Voice of the DBA

Category: Editorial

  • Timing is Everything

    We know that the online world is dangerous, with the number and variety of threats constantly increasing. For years, phishing with email has been a favorite tactic of hackers. Most of these emails are poorly written, and IT professionals often spot the fake ones, but there are times when the creativity of nefarious individuals is quite surprising.

    There was an attack on utility companies recently, which targeted engineers and purported to have some results for professional examinations. Since there is likely always someone taking an engineering exam as a professional at a utility company, this attack has a chance of succeeding. A Word doc included had a number of macros that installed a trojan for the employee. Hopefully few people allowed macro execution, but I’m sure someone was distracted, busy, and perhaps stressed about their exam results and didn’t think. Or clicked too fast.

    What is scary here is that the attack is suspected to be the work of a nation-state, which could mean substantial resources went into the attack. There are certainly potential issues if someone gets access to a privileged workstation, which is always a concern. This is why few people should have privileged access, and a privileged account should never be used for email software. A low-access account is the best way to work through emails and attachments.

    Many of us have privileged accounts, but imagine that someone gets a trojan on our laptop. When we use sudo or runas, we might find our credentials compromised. Think it can’t happen? What if all your IT staff got a note about an MS examination result? Or what if they got a free offer to take a certification test? I’m sure someone would click on it, and it only takes one.

    Security is hard, with education and caution being the most important tools at our disposal. Spread the word about stories like this and ensure all your staff, especially junior staff, is especially cautious about how and where they open any potential email attachments, click links, or even allow pictures. Security remains a challenge for all our organizations and we need to continually work at maintaining a vigilant environment.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Attacks Using Attacks

    Not too long ago I wrote about a security failure from an AI company, Evisort, that had a development database exposed on the Internet. There were reports of customer information being exposed and initially it appeared the Evisort was being negligent by putting an  ElasticSearch database with no password on the Internet. They were, but this might not have been a problem for customers.

    In an update, Evisorts dispute any customer data was exposed and they’ve updated security. They’ve hired consultants to help them and they are investigating and reviewing all documents that were exposed. They’ve offered to talk with any customers, and it appears they are taking this event seriously.

    So, was there really a breach? I don’t know. I have no firsthand knowledge of the actual data, and I haven’t seen anything that indicates Evisort is covering up data loss. Perhaps they are, but perhaps someone was just seeking to imply there was a breach. Doing so is an attack on Evisort, not with data, but with information.

    This might have been sent to a reporter to cause Evisort issues. Perhaps the issue was publicized to win a deal for a competitor that was near completion by making Evisort appear negligent. Perhaps this was an attempt to prevent Evisort from getting any more funding or reduce the value of the company.

    There are all sorts of attacks that occur on companies. Some of these are to get data to sell. Some might be to create bad press. Some might be to influence the value of the company or perhaps cost them customers. The attacks are often aimed to accomplish some secondary goal: reduce share price, interrupt funding, influence customers to stop doing business, or even to make competitors look more valuable or desirable.

    These are attacks on a company using some sort of other attack, like a hack of some sort.

    The world is becoming more and more scary for data professionals. We have to be increasingly diligent, and not only be able to protect data, but prove we are protecting it. With the swift and strong reaction of many in social media, it behooves us to take extra precautions and ensure we have evidence of our taking precautions ready to dispute any misleading account. More importantly, we ought to know how to react if we do actually lose data. Think about this ahead of time, as you might not have time to so once an event actually occurs.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Cloud Migration Challenges

    Like many of the trends in technology, I’ve been skeptical of the movement to the cloud. Quite a few people that I have discussed this with across the last five years have had concerns, and real challenges with latency, performance, and cost. The cloud hasn’t always been cheaper, with more than a few people having larger bills than expected.

    Across the last couple years, the trend seems to be changing, which is certainly reflected in the growing revenue Azure, AWS, and other providers are reporting in their annual reports. More and more companies are finding the cloud valuable, and the cost to be acceptable. While the cost still might appear to be larger than on premises, the lack of commitment and the change from capital expenditures to operating costs seems to be worth the move.

    Moving to the cloud, however, takes some work. Certainly your applications might need to change, but as compliance becomes a bigger concern for organizations, there is some good advice in this piece about secure cloud migrations. I think understanding your current security and how this can be improved or adapted to a cloud vendor’s architecture is important. Far too many people think about security after infrastructure is in place, which often results in poor security.

    This is one place I think the cloud can be more secure. Since the vendors don’t want issues between their customers, and certainly try to avoid issues on their own networks, the cloud platforms inherently ask for more security as you provision and deploy systems. Certainly there are companies that just open up all networking to get systems to work, and I hope this is the minority. Anyone moving applications to the cloud should configure secure networking, and limit access between resources wherever possible. Just like we don’t want applications using “sa” to log in, we don’t want every machine able to access every other machine. We certainly don’t want every user or application able to connect to every other one.

    I do think the cloud plays a part in the future of most organizations. Not all, but most, with any type of workload and application you may have. The performance continues to improve with new offerings, as well as the flexibility. The costs rise and fall, but the ability to scale up and down can make this option very attractive. DR is superior to what most of us can build on-premises, certainly in any short period of time, and there are sufficient security options that work very well for almost all of us. The challenge for most of us, and our organizations, is learning to implement them correctly.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • The Aware DBA

    A long time ago, at least, a long time in the eyes of my kids, I worked for a large organization as a production DBA. We had a generic monitoring tool, but it wasn’t SQL Server specific. I ended up writing my own enhancements for the tool that used its data, as well as gathering other SQL Server specific items into a local database on each instance. From there, I had this data copied to a central location each night and a report generated. This helped us with ISO certification (originally) and later, Sarbanes-Oxley compliance.

    I was reminded of that when I read Pamela Mooney’s post on Things You Should Know About Your Server. She follows the simple method of ensuring each server monitors itself and rolls up that data. This works well, even if I’d never want to do this again. The time I spent building a monitoring system wasn’t really time well spent. These days I’d buy some monitoring software and then query that data, bother the vendor for enhancements and have either a notebook or a smaller set of processes that gathered specific data I might need. Likely I’d use XE and some stored query data, but if I monitor infrastructure, I don’t want to have to worry about building and maintaining monitoring software.

    The main point from Pamela’s post, however, is that she seeks awareness of how the systems work. That’s the key for a successful sysadmin of any system. You should not, and do not want to, check each system every day, but you do want to know how to find out what is “normal” quickly and be aware of changes. We want to quickly narrow down potential and possible problems because of our experience and history with some server/instance/application/etc.

    Most of us get calls on a few systems regularly. We may know those well, but often we’re fire fighting and normal can be an elusive definition. There are often many systems that we rarely get called to examine, but most good DBAs I know have some idea of how almost every system performs. Having a little data available quickly allows us to diagnose whether a problem is real or imaginary, chronic or transient, as well as how to proceed to resolve any issue.

    Awareness is an important skill when dealing with anything on a regular basis in your life. Certainly in parts of life outside of work, but even at work, paying attention and having some idea how how your environment should work will help you catch, diagnose, and solve issues. The best DBAs might do this before the client even calls.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.