Voice of the DBA

Category: Editorial

  • Encryption Gets Broken All the Time

    There are always researchers and hackers looking to break encryption algorithms. In fact, there are regularly a series of challenges against the very commonly used RSA algorithm. Recently, the RSA-250 challenge was completed with the algorithm being factored, albeit with a key length of only 829 bits. Most of us would use a 2048 or 4096 key length, so this isn’t that disconcerting. Especially given the amount of time this took.

    The effort took 2700 core-years, and in real time, thousands of cores used for a few months. This was a new record, and one that scientists regularly compete for. There are challenges that are being run to try and help determine just how strong our encryption algorithm are in today’s world. I don’t think many of us have anything to worry about, but if you are still using any lower length RSA key lengths (512 or 1024), you might think about replacing these keys with longer ones.

    In fact, all sorts of algorithms and key lengths have been shown to be insecure, meaning they can be cracked relatively easily. In SQL Server, there are a number of algorithms that have been deprecated for this reason. While most people don’t use the encryption features of SQL Server, some do, and some of you might not realize they are in use in your system. If older algorithms are being used, you should change them as soon as you can. Right now, only the AES algorithms are active, and using any older ones requires a compatibility level of 120 or lower.

    This isn’t to imply that encryption isn’t strong or useful or necessary. It does provide protection, but it isn’t perfect. In fact, just like many organizations don’t rely on just locks; they also use live human patrols to secure their assets. You shouldn’t rely only on encryption along. Audit and monitor your systems for unusual and unauthorized activity, and then take the appropriate action, including revoking access for compromised encryption keys.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Is Now the Time to Learn?

    With many of us shut in our homes, it’s a stressful time. We’re often managing work, family, and the rest of our lives from an unchanging environment. If you’re like me, you may struggle to tell one day from the next. Thankfully I have an app the keeps the date in the corner of my desktop, since I have to check it regularly to remember if it’s Tuesday or Thursday.

    Some of us are busy, or busier, and some not as busy. Stress has changed, and I know quite a few people looking for some break in their routine. At Redgate, we’ve started the Community Circle, which has some technical resources if you’re trying to learn more or level up your skills. Some people are finding this to be a good time to tackle technical stuff, but not everyone feels that way.

    Personally, I am doing a little more, or was before I got really busy at work, but more I need a break. I have been trying to do things away from work, mostly to just change my routine. I also have been doing a bit less overall, mostly because I’m struggling to find more mental energy to focus after work.

    I saw this post from Kenneth Fisher, where he asked the same question and showed that he’s trying to learn to juggle. I have been doing a bit more guitar, which I find relaxing. As the weather improves, I’m looking forward to sitting outside with a drink in the evenings and just learning a new song or playing something old.

    The lack of movement for many of us does mean more time, but it doesn’t necessarily mean you want to focus on learning something. If you do, there are lots of resources, and we’ll keep providing information at SQLServerCentral. If you can’t focus, then maybe you just want to relax and consume something fun. My wife and I have gone through the Oscar Best Picture nominees, one every few days, which has been fun. However, you might try picking up a fun new skill, like juggling. A break trying something new, laughing at yourself, or just getting away from life, might help you cope better.

    Steve Jones

  • A Remote Work Guide

    It seems that the vast majority of people I know in the data professional world are working from home these days. Actually, I think more people are working remotely than ever before. I don’t know how much will carry over into the future, but I certainly think more companies will think about having people work from home more often. This might be the thing that finally gets many managers accepting remote work as a normal way for employees to get things done.

    Across the last month I’ve seen lots of advice and thoughts about how to adjust to remote work. Some I agree with, some I don’t. I’ve been full time at home for seventeen years at this point and my wife did it for nearly twenty. We’ve had a lot of experience, and learned a lot in that time. While thinking about the advice I’ve give to others, I noticed this guide from Gitlab for their employees on adjusting to working at home and wanted to share it.

    I think this guide has some good advice, though certainly finding space and finding separation between work and home life can be tough at first, especially with kids at home. I think it took me 2-3 months to really adjust to the new routine when I started full time at home, and even now, I can struggle at times. Usually I have the gym, coaching, travel, and other activities to break up life and get me away from my office. That’s not the case now, and this tweet from Scott Hanselman sums up things for me. This isn’t the same as my routine has been for over a decade. This adjustment is hard, and we should allow for fits and starts from both ourselves and others.

    Many of us technical people are somewhat introverted. I know I am, despite all the public speaking I do. It’s easy to retreat a bit into our own world right now, which isn’t necessarily the best thing. As the guide notes, experiment with some changes and new things. I have to say that I never thought a virtual coffee break or happy hour would be something I’d try, but I look forward to my 9am happy hour with Redgate staff every Friday. Don’t stop engaging completely, and as you find structure, experiment a little here and there.  Loneliness can creep up on you.

    If you’re a person that likes the written word, the SQLServerCentral forums have some great discussions. Feel free to join in to something fun, like coping, baseball, or anything not about SQL, or stick to technical topics if you like. If you prefer video, I’d urge you to reach out to a friend or family member, or even someone on Twitter, for a quick chat. I’ve made it a point to reach out to a few people every couple days, usually text or messaging, just to check in and say hi. It’s been helpful to me.

    Remote work is a challenge in and of itself, but this isn’t the same as normal telecommuting. Try some different things, build some routine, and remember to take care of yourself and your family in this challenging time. If you have tips or tricks that have worked for you, especially those of you in small spaces, share them with others in a comment today.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Mongodb Encryption

    The last decade has seen a number of new database platforms get implemented in a variety of organizations. Most of the newer popular platforms have been NoSQL (Not Only SQL) products, and one of the first that became quite popular was MongoDB. I first ran into a few customers using this platform around 2012/2013. At the time some customers inquired whether we had any products to help with development. We did, somewhat, as we invested in 3T.

    MongoDB has enjoyed a lot of popularity and set some standards for how to store and retrieve data. CosmosDB (and other products) has API compatability with MongoDB, precisely because of its popularity. While I’m not sure MongoDB is the replacement for your RDBMS, I’m sure it has places and problem domains where it shines. I’ve also watched the product improve and grow to meet the requirements and desires of more customers. One recent addition was field level encryption.

    MongoDB has had storage level encryption, similar to TDE in SQL Server. It also has had transport encryption (think SSL network protection). This new feature is more like Always Encrypted (AE) in SQL Server. Clients can perform the encryption and decryption, assuming they have the keys. This isn’t quite like AE as it appears to need code changes, but it does protect the data from system administrators, which is a concern for some applications and industries.

    How well does this work? There certainly is a challenge with managing keys, distributing them to clients, revoking them, and more. All of these are the same challenges more encryption technologies have to deal with, including AE. This is a good addition to all data platforms, which ought to enable encryption, but having, or even using, the encryption, isn’t a panacea for the problem of protecting data. We need lots of other things to be designed, implemented, and operated securely.

    I’m not a big fan of MongoDB, but it’s a fine platform, and it likely works well for some organizations. I’m glad that it continues to enhance its security capabilities, and I hope that anyone implementing it enables all that they can. Too many installations in the past haven’t had good security, and that’s a problem. If you manage data, secure your system, and be sure you continue to monitor the platform for security issues and keep learning more about how to best protect your data.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.