Voice of the DBA

Author: way0utwest

  • Shared Security

    When I worked in a large Operations team, we had various passwords for some systems that we stored in a password vault. This was on a network share that only the administrators had access to read. We used this for keeping a number of passwords for various services and systems that required sysadmins to access.

    However, we tried not to use shared accounts whenever possible. We wanted to ensure an audit trail, for both compliance and understanding of what happened in our environments. All sysadmins had two accounts, which allowed them to access most services. We only had a user/password stored for certain systems that needed some sort of separate account, and we did change those passwords regularly.

    Our customers didn’t always do this. In fact, I regularly found different groups using a single account, always logged in, for which everyone knew the user name and credentials. They never seemed to consider this a problem, despite regular security warnings from administrators.

    I was reminded of this story about a water treatment facility in Florida that was hacked. They had a shared account, used by many people, the same password for everyone, and a lack of a firewall. An intruder caused a release of chemicals, but no one was injured.

    Firewalls prevent a lot of issues, if they are configured to limit access. In addition, ensuring that each user has different passwords is important. This allows you to turn off access for certain people, which includes former employees. That’s basic security, and I’m surprised how often people forget about this, often because they worry about some system breaking.

    The tools we have to enforce stronger security have improved over the years, but we need to take advantage of them, and we need to ensure that good, if not best, security practices are followed. It’s easy to become lax over time, but remember that there are lots of threats out there, from hackers to malware, to former employees.

    Far too many people are attacked, more than are in the news, so don’t get complacent. We are all at risk.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • Daily Coping 23 Feb 2021

    I started to add a daily coping tip to the SQLServerCentral newsletter and to the Community Circle, which is helping me deal with the issues in the world. I’m adding my responses for each day here. All my coping tips are under this tag. 

    Today’s tip is to get outside and notice 5 beautiful things.

    It’s winter, and it’s cold. Still, you can find beauty in little things. I decided to grab a few shots recently while I was outside. Here are my beautiful things:

    • Azure – she think’s she’s co-trainer with my wife. She’s ready to start, waiting for the horse to be saddled.
    • Vega – She was running around, and stopped to wait for me. Quite patiently.
    • The view in the snow from the front yard. Always makes me smile.
    • Sun in Denver; a big reason we moved here.
    • A new tool, Ranger 570. The old one is old, and this gives us a spare, which will make repairs easier. However, this is also a really nicely engineered machine.

    20210221_171606

    20210220_132207


    20210218_091609

    20210222_122347

    20210220_122535

  • Being Professional

    I often write about data professionals, meaning those people who work with data and are paid to do so. Certainly some of you might be amateurs, doing data work as a hobby, but most of the people that visit SQLServerCentral work with data as a part of their career.

    The second part of that title is the “professional” part. What does it mean to be a professional? I saw some thoughts from Randolph West recently that caught my eye. He talks about treating others as you’d like to be treated, which is a good place to start for most of us.

    However, there are other considerations for being a professional in Internet age. Randolph covers a few, in terms of respecting others’ form of address, their time, and their own struggles. The world of work has blurred with personal time, especially when most of us are not in the same physical location, and our “environment” might include people that don’t actually work for the same organization.

    I’ll add a couple more items here that I think are important to being a professional these days. While we do understand that children, pets, and more might interrupt meetings, understand that security and privacy for our organization (and its data) is important. Lock your machines, watch what you share out loud, and caution your “co-workers” against sharing things that might be secure or sensitive.

    In line with that, be aware that you might accidentally share something from your personal life on a video call. While you don’t need to wear a suit and tie, you might ensure that you are not wearing something inappropriate. Certainly there is a running joke that people at home might not wear pants. Whether you do or not, be aware that standing up without pants wouldn’t be very respectful. It might also be career limiting.

    As we continue to move forward in work and life, with the challenges of both always and never being at work, for some or all of us, be professional to each other likely means being respectful, understanding, appreciative, and sensitive to others.

    It’s not my world; it’s not your world. It’s our world.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • The PASS Pro Videos are Live

    The PASS Pro program was an interesting educational opportunity that came out last year. A number of people subscribed, including me. I did this more to support the org than for the content, but I did want to watch the videos and learn some new skills.

    When Redgate Software purchased the assets, this was one of the first things we wanted to release. The process took a couple weeks, but you can now access the materials for free.

    All the courses were added to the Redgate University, as this was the easiest way to organize them on our side. You watch each of these for free:

    You can now work through these courses, without the quiz gates, and just view the material.

    I do hope we get the quizzes live, but for now, you can access these for free.