I read a piece recently that got me thinking that data breaches might be inevitable. Disclosure: This was written by Redgate, for whom I work, titled “Data breaches May Be Inevitable—Compliance Failures Don’t Have to Be“. It’s based on our research with the State of Database Landscape survey as well as feedback and conversations with customers.
The thing that caught my eye was the first part: data breaches may be inevitable. Do you think that’s true? Are we doomed to lose data in our organizations, not as a possibility, but something that will happen at some unknown time in the future? Those of you who have suffered breaches might agree with this, but for those of you who haven’t had to deal with that situation, are you resigned to it happening at some point?
I’ve gone through phases in my career. In a few jobs I worried about this. When we started SQL Server Central, we were very careful and cautious, trying to be sure we wouldn’t be caught losing email addresses of the community members. We never had an issue, and I’m proud of that. These days at Redgate, I worry a bit more, mostly because we’re growing and it only takes one person to click on a phishing email to cause problems. Fortunately our IT group is on the ball and even conducts plenty of “mystery shopper” email campaigns to test our awareness with follow-ups to help ensure people are aware and careful with how we handle data.
The criminals always have an advantage in that they are focused and only have to take advantage of one mistake to win. We have to constantly be vigilant, across all our staffers and systems. Simple mistakes, or worse, typos in complex configuration files could result in a data breach. One of the places this can happen is in test/dev environments where more people the make changes. If we have sensitive data in those places, we’re increasing our risk.
I don’t think breaches are inevitable, mostly because companies are getting better at simple security measures and reducing the ways in which unauthorized access takes place. There’s also the fact that the world is huge and there are more and more systems all the time, which might reduce our chances of the criminals targeting us. Don’t get complacent, as automation gives criminals a tool to attack us at scale, in the same way it lets us get more done with less.
One criminal can do a lot of damage, so remember that the next time you’re annoyed by your MFA or other security measures.
Steve Jones
Listen to the podcast at Libsyn, Spotify, or iTunes.
Note, podcasts are only available for a limited time online.
Voice of the DBA 