I’m back in New York on vacation, so you can re-read The Justification Database today.
Category: Editorial
-
Bad Culture Bad Security
I ran across a blog noting that Cisco has a vulnerability in a new product. The blog also lists two (one, two) articles showing that Cisco has had hard-coded credentials in the past. I understand that many times a known process is repeated, essentially copy-pasted between people, and we have similar issues as we have had in the past. However, in 2022 or 2023, it’s unacceptable to hard-code credentials in digital systems that will be used in today’s world.
What’s worse than having this issue is stating that the fix is “an upgrade”. Their verbiage for those without a service contract is: “Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.” Which, to me, is not only bad for the world, but it’s equivalent to the stuff that bulls leave behind in the fields.
I suspect that this product and software were based on something that already exists, and it was rushed out without a good security evaluation. Or perhaps there are developers and managers who don’t think that hard-coding credentials will compromise security.
That’s a cultural problem. Either you’re going too fast, or you don’t take this seriously, either way, you don’t have a good culture that values quality and protection. Certainly, their disclaimer about needing valid contracts or proving you have a device to get a security patch for a flaw they built is also a sign of a poor culture that doesn’t really understand the problems they are creating, nor are they taking responsibility for the issues.
At the very least, fixing their poor security ought to be free and easy. I get that there are likely some software upgrades included in this patch, given the nature of software development and limited branches under support. However, there are other ways to ensure those features aren’t enabled for customers who shouldn’t have them. Making the entire world of computer network infrastructure less secure because you want customers to pay for your mistakes isn’t a model I’d want to adapt.
I know many people don’t want more regulation or guidelines from governments (or even from insurance), but if I were going to accept some universal restriction, this would be the place. If you use hard-coded passwords, your product can’t be sold and no insurance claims apply if you are sued.
Maybe that would change the way Cisco and others build software.
Steve Jones
Listen to the podcast at Libsyn, Spotify, or iTunes.
-
Declining Work for Mental Health
This year has been a busy one for me. I had 30 trips on airplanes away from home and around 100 nights not in my own bed. It’s been quite a year, and a little overloaded. There have been a few months were I traveled little, but more than a few where I was gone more than I was home. I spent 19 nights away from home in September.
A few weeks back, I realized that I had another long trip coming up in October (9 days) and the PASS Data Community Summit in November. My body is a little worn out, but my mind is also distracted and struggling to focus. I recognized the beginnings of burnout when I realized that I was slightly dreading the Summit trip. While I want to see friends and catch up, I wasn’t looking for a long trip.
On the spur of the moment, actually while sitting in an airport and waiting for a flight, I sent a note to the SQL Saturday Oregon organizers asking them to withdraw my speaking submission and not select me. I felt bad for doing so as I try not to create work for others or submit to events without the intention to go, but the extra 2 days in Seattle would make lift hard, and I thought this was the best choice for my mental health. I also chatted with my boss a bit about some work opportunities that were coming up and decided to decline a few other things, as well as skip conference submissions in Q1 2024.
I’m not burned out, but I do recognize that I’m overloading my body a bit. Physically it’s a bit worn out and I can see that in my frequency and effort at the gym. Mentally I’m slightly dropping the ball on a few things, working slower than I often do because I find myself slightly distracted and looking for more breaks.
One of the big learnings for me over the pandemic was that I need to ensure I take care of myself and treat myself as I’d treat someone else in similar circumstances. I’ve had coworkers and friends struggle at times in life, where I’ve made an effort to work more and help them work less. I need to remember that for myself and ensure I can lean on others where needed. Redgate is an amazing employer and everyone is willing to flex with each other to ensure work gets re-distributed or we move deadlines. My manager and I have discussed this, and we are monitoring my workload moving forward in our regular meetings.
One of the best things I’ve learned over the years is to say no. I say no a lot to various queries on my time. Often when I feel I can’t deliver on time. This year I was looking forward to these opportunities, perhaps a bit too much, and ran myself down a bit with over-excitement. I recognized that and made an effort to take steps to help myself before I burned out or started missing commitments.
The last month (and half of the next one) has been a bit rough, but I’ve mentally prepared myself for the work, and seeing relief coming in a couple of weeks is helpful. I’ve learned a bit more about myself this year, especially in relation to my slightly changing job and hopefully, I’ll do a better job managing myself next year (or my boss will).
Learning to balance work and life is important. Remembering that life, family, friends, hobbies, faith, etc. are more valuable than work, and we need to ensure we don’t overwork ourselves makes us better employees and better people. Any of us can get overloaded in the short term, but don’t let that become an accepted part of your life. Your employer may push, but learn to push back and protect your physical and mental health.
Steve Jones
Listen to the podcast at Libsyn, Spotify, or iTunes.
-
Practicing (Annoying) Better Security
At Redgate Software, we’ve been looking to “level up” our internal security game. While we have had very good security during the 16 years I’ve been there, there have been a few security issues with our products. The speed at which we address things, as well as the communications with customers, has impressed me.
We’ve had almost no problems with our internal systems, unlike a few other places I’ve worked. We haven’t had the phishing/virus/breach/ransomware issues that I’ve seen at other employers or heard about from friends. I do think our IT staff is diligent and careful, as well as forward-thinking. It also helps that we’ve had a relatively small employee staff that worked in physical offices for most of our existence.
Recently, we’ve been on a security push to tighten up the way we deal with systems. As we grow our staff, and as we add more offices, there is a recognition that our attack surface area is growing. We also find more and more people using non-Redgate-owned devices. This year we’ve had a series of policies rolled out that we are supposed to adhere to in order to ensure strong security, as well as compliance with data privacy rules such as the GDPR.
One of these is a bring-your-own-device (BYOD) policy. For years I’ve used my personal mobile phone for Redgate, with a few settings enabled to allow a remote wipe if I lose it. However, I’ve also had a personal desktop that I use for daily work in my home office. I’ve never enabled a lock on this as my wife occasionally uses it to get a picture or other document. Or send me something I forgot to sync in the cloud.
Part of our new policy is that I need to enable a lock on my desktop, as there is privileged Redgate information on there. Not much Redgate data, but the machine does connect to our business OneDrive and SharePoint systems. This lock should be a 2-minute timeout, which means that I come back to my desktop after coffee, laundry, or something else to find it locked. After years of always locking my desktop in corporate offices, I somehow find this more annoying. Especially as I’ve gotten used to rarely typing my 15-character password. I mess this up regularly and have to (more slowly) re-type my password a few times.
I know this is better security, and I am always conscious of locking my laptop in our various offices when I go in. However, I find it annoying at home. Especially when I pop in away from work to look up something on the Internet. I keep telling myself this is good security, and good for both Redgate and our customers. I’m still annoyed by the change, but I know it’s for the best. Like many who work in organizations, I’ve been lazy about some security aspects for years, and the change is a disruption. I’m sure some of you feel the same way about the rules and protocols that your employers have implemented.
You’re not alone in desiring a more convenient workplace, but security is a series of overlapping measures that work together to protect data. Practicing and adhering to good security is a lot like a daily backup. Most of the time it’s something never need, but when there’s an issue you’ll be glad you followed the process that day.
Steve Jones
Listen to the podcast at Libsyn, Spotify, or iTunes.
