Voice of the DBA

Category: Editorial

  • The Auditor Attack Vector

    The phone on the desk buzzed. The CEO picked it up, expecting his assistant to let him know his next appointment had arrived. Instead he was told a person had called and wanted to discuss why his managers were paid less than some of their direct reports.

    The CEO was puzzled, and worried, so he accepted the call.

    “Did you know that you have programmers making more than some of their managers? ” the caller asked, quoting the specific people and their salaries.

    The CEO did know, acknowledged this, but declined to discuss the matter. Instead he asked who was on the phone, and how did they know the salaries of his employees.

    The caller declined to give their name, but told him that they had found a USB thumb drive outside on the street and had plugged it into a computer. A number of spreadsheets were on the drive, with one containing the salaries and organizational structure of the company. The called left the story there, promising to mail the drive back to the CEO.

    The CEO was upset, and worried, but waited a few days to get a package in the mail. He had been planning to terminate someone for carelessness. However when he opened the package, he realized none of his employees was to blame. Instead, this was a device given to an auditor who was verifying the accounting practices of the company.

    I don’t know the rest of the story, but it was given to me by someone that runs a decent sized company. It’s a scary story and shows a concern one that has nothing to do with most of us that work in technology departments. However this does show that there are always holes in our processes and practices. We need to consider the fact that many of the businesspeople we work with value convenience much more than security. We need to be sure we take precautions where possible, such as encrypting all data at rest, and in transit, wherever possible.

    It might not be our fault, and it might not be something we’re blamed for, but I certainly would feel some guilt if I had copied the data onto the USB drive without providing additional security, such as encryption or at least a password.

     

     

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.2MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • NoSQL Complaints

    I think that NoSQL databases are a really interesting set of technologies, however they aren’t necessarily a panacea for many problems, including scalability. There are likely some problem domains where a particular NoSQL technology might work better than an RDBMS, and perhaps some situations where many types of databases would work well.

    I ran across a piece that looked at some of the complaints that companies have with NoSQL technologies. It’s a generic piece, perhaps too generic, since a graph database is not like a document database. However it does talk about the issues that companies see, such as performing analytic queries. While a row-based RDBMS isn’t ideal for these queries, often the platforms work very well for a wide variety of reporting requirements.

    I do think some of the problems people have noted have to do with the maturity of the systems. There are a lack of references for how to run a high uptime NoSQL database, not many data models to review that may or may not work well, and relatively few administrative techniques to maintain these databases. The problem isn’t that NoSQL databases can’t meet your needs, or run quickly, or provide many 9s of uptime, but rather many enterprise professionals might not know how to find the information to accomplish these goals. That’s something easily solved across time.

    Ultimately I think the NoSQL world has a lot of maturing to do, and we, as professionals and media, need to start to differentiate among the various flavors of databases. I am glad to start seeing articles and blogs refer to graph databases when they cover a product like Neo4j rather than writing NoSQL. Slowly I am seeing MongoDB referred to more often as a document database, not a NoSQL database. It’s good to start to separate technologies and not confuse one with another.

    One thing in the piece I did notice is that it’s likely that we will see more platforms and products incorporate both RDBMS and non-RDBMS technologies together. We see that in SQL Server already with the addition of columnstore technologies in the last few versions and Polybase to SQL Server 2016. I expect we’ll also start to see some of the capabilities of DocumentDB added to SQL Server, along with, perhaps, graph based technologies in the future.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.7MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • Just Say No

    Just say no was a tagline from my youth. As I recall, it didn’t work well then, but I hope it will work better for a different audience and in a different context today. I was reading Brent Ozar’s note about one of the toughest things for consultants to do: saying no. While I certainly think this isn’t a problem for some people that can’t find work, I do think this is an issue, and one that isn’t just a problem for consultants.

    I have worked with many people across my career, and one of the things that most of them have struggled with is saying no. Maybe it’s fear over being scolded (or worse) by a manager. Maybe it’s the simple desire to please others. Perhaps it’s because we simple are eternal optimists, and we think we can handle everything thrown at us. No matter what your reason, many people find the inability to say no plagues them throughout their careers.

    I’ve learned to say no across the last decade. I probably say no to more things than I agree to accomplish. There are times that I worry about how much I decline to tackle things at work. However I have learned to deliver what I agree to, and deliver it well. I’ve learned that to do that, I can’t tackle every project, idea, or assignment. There are times I have to push back and refuse (politely) to do something.

    It’s a luxury for sure. I have been successful in my career, and I’m not in a position where the loss of my job would wreck my life. However I also realize time is the most valuable resource I have at work. Time is also the most valuable resource I have in life, and I have to learn to balance my use of that resource to continue to be successful. Hopefully you learn that as well.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.1MB) podcast or subscribe to the feed at iTunes and LibSyn. feed

  • The Biggest Data Breech (For Now)

    I keep reading the words “the largest data breach in history” in a variety of stories. In fact, given the tremendous growth of data acquisition, I’m guessing that this headline will continue to repeat itself over and over. I think I’m getting to the point where I’d rather just see a story say that xxx million customers were affected. At least then I’d be able to easily put some scale to the loss of data.

    What’s interesting in this case involving JP Morgan is there are indictments being handed down, to at least two men that somehow participated in hacks that copied over 100million people’s data. JPMorgan admits 76 million households and 7 million small businesses were compromised, which isn’t 100, but perhaps there’s something I’m missing. However the data wasn’t just sold, but rather hackers used the information to market stocks to the individuals compromised. That’s an interesting level of sophistication, and a scary one.

    Can you start to imagine criminals using the information intelligently to not directly sell the data but to make a secondary use of the information. Perhaps they will enagage social engineering by bundling the information with other data to perform some other attack on individuals? It’s entirely possible that we will see more sophisticated uses in the future as criminals work to evade or avoid the fraud detection systems that have been put in place.

    I have no doubt that bigger data breaches are coming. Perhaps we could reduce the impact and frequency with better security frameworks and development practices, but I’m not sure that any company out there will place a high priority on security over ease of access and speed of development. I do continue to hope that market forces will drive companies to build better detection and protection mechanisms, and our vendors will build better security mechanisms into all platforms.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.4MB) podcast or subscribe to the feed at iTunes and LibSyn.