Voice of the DBA

Category: Editorial

  • Masking Data

    This editorial was originally published on Mar 7, 2008. It is being re-run as Steve is out of town.

    I saw an interesting thread awhile back where one of our very talented community members was asking about how to go about altering data in an application for a demo. It’s a valid scenario and one that I’m sure many people have run into at some point in their career. You want to show data that’s somewhat real so that it showcases the application and what it can do, but you don’t want to show real names, amounts, or any identifying information.

    A bit of a quandary and it seems that many people solve it in one of three ways. They just use test data, which is a very small set of data and doesn’t show as well. Or they may alter everyone’s name to something like “Steve Jones”, all phone numbers to 555-555-5555, etc., which looks funny.

    Or you just show the production data and wink and say “I don’t usually do this, but since you’re such a valued client…”

    So for the Friday poll: Do You Alter Production Data When It’s Copied?

    Meaning when the data gets moved to a non-production system (demo, test, development, etc.), do you alter the data and obfuscate it to remove any identifying information. Make it “safe” data that can’t be used to somehow compromise your production system.

    It’s a good practice, and one that I used to follow at a couple companies. I didn’t have any tools, but I did write scripts, load a few base tables of names, and then run those scripts as part of the restore job. They would randomly reassign new names to people, companies, addresses, etc. We would also redo phone numbers in sequential orders (555-555-0001, 555-555-0002, etc), and even randomly add products to sales or amounts to financial figures. It wasn’t perfect, and if you worked on the production system a lot you could guess which people were which, but it worked well for testing and client demos.

    I actually ran into a product recently (Camouflage) that does this and it’s a great idea. It’s something that quite a few companies should be implementing to ensure that their non-production systems are that much more secure.

    Steve Jones

  • From Great Idea to End Result

    This editorial was originally published on May 5, 2011. It is being republished as Steve is at the PASS Summit.

    What’s the time for you IT department to get from great idea to a resulting application? This is a very good piece from CIO magazine that finds many IT departments are seen as too slow. However there are a number of companies that are trying to innovate and find ways to increase the speed at which IT departments can deploy an application and respond to a business need.

    One great quote in there is “velocity is more important than perfection”,  which is a tenet that I have found to be very true over the years. It’s not that you throw junk out that isn’t well built or tested, but that you don’t try to meet every possible requirement or handle every little issue. The system has to be secure, handle errors, and meet the basic requirements, but it’s more important to get something done and in production than to have it perform and scale perfectly.

    Is that heresy to the developers and DBAs out there? Perhaps, but I think this methodology has to go hand in hand with another mantra I heard fromJason Fried: do more of what works and less of what doesn’t. In this case if a system shows promise and starts to get heavy use, it receives more resources and perhaps gets refactoring in real time, even as it gets enhanced with new ideas.

    “You want IT to be in constant test-and-learn mode”, another quote showing that IT needs to be working closely with the business to try ideas, learn from them, and move forward. The Agile style of development applies, and in some sense I think this is the future for the strategic IT department of the future.

    For the data professional this means that you must learn to model quickly, and with an eye towards a flexible design that might need to change regularly. We need to understand the businesses we work in better so that we can anticipate how requirements might change.

    Management has to buy into the idea that applications will not be perfect, they won’t be polished, and most importantly, they are essentially prototypes that either need to have addition resources spent on enhancements or they should be abandoned quickly. However I think this is a great way to develop internal applications that can provide a nice ROI, and be a more enjoyable way for developers to work.

    Steve Jones

  • Positive or Negative

    While watching a presentation recently on a SQL Server topic, I was surprised by a design technique that the speaker used. I hadn’t ever thought of the issue, but it caught my eye and made me rethink the way I look at design, and even data.

    In this case, the speaker was building a table and looking to make a row active or inactive. This person chose to use a column name of “inactive,” which surprised me. I’ve always used an “active” column if I am trying to mark a row in a binary fashion.

    That got me thinking. I wonder if there is some impact to designing entities either way, but I wanted to ask this question:

    Are you positive or negative. Would you use an active flag or an inactive flag?

    This could be extended to any other type of choice, but do you look to flag an action as happening, or not happening. As readable or not readable? As usable or ignored? I’m not sure it matters, but I’d certainly be curious if anyone has any reason why you might choose one or the other. Is there some meaning conveyed? Let us know this week.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 1.9MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • The Dangers of Travel

    I cross a lot of borders, and I have been worried at times about losing my electronic devices. There hasn’t even been an issue, but then again, I don’t really have anything of value other than the hardware. The bits themselves are fairly replaceable for me as I ensure I keep things backed up in multiple ways.

    However, I wonder if this will start to become a new type of data breach. Will officials of governments be required to relinquish their devices when proceeding through customs? Will this happen to corporate employees? Something like this happened and it was unclear if this was an action on the part of the Department of Homeland Security in relation to an investigation. However, could this start to become a standard practice as a way for governments to spy on other governments or even corporations?

    This definitely sounds like a movie plot more than something that occurs in real life I would guess this is what we’ll find to be true here. It’s also not likely to be that effective if it does become a standard practice. If devices were being confiscated and checked at any scale, I’m sure we’d all be looking to travel with blank laptops that only had a VPN connection. Once we crossed a border, we could easily access information and download it as needed, deleting it before we recross the border.

    However carrying information on a mobile device is always a bit risky. You could lose a device by accident or theft, and anything you had on the hardware could be exposed to others. For most of us, it’s not a problem, but since some of us carry around database backups or developemnt data, we should be sure that we aren’t carrying sensitive information. There’s really no excuse to do so, no matter what your deadline. Use masked sets of test data that you don’t mind losing, and you won’t have an issue.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.1MB) podcast or subscribe to the feed at iTunes and LibSyn.