Voice of the DBA

Category: Editorial

  • More Data Security Issues

    Employee issues are a big problem for IT security.
    Employee issues are a big problem for IT security.

    Insiders and human frailty are still a big problem in data security, according to a new study from Symmatec. Along with system issues these account for two thirds of data breaches. I suspect system issues means misconfiguration and poorly written code (from a security standpoint), though I can’t be sure there aren’t other factors that contribute. What’s disconcerting is that employee behavior problems seem to be rising.

    I think this is partly the result of attitudes and a lack of loyalty and respect from many companies towards their employees. It seems that job dissatisfaction is on the rise, and coupled with a lack of employment security, this makes it easy for some people to ignore regulations, not bother securing their systems, or even copy internal data themselves.

    I don’t know how we change the insider problems without fundamental employer/employee cultural changes. I’m not confident those will change in the short term, and I suspect next year’s report might look similar to this one. I do know, however, that we can each to a better job by learning more about secure coding, secure installation, and encryption. Many of these topics aren’t that hard to understand or even implement, but they do require some practice to build habits and become comfortable with the technologies and processes.

    Security is looking like a constant challenge for those of us working with technology for the foreseeable future. Learning more about how it works, and building the habits to implement it smoothly, in all our systems, or the challenge we should take on for ourselves.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • When Is Work, Work?

    pearl81001This editorial was originally published on Sept 11, 2008. It is being re-run as Steve is out of the office.

    More and more people carry Blackberry phones for work, getting push email and a constant connection to the office, it is sometimes hard to tell when someone is working and when they are not. It’s not just Information Technology workers, but everyone from paralegals to facilities workers carry the devices. And with the iPhone connecting to Exchange servers and Windows Mobile devices getting push emails, we’re all likely to be more and more connected in the future.

    It is debatable if that’s a good or bad thing, but in either case, there might be a side to this debate that you haven’t considered. Is it legal? This article talks about how some workers, specifically those non-exempt workers that receive overtime, may end up suing over the devices long leash. For those workers who are paid by the hour, and that includes some technology workers, is time spent on their phone work time or personal time? If they’re answering email on a commute or during downtime away from the office, are they working?

    There haven’t been any lawsuits, but a number of lawyers are asking companies to update their handbooks. The article mentions Disney asking non-exempt workers to sign a waiver that they would not be compensated for after hours work on Blackberry devices. I can’t imagine that standing up in court, but time will tell.

    Most DBAs and developers I know are exempt from overtime pay. They are asked to work in excess of 40 hours on a regular basis with no change in pay. Now some get paid for on-call work, some don’t, some get comp time, or extra time off, for extra work and some don’t. No one I know gets paid for taking a phone call or answering an email away from work, Blackberry or not, unless it’s a specific on-call responsibility.

    It’s an interesting question to ask as the line between when is work time and when is personal time with devices like Blackberrys. It’s not as though RIM is to blame as similar issues have existed as long as there have been exempt workers. At least now we get to go home at a reasonable hour. In past times, people would stay at work until all hours of the day or night. Look at lawyers, doctors, and bankers for examples of how things could be with remote capabilities for work.

    Personally I think boundaries should be setup. That might sound silly coming from the guy that was answering posts at 9:00pm on a Sunday night (and Friday), but I’m the exception that proves the rule. And that’s my own decision; no one asks me to work on a weekend.

    For most normal people, I think you have a right to ask for a policy and some boundaries to be set. We all need time off, we need time when we don’t have to think about work, or worry about being called. Time to enjoy the rest of your life outside work, is valuable to us enjoying life overall, and it’s valuable to us being more productive at work. That downtime, whenever we can get it, that time to recharge, gets us ready to face another day, week, or hour at work.

    Steve Jones

    The Voice of the DBA Podcasts

    Everyday Jones

    The podcast feeds are now available at sqlservercentral.mevio.comto get better bandwidth and maybe a little more exposure :). Comments are definitely appreciated and wanted, and you can get feeds from there.

    Overall RSS Feed: or now on iTunes!

  • A Release from Data

    Morihei-UeshibaThis editorial was originally published on Aug 14, 2008. It is being republished as Steve is at SQL in the City 2013 – London today.

