Voice of the DBA

Author: way0utwest

  • Employee Slurping

    This editorial was originally published on Oct 21, 2006. It is being re-run as Steve is out at SQL in the City today.

    I’m not talking about soup at the employee cafeteria or summer trips to 7-11, but rather the newest definition of slurping: siphoning off data with portable storage devices. It started to become a big concern with the wide deployment of iPods with their 20+GB storage capacity and easy connection to PCs. The advent of this scale of portable device, made more disturbing because of their benign appearance, has raised the concern of IT security folks. Now someone could appear to be listening to music while doing their work and siphon off an entire database!

    Now a number of companies are starting to build software to secure USB devices and help prevent data theft. And they’re taking an interesting approach, similar to that taken by networks: they control the access to USB devices at the PC level.

    This is a step in the right direction, but it still doesn’t limit what data can be downloaded to the device if USB access is enabled. It does report on access, which is probably as important as blocking the transfer. Being able to respond to security events and track them down is critical since someone will always find ways around the limits you impose.

    The is of particular concern for DBAs as the sizes of these devices grow close to that of our databases. Losing a record or two of data is one thing. Losing an entire database is something else.

  • Virtualization for Security

    Will we see VMs on phones for security?

    This editorial was originally published on Nov 7, 2006. It is being re-run as Steve is at SQL in the City today.

    I read a novel some time back about the CIA. Well, not exactly about the CIA, but it was a spy novel and the CIA was in it. One thing in there that caught me eye, and probably the only thing since I can’t remember which book it was, was the use of a secondary computers by one of the analysts.

    In this situation, the analyst had a computer that was connected to the internal network, but not anything outside. Instead there was a second machine that could connect to the Internet and allow research, checking on things outside the internal network, etc. There wasn’t an easy way to transfer information between the computer (other than typing it in), so it provided some aspect of security.

    That same type of architecture may be the answer to IT control of user’s browsing. Imagine if a virtual computer were installed on everyone’s machine. With the high power we have and free Virtual PC, this might make sense. Have it automatically installed and connect on a different IP network than the regular machine. This virtual machine could have outside access for Hotmail, browsing, etc., while the internal machine would only allow access to corporate information.

    I know there are some issues and the cut-and-paste problem could still exist. There also might be issues with trying to track browsing for regulatory and compliance purposes, but it would prevent some of the secruity issues.

    Have a virus hit? Clean out and reset the virtual machine.

    It would also help propgations by users who run as adminsitrator. I know you’re not supposed to do this, but sometimes it’s not practical. You’re doing a lot of administrative work and need to check something on TechNet. With cross site scripting issues, even this might not be safe anymore.

    Actually the more I think about it, this might be the solution out here at the ranch for letting the kids browse their music sites 🙂

  • Buckets for Disaster Recovery

    Disaster recovery can be a huge project at any company. Considering the ways in which you build a plan that covers all the infrastructure, and it can quickly become a full time job for someone. The details, and the scope of the project can be overwhelming when you try to address your environment.

    There’s a way to make this easier: buckets. If you can group your systems into a few gross buckets that define those systems that have similar needs, you can make life simpler.

    In the past, I have typically built four buckets of systems for DR purposes, though I think you could go with three. These are the buckets I’ve had:

    • Critical Systems – high priority systems that typically must be running the majority of the business day. Note that you may have a 24 hour business day in which case downtime must be minimized to minutes.
    • Low priority – systems that we can function without for a day or two if we need to. Often development systems fall into this area.
    • Everything else – Medium levels of priority.
    • Not recovered – This is an optional level, but it’s almost always been a set of test systems, maybe some development systems that aren’t important enough to worry about.

    The fourth bucket, the “Not Recovered” bucket doesn’t mean you abandon those systems. In the event of an issue, you would make an attempt to recover them, but you might not spend time or resources practicing or preparing for the recovery effort.

    Bucketing your systems is the best way to easily manage your preparations for disaster, and also set some gross priorities. You might end up recovering systems within the bucket in different orders, depending on what happened, but this gives you an easy way to allocate resources, both in a disaster, and in preparation.

  • The Good Job

    I have the best job in the world.

    These days it also seems that many people are disenchanted with their jobs. They work for the paycheck with little loyalty or concern for their company’s business, and I think that’s fair. When I hear about companies that are not very loyal or concerned with their employees, asking for more work every year without more compensation, with less people and the threat of layoffs hanging over the employee’s head, I think employees have to start treating themselves as self-employed. They should consider their employment as a “contract” with their employer, one that is temporary.

    However I don’t know that this is how the majority of people feel. It seems that I regularly meet people that like their jobs, and feel their employers treat them fairly. I feel that way, and think my employer does an excellent job of partnering with employees, rather than exploiting them. People are treated fairly, trusted, and in return, they do a professional job, to the best of their abilities.

    In the last few months, I’ve attended quite a few events and spoken with hundred of people. While the people that often attend events are a self-selective group, but most of the people I’ve had conversations with like their jobs. For the most part they think their jobs are fairly secure. That’s comforting, especially at a time when much of the news in the world relating to the economy and job outlooks is bleak.

    If you don’t have a good job, it’s up to you to look to make a change. It can be a slow, drawn out process, but it doesn’t get done through delay. Make a plan, build up your skills, improve your brand, and set a goal to make a change to find a better job across the next year or two. Life’s too short to live with a crappy job for a long time, no matter how much they pay you.

    Steve Jones

    The Voice of the DBA Podcasts