Voice of the DBA

Category: Editorial

  • Lower Your Attack Surface Area

    It’s no surprise that our systems are under attack by all sorts of criminals. Some organized, some opportunistic, some just aiming for vandalism. We need to protect our digital systems to prevent issues, and a part of better protection is reducing the number of places that are vulnerable. Those places include databases.

    This article discusses the rising costs of data breaches and the increased frequency of attacks. It also examines the increasing number of regulations that are demanding proof of stricter security measures. It can be hard enough to defend production systems, let alone protecting dev/test environments. I see an increasing number of organizations that limit access to production systems, even to the point that this impedes some of the daily work habits of technology professionals, but that is probably a good thing. Too many of us are too lax when it comes to security.

    There are lots of approaches to getting better at security, but one of the easier ones is to avoid making copies of sensitive data. About half of you (I hope it’s not more) still use production restores in dev/test environments. That’s a tripling of the places your data could be attacked if you restore a database to a development server and a test server. If could be even worse if you make more copies.

    An easy solution in today’s world is to build a better test data management process for either anonymizing and obfuscating your sensitive data or generating synthetic data. Both have their challenges and I suspect that most organizations need a combination of both approaches to both protect their data as well as build better software for their customers. After all, a huge amount of bugs are data related, where developers have not tested their software against enough different data elements. Both synth data and anonymized data help here to produce enough different edge cases that your testing is thorough enough to increase quality.

    Of course, you need extensive testing, which means automation. Ideally an automated DevOps flow that subjects your software to increasingly complex tests as it moves through your pipeline to ensure it’s ready for release. This also means a good set of test data, not only for QA, but for automated tests. You need a test data management strategy.

    Securing digital systems is a complex task, but we ought to try and make it easier on ourselves by developing good habits in how we manage both access and by limiting the copies of sensitive data.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

    Note, podcasts are only available for a limited time online.

  • Widespread New Technology Adoption

    This week I saw an article at Ars Technica that noted in 2025 that electrical vehicle sales had increased 28% in the US. That’s quite a level of growth in adoption of this technology, especially given how set in their ways the US can be and how often these transition away from ICE vehicles has been politicized.

    I’ve had a Tesla for a little over 3 years and I think it’s the best and most fun car I’ve over owned. The technology and convenience are amazing, and I still enjoy driving the car around. For the most part I don’t have range anxiety, though I recently skipped using it on a weekend trip. The car has proven to be very inexpensive to operate and I wouldn’t hesitate to purchase another EV.

    Apparently lots of other people feel the same, though not everyone. About 75% of new vehicles sold are still ICE vehicles, which I completely understand. Not everyone has access to regular charging at home and the cost of these vehicles, while only slightly more than ICE ones, is still much higher to start. That hasn’t stopped many people from evaluating and choosing to purchase a car that runs on battery technology. However, plenty of people just don’t want to adopt new technology.

    I see the same thing in the tech industry. GenAI has been quite the disrupter the last few years, but many people don’t trust models and don’t want to try to use them. I’ve also seen many people who blindly trust this new technology, which can be even worse.

    I’ve seen the same type of attitude in the past with DevOps, PowerShell, NoSQL and other technologies. Many people are slow to adopt new technology, for a variety of reasons. It might be they aren’t sure the technology really offers any improvement, which is understandable. After all, if something new doesn’t actually provide significant benefits, is it worth an investment? After all the investment is a cost and there are likely some downsides.

    There are other people who are resistant to any change or unmotivated to bother, preferring to stick with what they know and are comfortable with using. I don’t quite understand this view, as it’s entirely possible we originally learned a poor way of doing things. It’s also likely that as technology changes, there are improvements made from our learnings in the industry. Certainly doctors, mechanical engineers, architects, lawyers, and more adopt new practices because their professions evolve and move in new ways, so why should technology professionals be different?

    I’d like to think that the reason many people don’t bother to learn new (or improve existing)  skills or adopt new tools is that they don’t have time. We’re all under pressure to get work done, and often without any planning for our various administrative work and meetings, let alone time to invest in ourselves. However, I will say that finding a way to carve out time to read, experiment, and practice skills has helped me improve my own career prospects, as well as helped me convince employers to match my investment with their own time, resources, and funding.

    Steve Jones

  • Editorial Republish: The SQL Twilight Zone

    Once again, I’m not home. This time it’s vacation, well, working vacation. I’m in New Orleans to coach a volleyball team at a tournament this weekend. Hopefully I’m not too jet-lagged after my week of Denver-London-Denver-New Orleans travel.

    In any case, I thought it appropriate to republish the SQL Twilight Zone. If SQL Server goes away, I’ll pick any other platform. Snowflake sounds interesting now, but Oracle, PosrgreSQL, I’m not particular. I like working with data and helping others do the same.

  • Editorial Republish: Horrible Bosses

    Maybe I’m actually watching this movie as you read this. After 48 hours in London, I’m heading back to Colorado today.

    Actually a little more. I landed at 940a Monday and left at 11:35am today, a whirlwind trip to this amazing city. Not the first time I’ve done it, and likely not the last.

    You get to re-read Horrible Bosses as I try to figure out how to get back on a different time zone.