Voice of the DBA

Category: Editorial

  • Security for 2FA

    I got a new mobile device recently and despite the restore from backup, I still had to perform quite a few setup chores. Reconnecting various apps to services by logging in was time consuming, but simple. A password manager was useful here, since I have different passwords everywhere. I set that application up first and then proceeded from there.

    The only trouble I really had was with Outlook and mail. I have an IMAP provider for one account and Outlook doesn’t make it easy to figure out where to change the settings for this. The second issue was with my corporate mail, which is secured with a 2FA connection through Duo.

    This is a technology that doesn’t use text, but has an application on devices and pushes a notification to them. I get a push when I log onto corporate assets from my PC, and I have to approve a login from my mobile. This prevents sum of the sim hijacking that can occur, where someone might have access to my SMS messages. It also prevents a lazy guy with Google Messages from getting a code on the same device rather than walking to the other room to get my phone an ensure I have it.

    I had to get help from our admins with the new device, despite having the old device connected and able to approve the connection. I had thought this would work, but there was some issue with Duo. On one hand, maybe this is good that it isn’t simple and I can’t quickly approve a new device, in that it prevents someone from stealing my identity on a cloned device. On the other, in an organization of any size, where mobiles might change constantly, this feels like a time sink.

    This might not be an attack vector to be worried about, but I think it’s better to be safer here than we might need. I do think that good security is worth some hassle. I don’t really complain about having to periodically re-authenicate, the requirement for strong passwords, and I love having 2FA enabled on many services. I hope we continue to find more and stronger methods of protecting individual and corporate data, along with more respect for the rights of humans whose data is being captured and used by most organizations. I also hope that we continue to improve the security options in SQL Server, including adding 2FA.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Seeing the World Differently with a Coach

    I ran across an article recently that got me to stop and really think about how I proceed through life and who my coaches, confidants, and mentors are in the world. There are a few people I lean on, and while I don’t get the same advice from them as in this piece, I did find this to be a series of things in this post that made me stop and think.

    Leo Widrich is a coach to CEOs, founders, and executives.  Last year he coached 101 people and wrote about a few takeaways. It is an interesting read, and paints many of these executives with feelings, emotions, insecurities, and other frailties that I have. I suspect many others feel the same way in their lives.

    Each of these items made me think a bit, but perhaps the one that had the most impact on me was to think about non-attachment. I think this might be my biggest struggle, to accept difficult situations, and not lash out or get upset, but let the emotions wash over me, experience them, and then let them go. I struggle to do this without some sort of reaction, or most often, overreaction. I have recognized this a few times as I get older and gotten better at experiencing things without a out sized emotional response, but I still have work to do.

    Maybe the best quote for me was at the top: “… people have heard me say that I think it quite reckless and silly for founders and other executives to go through their life and business world (when you can afford it) without a trusted mentor, coach, advisor or therapist.” I actually think this is something most people need, especially those in stressful situations. I don’t know you need to pay a life coach, though a therapist is often a good idea. A good adviser, someone trusted and with your best interests at heart is invaluable as you go through life. I think I have a couple of them, and I’m glad I do.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Real World DevOps

    One of the more interesting aspects of my job is talking about building software with customers. As I do more of this over time, the discussion have changed from “what is DevOps?” to “how do we get started in DevOps” to “how do we improve our DevOps process?” These days so many customers have bought into some aspects of DevOps that the last one is quite common. There are still a number of companies trying to get started with DevOps in some way, but very few people I speak with have no idea of what DevOps is or how why it can improve your company.

    Of course, I’m not sure there’s a great standard definition of DevOps. I often lean towards Gene Kim’s Three Ways or Microsoft’s broad view of the principles. Ultimately, most of the practical things that I find myself discussing are how to smooth the process of integrating code from developers and getting it transferred to production. Everyone wants this to go smoother, with mistakes caught earlier, and with compliance with whatever internal rules, regulatory mandates, and customer demands exist.

    Grant had an interesting conversation with a few customers recently and wrote a blog about the conversation. There are a few items that resonate with me, and things that I like to emphasize to customers. The experiences from Stuart and Chris are common in any journey to improve your software process.

    People need to test and measure. While testing has gained traction in the application development world, it’s still fairly new to database people. However, as people try to reduce mistakes and problems, often from simple issues, they adopt more testing. They also start to realize that having instrumentation to help measure the impact of changes is important to learn what to test and watch out for.

    Starting small is important as well. While there are many, many commonalities in all my customers, the way they solve these with their teammates, and the order in which they solve them, varies. Even if you were to end up with the same VCS, build process and deployment script as someone else, the journey will be different. The challenges from internal people and processes, the evolution of habits in your team with vary. You need to find your own path.

    So start small, with a few people, let them learn and then teach others. Let them build up knowledge, habits, and skills that others can adopt. That’s how most things work in the world. A few people discover something and then many follow their footsteps. If you want to build a better software process, find someone to start doing it. When they find something that works, the rest of the organization can stand on their shoulders.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Confidential VMs

    Ever since we started to offload workloads to hardware that we didn’t physically control, there have been security concerns. I remember when this started with application service providers and web workloads. This has continued to be an issue as more and more types of workloads have moved to cloud vendors and other hosting providers.

    Google is trying to ameliorate some of the concerns by offering customers confidential VMs. These are special types of VMs, using encryption and hardware capabilities to protect the workloads from any unauthorized access. I don’t know to what extent this practically protects a workload compared to a non-confidential VM, as the details are a bit confusing. I’m sure there is some extra protection, but the weak point in most cases here is still likely the humans that use credentials to access the VM. I’d suspect a determined attacker would try to hack the sysadmin and their laptop rather than the VM itself.

    In any case, Google is trying to ensure the added encryption doesn’t cause any workload degradation. Hardware can likely help her, but I’m not sure that you can perform encryption and decryption without using more resources. There might be minimal impact, but there has to be some resource impact. At least compared to a non-confidential VM.

    I’m glad there is research and work still happening to find ways to improve security for systems that we might no longer control. I think that’s increasingly the trend. Whether you go with a cloud vendor like AWS, Azure, GCP, etc., or you look to host with a Rackspace like provider, more and more of our infrastructure is being outsourced, and I don’t know that the trend will reverse itself anytime soon. Even if it does, the more we can provide security hurdles against unauthorized access, the better.

    Steve Jones
    Listen to the podcast at Libsyn, Stitcher or iTunes.