Voice of the DBA

Category: Blog

  • PCI and Encryption

    It surprises me how often I see people posting questions about what type of encryption to implement for credit card data. If you are processing credit cards yourself, and storing the data, you need to comply with the PIC regulations that exist. Here’s a good place to get started: https://www.pcisecuritystandards.org/.
    Actually the place you need to start is with your bank or processing company. They should be able to guide you in what requirements need to be met for safe data storage.
    However if you’re running some service and perhaps trying to store a credit card for a customer to make it easy to charge them over and over, that doesn’t mean you don’t need to comply. You are holding financial information about a customer and if something happens to the data, you’re at fault. Your company could be liable, and possibly even you personally if you make the recommendation to build something yourself.
    Good security isn’t magical, and it isn’t secret. It involves you using well known algorithms, protecting the keys, and following best practices. There are some great encryption technologies in SQL Server 2005/SQL Server 2008, but don’t just implement them without learning a few things about what best practices are and how these technologies work.

  • Netbook Replacing a Laptop

    My laptop died recently, actually died completely, unable to boot. The hard drive was fine, and I managed to stick it in my desktop and recover my files. The critical stuff (writing) was backed up with Live Mesh and had moved to the desktop already, but hadn’t been on the netbook as it hadn’t been powered on in about a week or two. So I fired it up to ensure that I had 2 copies of the critical stuff.

    Once things had moved across, I was hoping to actually get some work done away from my desk. About two-thirds of more of my writing takes place away from my desk. I lie in bed, or work in a coffee shop, before karate, etc. It’s more inspirational to me, and I depend on it.

    However the netbook really slowed me down. I’ve written before that I run many things on here, Office, SQL Server, I blog, write, etc. and it works well. It does work well once I’m doing something like writing, but switching applications, getting started, it’s slow. In fact so slow that I was frustrated getting the browser started and OneNote fired up.

    I traced some of this to a full drive, with over 15.8GB of stuff on my 16GB drive, and had to clean that out.

    Once that was done, things improved, but it was still slow to get started. When you try to switch applications, things take time and you have to be prepared for that. When I’m just writing, this is OK as I’m moving at a slower pace, I need to think, etc.

    However when I’m doing other work, editing, checking on the site, moving between aplications, it’s very, very frustrating. So much so that I know that this netbook isn’t a possible full-time replacement for a laptop. I’d considered one for the kids, especially my oldest, but it’s not going to work. He’ll need a real laptop for college, not a netbook.

    I still like the form factor, and times like this, where I’m catching up on blogging or writing while waiting for the kids at karate or tutoring it’s much nicer. The form factor works well. I can do email, browse, or write on it. But trying to really work, or get multiple things done doesn’t work so well.

  • Expert SQL Server 2008 Encryption

    51s2ofIFTrL._SL500_AA240_ Encryption is a tough subject, but it’s one that’s fascinated me for years. I downloaded PGP when it came out nearly two decades ago, and learned about the intricacies of symmetric and asymmetric keys. I thought it was fun, even when I couldn’t convince many people to consider using it.

    Last year at PASS I ran into Michael Coles, who I’ve known for a few years and had just finished tech reviewing a book for. He was planning on a new book and asked me if I’d be interested in doing another one, this one on encryption. I jumped at the chance, and sometime this past spring started getting chapters.

    I knew a lot, but had to learn a lot as well. I spent a lot of time Googling various terms and double checking historical references as well as algorithms and terms. I think I did a good job, and Michael and his co-author, Rodney Landrum, did a fantastic job.

    I found a package on my desk this morning, and opened it to find my copy of the book. It’s now out, and available in bookstores, including Amazon.

    So check it out, and learn a bit about this very important topic for DBAs. Not a lot of companies use encryption, but the ease of administration has grown with SQL Server 2008 and more companies are using it every day. I expect to see it start coming up in interviews soon.

  • The last good date for your database

    cc165445.cover(en-us)[1] I was reading the most recent issue of TechNet from Microsoft one morning and flipped through the column on SQL Server. This is one of the few paper magazines I get, and for some reason I see things in there that interest me.

    It’s not the topics, but often the delivery and format. I flip through it at my desk, or while cooking, and I’ll see things that I’ve missed on the Internet, or get reminded of things I’ve forgotten. The October issue contained one of those.

    Paul Randal writes the SQL Q&A column and he usually has something in there that’s worth knowing. This month he answered a question about some strange messages in the SQL Server error log. Here’s the message from my test instance:

    Dbcc_startup

    In case it’s hard to read, the message is:

    CHECKDB for database ‘db1’ finished without errors on 2009-09-21 08:33:03.713 (local time). This is an informational message only; no user action is required.

    This was on startup of the instance, right after the “starting up database” messages that you see. I have this same message for a couple other databases (db2 and master). It didn’t appear for model, msdb, tempdb, and a couple other databases I have on this instance.

    Why not? Or rather, why did it appear for these databases? Is DBCC CHECKDB running on startup?

    The answer is no, and Paul has a good explanation in his column. It’s not online yet, but I’ve read this before and Paul gave me a great reminder. The message is the “last known good” time for the database. It shows the last time that DBCC completed successfully, and gives you a reference point that you can use an a DR or corruption scenario to try and narrow down when things went bad.

    It’s also a good reminder that you haven’t run dbcc in some time on a DB. When I first read the column, I checked my error log and didn’t see the message. That was a stark reminder that I didn’t have maintenance set up on this instance. It’s a test instance, only been installed for about 20 days, but still. I ran dbcc on those databases that showed messages (db1, db2, master) only as a test. I’ve now set up maintenance on the instance to grab a backup every night and run weekly maintenance.

    If I had production instances, I’d love to be able to easily capture this data from a server, or even compare the messages to the databases on the server and then report back to me if CHECKDB hadn’t been run, or if it had been longer than xxx days.

    Sankar Reddy, a fellow MVP, wrote a script that helps here, and it’s worth checking out his blog on the last clean DBCC value.