Voice of the DBA

Category: Editorial

  • The Care of Data

    It's not just a Dropbox problem

    DBAs are supposed to be trustworthy. After all, they are the custodians of data and often have access to sensitive information because of the nature of their system administrator level privileges. Their turnover ought to be low, and hopefully they have spent years building skills and a reputation that will provide them with a good job. They ought to value this investment and treat it seriously. Customer Service people are not usually in the same position in their careers, often at the beginning of their technical careers and usually change jobs regularly.

    Recently Dropbox had to back off the stance that it’s employees can’t view your data, with this note that their staff can access your files in some circumstances. There’s no evidence that employees have mis-used their access, but it could happen, and that’s a concern. It’s a concern with any cloud based service, and I think this is one area that cloud-type vendors really need to assure their customers that it won’t happen.

    Another major concern is overall security. If a cloud vendor’s employees can access your files, so can a hacker that gains access. That is, likely, an overriding concern of many customers, and it’s an area that I think that we really need to disclose openly the measures taken, the auditing in place, and the monitoring to detect any issues. Better encryption that actually prevents access by the vendor or it’s employees is a better solution.

    I hope we get encryption methods because the third major concern with cloud data is access by legal authorities. There are cases where the government might have a right to access your data, but that should be when they serve you with notice, not some company that is holding your data.

    There are many great customer service people and DBAs with strong worth ethics and morals. They take their responsibility as the custodian of your data seriously. There are a few, however, that are not so professional, and release information, sell data, put stories or video on some site like YouTube or TheDailyWTF for a laugh. Something that I’m not sure most of us that store data in the cloud would like to see happen with our pictures or video, and definitely something that companies would not want to see with proprietary information.

    Steve Jones

    The Voice of the DBA Podcasts

  • The Ad Hoc Change

    Ad Hoc changes are not what I like to makeHow many times have you been asked to change data in a production system? If your career has been like mine, it’s probably too many times to count. It seems that there are always data issues in production, and the DBA is asked to fix or correct something. In my mind, there are two many causes of this: user error and code bugs.

    In both cases, you would hope that some application contains the feature to allow a user to fix an error: either one they created or one the application slipped in. However in the reality of today’s IT world, too often there are not enough tools to allow an application to be used to correct issues. Just like testing, it seems that too often we haven’t spent enough resources before deployment in an area where they are needed: tools. As a result, it’s time for the DBA to change things.

    I saw a blog from Jon Russell recently that pointed out a few things that it’s easy to forget when making these changes. Many DBAs know their systems very well, understand the data relationships between tables, and hopefully, have declarative referential integrity (DRI) in place to ensure data integrity. However it’s easy to forget about some business rule coded in a trigger, or the downstream implications of a data change. That’s was a problem at SQLServerCentral at one point when I corrected someone’s question of the day response, but didn’t realize that their total points are stored elsewhere and needed to be updated separately. In that case I ended up with a lot of data to fix.

    We do have to make manual changes to data at times. When we do, Jon’s list of steps to include in the process is important, especially in many companies where auditing is demanded or even required. Keep copies of the old data, document what you did, and most importantly, make sure you’ve sent notifications. Often if an error crops up, it will be noticed by the end-users that usually work with the data. An email from the DBA just might help them find mistakes quicker, and prevent even more problems.

    Steve Jones

    The Voice of the DBA Podcasts

  • The Backup Passwords

    Hopefully you have better password management

    One of the things that my boss was excited to implement a few years back were passwords for our backups. Actually we were using a third party backup utility, like SQL Backup, for our SQL Server instances. We purchased the tool because of the compression, but the encryption feature was appealing to management in the wake of so many data loss reports in the media.

    It seemed like a good idea, and we started to make plans for the backups. However we quickly ran into a concern: how would we manage the passwords for the backups? After all, if we lost track of the passwords, then the backups couldn’t be restore and that would be a problem. Keeping the same password forever was only slightly better than not having a password given the turnover we had seen at the company.

    We used Password Safe to track current administrative passwords for our team, and that worked well, but backups introduced  the new dimension of time into our password storage.  We wrestled with the problem and came up with a solution, but I thought it would make an interesting Friday poll:

    How do you deal with key management across time?

    This mostly applies to backups because most other systems or accounts only have one password at any given time. However backups could exist for a long time, and even in a short period of time, you might have 3 or more passwords to manage. If you changed passwords one day and had an administrator quit the next day, you might end up with another change and 3 passwords across 3 days of backups.

    I want to know if you’ve thought about this and how you deal with it, or if you ignore it, keep the same password, avoid encryption or any other ideas.

    Steve Jones

    The Voice of the DBA Podcasts

  • Greed Is Good (for IT)

    I think that the lottery mentality that so many executives of companies have these days is bad for business. The idea that someone can be promoted from a director or vice president to CEO and then earn enough money in bonuses, benefits and stock options to retire is silly. People that lead a company should make more, but their jobs should be no more secure than anyone else’s in the company, and they shouldn’t be paid multiples more than their direct reports. If they lose their jobs, they should have to get a new one, just like the rest of us.

    Last week LInkedIn had an initial public offering (IPO), which was very successful. The company raised money, which hopefully will help it grow, and many stockholders and investors became rich. That might not be important to data professionals, but the news may have caught the attention of your management, and that could be good for IT.

    The CEO of TheLadders.com wrote a blog about the event, and he brought up an interesting point. Executives and management in many companies probably are thinking that social networking, or just online engagement with customers,  has an impact on their business. How do they get better engagement? Better Information Technology.

    While I’m not sure this will be pervasive throughout all companies and industries, there will be executives that want to build new systems and move faster. They will want new applications, which means new databases, and for some of us, this will be the chance to get a better job, build a strategic application, or just get a little more budget for our group.

    It’s also potentially an opportunity for you to be pro-active. Maybe you can suggest a few new ideas for projects or enhancements that you might want to tackle which would improve customer engagement. Maybe you’ll even get the chance to have some fun at work.

    Steve Jones

    The Voice of the DBA Podcasts