our systems, but it takes some effort, and a belief that we are vulnerable. Maybe setting up a test against your own systems will convince you, or more importantly, your boss, that it is worth the time spent better securing your systems.

    Steve Jones

    The Voice of the DBA Podcasts

  • Fast Migrations

    No matter if Hyper-V or VMWare are faster, competition will spur innovation.

    Virtualization is becoming more and more popular all the time, and if you don’t know much about this technology, I would highly recommend you begin learning. In fact, if you are a technology worker, you ought to have some sort of virtualization software installed on your computer right now. Testing, practicing, learning, all of these are made easier with a virtual machine that allows you to try out ideas without affecting your daily work.

    One of the advantages of virtualized servers is that they can be moved from one set of physical hardware to another. If you find that your virtual machine (VM) is not receiving enough resources from the host, you can move it to another less busy host, and improve performance. What’s even more amazing is that you can move this VM while it is in use. In fact, your clients may not even notice that the VM has migrated to another host, even while connected. To me, that’s absolutely amazing.

    The way it works isn’t important, but how quickly and smoothly it moves is important. VMWare and Hyper-V both support this live movement, and this might be the place we find the next race to speed up performance from software vendors. According to this article, the latest version of VMWare can move hosts five times faster than Hyper-V. Whether that’s true or not, I think it’s good that there is competition in this area, spurring innovation and research into ways that we can improve hypervisor performance.

    Improving that performance will lead to more applications for virtualized machines, including databases. I know plenty of people that are running SQL Server on a virtual host, and doing so quite successfully. It can be done, just be sure you do a little planning and think about how you virtualize your server. Also be aware of the limitations that exist in the hypervisors and don’t assume every SQL Server instance makes a good candidate.

    As always, test before you make the move, and be prepared for issues to come up, but don’t be afraid of making the move to virtualized database servers.

    Steve Jones

    The Voice of the DBA Podcasts

  • A Refreshing Break

    Taking a break on the Winter Park slopes

    Thanksgiving is always the biggest break from work for me each year. My family goes away for a almost a week of skiing to take a break away from our busy lives. Last week I was gone, taking 6 whole days away from work and I came back this week, with a lot of emails, articles, and various other work here at SQLServerCentral.

    This time, however, I tried something completely new. I didn’t check my email from SQLServerCentral, visit the site, or do anything else work related during the time away. That’s a first for me, as the last few years I’ve been pruning emails on my phone during vacation, handling minor items as I had time. It was hard, since my email client would show an ever increasing count of unread messages, but I made a point of not working during the time away.

    I was very refreshed when I came back this week, enjoying a couple days over the weekend of catching up on chores around the house. For the first time in a long time I wasn’t anxious to get back to work, and I completely enjoyed the time away. It never felt like checking a few emails was that distracting, but it was, and it made quite a difference for me.

    It’s the holiday season, work usually slows down, and many people take some time off around the Christmas and New Years holidays. I’d urge you to avoid email and work completely, even on your smartphone when you have a few minutes. Keep a book around, start a few Words with Friends games, or use some other leisure distraction to give you a complete break from work and see if you come back refreshed.

    Steve Jones

    The Voice of the DBA Podcasts

  • Forgiving Mistakes

    My main phone line at the house has been on the fritz for about 3-4 weeks. Yes, we still have a main line and it’s a legacy holdover from having that number for a decade and it links do our DSL account. We may get rid of it at some point, but for now we wanted it working. We actually weren’t aware it was down until a service repairperson told us when they arrived. We checked, and sure enough, no dial tone.

    My wife and I are somewhat savvy and we tried to debug it, but it was down. With travel and holidays, it wasn’t until Tuesday morning that we called CenturyLink for service and I was pleasantly surprised by a technician arriving in the early afternoon.

    He tried a few things in the house, then set up a tone generator and drove back out to the street. Yep, he drove. My driveway is 1/4 mile long and it’s another 1/4 mile to the paved road, and a mile and a half to the main road.

    About ten minutes later he came back and said things were fixed. We checked, and sure enough, we had dial tone. He then explained what happened: our line was cut.

    I was surprised and worried, until he explained that when you service lines in the boxes, there is often a little extra wire on a connection. Small scissors are used to snip that off and clean the connections, but there are a lot of wires in there and sometimes one gets accidently cut by a tech. He surmised that another tech was in a hurry and accidently got one of our lines (we have two). He apologized again, we shook hands and went on our ways.

    My Reaction

    I wasn’t quite sure how to react to the situation after that. Should I complain to CentuyLink and seek some credit on our bill? Should I vent on the Internet about shoddy workmanship? In the end, I told my wife it was fixed, explained what happened, and we both let it drop.

    Andy Leonard wrote a great piece on stress during the holidays with a very important section on forgiveness. I forgave CenturyLink because it seemed like the right thing to do. A few dollars on my bill aren’t worth the time it would take me to call and the aggravation I’d cause myself and some customer service representative in order to file a complaint and seek credit.

    I make mistakes at work. Heck, I make them all the time, and I don’t expect to be banned, burned at the stake, or excommunicated for them. They’re mistakes. I learn from them, I try not to make them again, I try to do my best, but I know that there will be a few that I make.

    I expect my co-workers will make mistakes, and I have to live with some of those. I might be annoyed, or inconvenienced, but I understand that most of the time they are just that, mistakes.

    I wonder sometimes if we’ve forgotten how to forgive in this world, forgotten how to tolerate the imperfections that exist in all of us, and in the work we do.