Voice of the DBA

Category: Editorial

  • Auditing Matters

    There’s been some reporting about Yahoo Mail getting hacked and potential issues recently. I ran across this piece that talks about what happened and it’s an interesting read, but there’s one quote that stuck with me: “Yahoo reported on its Tumblr that it had detected “a coordinated effort”—basically, an attack—by somebody trying to gain access to user accounts.”

    It’s not the notification or the proactive resetting of accounts, but the detection that resonates with me. We’ll never stop all hack attacks. We’ll never plug all the holes in software. We’ll never anticipate the ways in which our systems might be compromised, but we can detect issues. I think more often than not we can deal with any hacks or attacksif we are aware they took place.

    We have some login auditing in SQL  Server, an auditing and eventing framework, and the ability to capture and store this data. However we don’t have good proactive tools to help us detect issues. I’d like to see enhanced tooling to allow us to review log data, write alerts that look for patterns, and more. While much of this can be built by DBAs, it requires use to develop and maintain software, and even then it’s easy to miss potential attack vectors if you don’t constantly supplement your knowledge and enhance your tools.

    Given what we have to work with, I’d encourage you to learn a bit about the different frameworks and gain some basic skills with the tools. I’d also encourage you to think about writing queries to look for potential hacking issues, like updating all of your lookup values to the same string, or embedding script tags in your data. I’d encourage you to write or speak about what you learn, and how you use the information. If you’d like to write software to make the task easier, that would be great.

    I’d also encourage you to befriend your network or security administrators and teach them how to query their own lo data. Lots of their tools collect data, but provide poor query tools for the information. Perhaps you can even build them a data warehouse that allows them to tighten security by examining their own data.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.4MB) podcast or subscribe to the feed at iTunes and Mevio . feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

  • The SQLCLR Impact

    While I’m sure there are a few of you still using SQL Server 2000 instances, I think at this point that most companies have moved to SQL Server 2005 and later. Even if you still manage a pre-2005 instance, chances are you have a few 2005, 2008, or 2012 instances as well.

    It’s been a little over 8 years since the CLR subsystem was added in SQL Server 2005. At the time this was announced, we had any number of DBAs worrying about the impact. Before SQL Server 2005 was released there were lots of concerns that developers would embed most of their database logic in SQLCLR procedures and cause lots of performance issues. That doesn’t seem to have been the case, but this week I wanted to ask you about your experience.

    Have you had to review and implement custom SQLCLR assemblies on your instances?

    I’m looking for an idea here of the impact of the SQLCLR in your environment. Do you have standard assemblies on multiple instances or have you dealt with an ad hoc object here and there? Do you think SQLCLR is a normal part of your applications or a one-off that’s rarely used? Do you go through the code and understand how the logic is implemented? Do you ensure error handling is implemented? Perhaps you’ve not dealt with it at all?

    I haven’t seen much of a call for SQLCLR objects from the various developers that have worked on the SQLServerCentral site. Most of them seem content to use their traditional tools: they use .Net code in the front end or T-SQL code in the database.

    Let us know this week. Has the SQLCLR been a regular part of your SQL Server environment.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.4MB) podcast or subscribe to the feed at iTunes and Mevio . feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

  • The Remote Balance

    I still have hope that we will see more and more remote workers in the future. As large companies downsize and choose smaller facilities, and as many new companies start from scratch, we’ll see many of them considering telecommuting to find the best technologists for their openings as well as reduce their infrastructure costs. As noted in the book, Remote: “Today, the new paradigm is move work to the workers, rather than workers to the workplace.”

    I don’t know if we’ll ever get the majority of people working remotely from offices or at home, but I do know that I see more and more people able to get work done outside of a traditional office. I see people checking email and responding to trouble tickets in all sorts of situations, and with all sorts of jobs. I suspect that businesspeople continue to do this more and more as devices and software expand to allow it.

    I saw that quote from Remote in a blog from Scott Hanselman where he also commented on that idea, but noted that we need to strive for some balance. It is great that you can fix a problem at your kid’s soccer game or dance recital, but it’s also important that you attend and enjoy those events.

    Like most tools, our remote access can be good or bad. If you check too often, become tethered to devices, and ignore the real world, that’s bad. However if you leave the office early, get to the game, and get some work done before the action starts, that’s good. Just don’t forget to prioritize the important stuff, which is usually not work. It’s the event you’re attending.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.0MB) podcast or subscribe to the feed at iTunes and Mevio . feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

  • The Security of Interconnected Systems

    It’s a scary world in the wild, wild west of the Internet. Many days I think that’s a closer metaphor to the World Wide Web than the relatively ordered Kensington High Street in London. There are lots of bad people out there that are scraping identities, hacking systems, copying data, and more on a daily basis. Indeed the power of computers means that these malicious behaviors can be done at a speed and on a scale never before seen in the world.

    I ran across this account of a blackmailer stealing a Twitter name using a variety of hacks across interconnected systems. What’s worse than the attack against someone’s digital assets is that fact that so many of the companies on the Internet have no good way of recognizing ownership. It’s almost as it could be back in the gold rush days when you had to be vigilant and constantly inhabiting your property to protect the assets. At least in that time you could file a claim that would be honored. I’m not sure a Facebook name, a Twitter handle, a SQLServerCentral login, or any name on the Internet can actually be “registered” by most of us.

    The problem isn’t so much the ownership of some digital asset as it is the potential cascade of problems when we can’t own an asset and possession of a username and password seem to be what matters. I’d like to think that corporate assets are better protected, and corporations are usually more able to take legal action against attackers, but it’s entirely possible they aren’t. Especially when many of the companies that provide services to both individuals and companies aren’t providing support. The “Google” method of building automated systems that provide support looks like “hope for the best and too bad if it’s the worst” from my perspective.

    As we connect more and more systems together, whether through sign-on systems, automated feeds, or other methods, the ability to protect the entire system is dependent on the weakest link. The ability to resolve ownership and security issues, however, seems to have no protection at all.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.5MB) podcast or subscribe to the feed at iTunes and Mevio . feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.