Voice of the DBA

Category: Editorial

  • Quick Security Mistakes

    How many of you have gotten an urgent request from someone in your organization? Maybe it’s a new database, perhaps a quick, “simple” change to an application, possibly even a new server or share that someone can use to complete their work. It’s something new that you need to do. When that happens, how many of you ensure that you follow all the same steps and protocols to comply with the urgent request?

    A few of you do, but when we’re in a hurry, many of us don’t necessarily complete every step. We may shortcut something to get work done. We may have the best of intentions to go back and complete the work, but in a busy environment, it’s easy to forget to complete that last step, which might be configuring security or running all or unit tests or even decommissioning some resource that a user is done using. Some of you will realize these are big missteps, and some of you will still make them.

    Someone at the Department of Transportation in Coloroado (CDOT) made a mistake like this (thanks to DCAC and Joey D’Antoni for the story). They stood up a virtual machine, connecting it to their local network, but failing to properly secure it. In this case, the machine was exposed to the Internet and connected with a domain admin account. As you might guess, someone got into the machine and executed a ransomware attack on CDOT.

    As Joey points out, a few mistakes were made here, but these are the types of mistakes that anyone can make. Lots of us follow a process over, and over, and over again. Until we don’t. Until we’re distracted, busy, or in a hurry. They we take a shortcut. Most of the time nothing happens, but most of the time is becoming less acceptable. All of the time is the standard, which is why we try to use a DevOps, GitOps, or other process that ensures all the steps are completed. Not most of them.

    Do yourself a favor and build processes to handle your tasks with a script or the push of a button. Ensure the operations are logged and audited. Use these processes to be sure that setting up a new system, database, application, etc. is done in a consistent and secure manner. There’s still plenty of work to do for all of us. These processes will grow and change over time, and need to be maintained. Use your brain for the hard problem solving task of building a process and let the computer execute it, the same way, to completion, every time.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • The Art of Commenting

    This week I noticed an article on comments in PoSh over at Simple Talk. It’s a nice look at the topic from Greg Moore and discusses the various ways that you can comment in the language. Since these scripts are often shared in a corporate environment and because they may outlast your tenure, it’s a good idea to include comments in your scripts and functions.

    The idea with PowerShell is similar to what you get from docstrings in Python. Since many people can script and build modules, being able to get some help and understanding of the code is important. Even for the modules I write, I may use them for some time and then put them down. When I go to use the same cmdlet or function again, I might not remember all the parameters or what I was thinking. If you’ve ever had to dig into code to understand what is happening, you quickly learn to appreciate those well documenting help strings.

    You may quickly learn to despise those that don’t write them well or even forget to include them at all.

    Writing a useful comment is a bit of an art. The author often needs to put themselves in the shoes of a less skilled individual, or maybe one that is context switching and needs to quickly understand what the code is doing. Not necessarily exactly how it works, but what it is supposed to do. This helps us decide if we can use the code quickly, or if we might need to dig in further.

    In the article, Greg points out some nice additional comment items, such as requirements for the module to run. These are the types of quick enhancements to code that greatly improve its useability for others. I’d highly recommend everyone learn about comment based help in PoSh, docstrings in Python, and other valuable commenting techniques in your language of choice.

    Learning to write good comments is a valuable skill, one that your team will appreciate. Since most of us work on teams these days, those skills just might make you more desirable for that next promotion or even a new position when word gets out. Practice becoming a good comment writer.

    Steve Jones

  • The Time to Patch

    Microsoft has spent years working on building a reliable and dependable patch process for their software. While some products have had more sporadic updates, SQL Server has moved to a fairly regular schedule. Not quite a predictable “Patch Tuesday” schedule, but you can count on a CU arriving every month or two for SQL Server.

    Most people don’t patch every month, but slowly customers are getting used to regular patches for SQL Server. Microsoft would prefer you use one of their “evergreen” releases, where Microsoft is in control of patching. Azure SQL Database, and Managed Instances are handled this way, but with Azure Arc, you might deploy these inside of your data center and not worry about patching anymore.

    Most of us won’t get there anytime soon, and we will need to patch our instances. This week, I’m wondering about your patching process. Not whether you patch or not, but rather the extensiveness of your patching when you do decide to apply a CU.

    If you decide to patch a particular version in your environment (2016, for example), how long does it take you to patch all your SQL Servers? Do you even get all systems patched, or are there always lingering systems that can’t be updated because of some dependency?

    Maybe one other question might be how long does it usually take you to decide to patch your systems to some level? Or do you just randomly patch instances as needed?

    I am a big fan of leaving systems alone that are running well, but it seems the quality of patches from Microsoft has improved over the years. I’m not quite sure I’m at the point where I want to patch everything to month a CU is released, but I do think a regular process is a good idea, and hopefully it’s one that completes all instances for a version in less than 30 days.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Finding Motivation to Learn

    Monica Rathbun wrote a piece on investing in yourself, which I think is a good way to think about spending time and resources on learning. Every time that you spend some brain power on building or improving your skills, you are investing in your career, and giving yourself another way to drive your career in the direction you want to move.

    There are no shortage of excuses that Monica lists, and I’ve heard most of them. These are certainly hardships for your career, but these are things that many other people face, both in this industry and others. While these could be a short term reason to just grind out work, none is not a good long term excuse. I can accept you not progressing for a few quarters, but I’d hope you learned something new and helpful to put on your resume or CV every year.

    Doctors are constantly reading and learning to keep up in their careers. Lawyers and CPAs often give up weekends on their own to continue learning. Even mechanics, carpenters, electricians, and more are often working through continuing education. Some of it provided or funded by their jobs, some not, but plenty of it takes place outside of work hours. It’s just accepted that growing with your career is the norm.

    Most IT people expect they need to keep learning, but I find so many people are unmotivated to do anything their boss won’t provide, whether that’s time or funds. That’s a mistake, in my opinion, as you are one unexpected event from scrambling to find a new job. Plenty of people in that situation find themselves taking a pay cut, getting a longer commute, or finding more stress in their new position.

    Continued learning won’t necessarily prevent that, but it does increase the chance that you’ll be a more attractive candidate and perhaps have you pick of positions rather than settling for just some job you don’t want. The more you know, the more you can show, the more you document with a project, a blog, or elsewhere, the more likely someone is to want to hire you. Hopefully that means you find opportunities that suit you, rather than are just available.

    Steve Jones