Voice of the DBA

Category: Editorial

  • Elevation of Privileges

    At SQL Bits this year I attended a security presentation from Andreas Wolter. The session examined some attack methodologies, showing the flow that an attacker might go through to gain information about your database instance with SQL Injection. It’s a scary and eye-opening talk, and one that I might recommend to all DBAs and developers so that they can understand the dangers involved with poorly coded applications.

    One of the most scary attacks was the elevation of privileges from a web user to a sysadmin on an instance, mainly because of the Trustworthy setting being enabled. I had never imagined this as an attack vector, but it was disconcerting to say the least. However it got me wondering about instances I’ve managed.

    Would I detect if a new sysadmin were added? Or an existing user added to the role? I’m not sure I would, though that’s certainly something I plan on setting up with some sort of monitoring to detect. I would guess that most DBAs, whether professional or accidental, might not catch this either, at least until some audit was performed. At that time it might be too late to protect your data, and certainly too late to protect your reputation.

    Security is a tough topic, and it’s an ongoing process to protect your systems. I hope to see more presentations like this at future events, and I’d encourage you to request them for any events you plan on attending. You can certainly do this for all SQL Saturday events (there’s a suggest a session on the schedule page).

    Security requires vigilance and vigilance requires monitoring. Both of those also need knowledge, so be sure that you don’t neglect the security of your SQL Servers and continue to educate yourself over time as well as implementing technical solutions.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.5MB) podcast or subscribe to the feed at iTunes and LibSyn. feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

     

     

  • One a Week

    When Andy Warren and I first talked about SQL Saturday after the initial event in Orlando, we joked about whether we could have twelve events in a year, one a month. It seemed like a stretch goal, after all, how many events can you actually put on where the attendees don’t have to pay?

    The latest PASS Connector newsletter had the headline of “SQL Saturday: Setting Records” in which there were 86 events in the last year, 34 around the world and 52 in the US.

    52.

    That’s one a week, though there wasn’t actually an event every week. We had some busy weeks, mostly in April and September, including 6 events on Sept 14, 2013. That’s an amazing number of events where SQL Server professionals around the world are getting a day of training for free. The cost of some events is a nominal fee to cover lunch expenses, but all the speakers give their time, often delivering the same sessions they’d give at a paid conference.

    The success of SQL Saturday is due to all the efforts of the hundreds of organizers, volunteers, and speakers who work to give you a great event. If you attend an event, be sure to thank someone for their efforts. However much of the credit for the growth of SQL Saturday really belongs to Karla Landrum (b | t). The addition of Karla to the PASS staff, with her focus and support of event organizers, has made SQL Saturday grow far beyond what any of us might have thought possible at SQL Saturday #1, Orlando, 2007. If you get the chance, thank Karla when you see her.

    If you get the chance, I’d encourage you to attend an event in the 2014-2015 fiscal year. If there’s not one near you, organize one. You can put on a small event, with a single track, a few speakers, and support from your community. Lots of us would love to help support an event in a new city, even a small one. You might be surprised to see a nationally known speaker at a small event, but you shouldn’t be. We love helping the community.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.7MB) podcast or subscribe to the feed at iTunes and LibSyn. feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

  • Frustration with Bad Design

    This is not how you handle things. When you find security issues, and they don’t get fixed, it’s one thing to attempt to prove a point with a PEN test. It’s quite another to publicly expose information. You might find yourself in trouble, and you should be in trouble. This is a violation of the professional responsibility you undertake when working for someone.

    This is the type of frustration that occurs in many IT workers. I’ve seen more than a few people working in technology that are sure they know how to properly configure and manage an application. They know how to set up security, and they become upset with a company that doesn’t do a good job of running internal systems. They know that the architecture chosen for their application will fail when a load is applied.

    There are some smart people in IT, but sometimes they think they’re smarter than they are. Bad design, bad decisions, mistakes, even poor security practices will occur. However it’s usually not your company, and it’s not your place to prove that there is a flaw in a system. It’s especially true that it’s not your place to prove things without having been given permission to do so. Proving a point on your own is something children do, not professionals.

    When you find problems in your organization, it is your responsibility to report them. I hope you think it’s your job as a professional to do the best job you can, following the best practices as we know them. It’s also your decision to choose to leave a job if you can’t go along with, or abide by, the decisions made by your management.

    If your company has chosen poorly in their technology decisions, I understand your frustration. I’ve often shared it, but I’d advise you to do what I’ve done. State your objections and either support the chosen path or find another job.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.3MB) podcast or subscribe to the feed at iTunes and LibSyn. feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

  • Summer, Summer, Summertime

    It’s getting close to the end of summer, at least for my family. The kids start school activities and sports on Aug 11, so we’re just a few weeks away from me starting to wake up early each day and move them around. It’s been an amazing summer for me, one that I never would have imagined at the start of the year, and we still have a couple more activities planned.

    Most of my summer was my incredible sabbatical, which was the experience of a lifetime. My family had a few other events, and we’ve got a short vacation planned before school starts. While I’m sure most of you don’t have anything like a 6 week adventure away from work, I am hoping you had some memorable times. With that in mind, I wanted a poll away from work this week.

    What fun things have you done this summer (or this year) away from work?

    Many of you have kids, or at least plan some summertime holiday. We’ve seen traffic go down at SQLServerCentral, so we know at least a good percentage of you haven’t been diving into work each day and continuing your education. I suppose some of you have been working very hard on a project and haven’t had time to take breaks to learn something, which is a good problem to have. At least in the short term.

    Perhaps you have exciting plans coming up, but in either case, let us know what was a fun break from work this summer.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.0MB) podcast or subscribe to the feed at iTunes and LibSyn. feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.