    Have you ever had that frustrating day where you can’t get your queries to work, or can’t find a problem and spend all day working on an issue you can’t solve? Have you had customers or clients that make unreasonable demands, and you want to just punch the wall? Any co-workers that upset you with requests or complaints that make you walk away before engaging in some other career-ending action?

    Someone actually suggested to me that this might make a good topic as they noticed quite a few people that were interested in databases were also interested in martial arts. At first glance it might seem strange, after all, the traditional geek is more of a passive individual, someone that spends their spare time in virtual worlds they visit on the computer, on a TV screen, or in their minds while reading a book.

    I studied martial arts as a teenager for about 6 or 7 years, trying different styles and teachers as I moved around early in my career. It was a great exercise and a nice release after working hard during the day. However I got married, had kids, and my career took off, and I turned to running, swimming, and other activities I could do during lunch, freeing up evenings for my family.

    Over the last year, my middle son become interested in karate, and it got me back into a dojo after 15 years. We go together 3-4 times a week and even have one class together where parents and kids and study together. I’m even planning on going to the PASS Summit early and taking him to an aikido demonstration the weekend before ( Puget Sound Aikikai).

    Martial arts are not for everyone, but I will say that being able to focus on hitting a pad, and actually hitting it, is a great stress reliever for me. If you’ve never tried it, I’d recommend taking a class or two from a school that doesn’t engage in a lot of contact between people to get a feel for the sport. You might really enjoy it.

    If it’s not for you, I do think it’s important for everyone to take care of their body a bit, especially by putting it under some physical stress. Walking, running, basketball, even chopping wood with Grant, anything that gets you moving will only help the rest of your life. I’d encourage everyone to find some release for those days that you just need to unload some stress after work.

    Steve Jones

    The Voice of the DBA Podcasts

    Everyday Jones

    The podcast feeds are now available at sqlservercentral.mevio.com to get better bandwidth and maybe a little more exposure :). Comments are definitely appreciated and wanted, and you can get feeds from there.

    Overall RSS Feed: or now on iTunes!

  • Lost in Space

    hammacher-lost-in-space-b9-robotToday’s editorial was originally published on Sept 2, 2008. It is being re-run as Steve is traveling today and out of the office.

    Well perhaps not lost in space, but according to this article, a number of US airports report over 600,000 laptops lost a year. Over 10,000 are lost each week at the 36 largest airports. That’s a lot of bits floating out there in the world. There’s some dispute as to these numbers in another article, so it’s hard to know who’s correct. I tend to think these numbers might be high.

    In any case, what might be even more amazing is that 65% of these laptops are not reclaimed. What’s scary is that 53% of people surveyed said confidential company information was on their laptop and 65% said no effort was taken to secure their data. I found this on Bruce Schneier’s blog, and he sees it as a huge dollar loss for the country if the numbers are correct.

    My wife travels quite a bit, 30-40,000 miles a year, and she’s not surprised by these numbers. She guesses that the main problem is that there is no good way to match a lost laptop with a traveler. Unless you lose it at your home airport, with a lack of staff and the time it might take for something to get your lost and found, it’s likely you would never be able to search for it.

    And how long would you search? After how many days would you just move on and file a claim and replace the laptop? I tend to carry my important data on a USB key (and likely will upload to some service for future travel), so I’d probably spend whatever time I had in the airport, or maybe a day here in Denver, but after that I’d be ordering a replacement and moving on.

    Information has a tremendous amount of value, but to many of us, the information also has a shelf life. We might move on quickly and just accept the losses as part of doing business. I understand that and agree with it for the most part.

    However I think we should all have some sort of encryption and protection for our data. You never know when you might have some letter to a bank you drafted with your account information, or something else. For most thieves, I’d guess that an encrypted laptop isn’t worth dealing with. They’d wipe it and move on.

    Steve Jones from SQLServerCentral.com

    » Join the debate, and respond to today’s editorial on the forums

    The Voice of the DBA Podcasts

    The podcast feeds are now available at sqlservercentral.mevio.com to get better bandwidth and maybe a little more exposure :). Comments are definitely appreciated and wanted, and you can get feeds from there.

    Overall RSS Feed: or now on iTunes!