Voice of the DBA

Tag: career

  • Building CyberSecurity Skills with an Advent Challenge

    I’ve been working on the Advent of Cyber challenge this December. It’s more of a walkthrough of some puzzles than it is solving them yourself, but it has given me a brush up on some skills and helped me learn some basics of how people in charge of (or looking to break) security look at the world. Plus it’s been a little fun with a silly storyline each day.

    The first challenge starts with a chatbot and trying to social engineer answers out of it. This was interesting to me, even though it was likely (hopefully) not a representative example of how AIs would work in most systems. However, it got me to think more about how I pose questions to an AI and how I can grow my prompts. The neat thing about AI is that you don’t have to ask the perfect question and then re-ask the same question with more info to get an answer. The AI keeps context in a conversation, which is way more powerful than previous Q&A search systems.

    The second day was Python and Jupyter Notebook basics, which were a nice refresher for me on a couple of concepts, but not that interesting. However, the third day introduced some password-cracking tools, the fourth day added other ones, and a few subsequent days showed some software that is devious in how it can be used to penetrate security. Other challenges have me the chance to brush up on Linux and network skills I hadn’t used in a long time.

    The SQL Injection module (day 10) is well done, and I might recommend most developers go through that to see why their easy, convenient build-a-sql-string-to-execute code is an incredibly bad idea. It’s also why they can’t also use stored procedures as built-up batch commands. Use the stored procedure objects to execute with named parameters.

    The idea of using a little plot and story, with a simple challenge to teach some skills is a good one. I’ve been lucky in my career to be exposed to a lot of different technologies and ways of working with systems. I’ve set up bridges, routers, and firewalls. I’ve had to get network links and cables to work and talk with different protocols, including configuring T1 connections. I’ve built machines, dealt with different types of local and remote storage, and had to program and administer systems at all levels of the OSI model. Does anyone remember that?

    This was a fun break from work, doing a module or two every other day, remembering there are a lot of complexities to our systems outside the database, or outside the application software. It’s also reminded me of all the different ways that security can be breached.

    Take the challenge and learn some new skills. I think many of you will learn something and you might enjoy yourself along the journey.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

  • Focus on Growth in Your Career

    I find there to be a lot of value in actively managing your career. This is part of a series of editorials based on advice I’ve read from Raylene Yung (Facebook and Stripe) on your engineering career.

    I write a lot about growing your career. I think it’s important to find a good career, but also learn to be good at whatever you choose to do for employment. While I do think that learning is a skill and each of us ought to sharpen our saws, I sometimes find people chasing new things all the time. In this interview, I saw a great quote:

    “… while it’s important to be informed about the latest frameworks and best practices, learning this at the cost of developing fundamental skills is a bad tradeoff.”

    That’s something I imagine Jeff Moden saying about all the new technologies that get incorporated into database work. Often I find there are a lot of DBAs and database developers that want to implement PowerShell or MDX or Python because they can and not because it’s a good choice. Or perhaps more often because they aren’t as skilled in SQL as they should be.

    I am a fan of experimenting with different methods and determining if there is a better way to solve a problem. However, I am only a fan of using new techniques when they are better. Either they have to perform better (less resources or a lot less time to run), simplify the situation, or they save a ton of developer time. And not just your time, but for all other developers.

    One of the things noted in the interview above, as well as something I’ve seen, is that many younger people want to constantly try something new, without developing deep skills in any area. They often move in new directions because they can. I also see intermediate or senior engineers getting bored with their work or excited by something they read about and looking to shift everyone to a new platform/language/framework/etc.

    New can be better, but isn’t necessarily better. Instead, I might try to answer these questions from the article:

    • how can I make every code change great?
    • how can I be as good at X as someone on my team – For SQL, can you be as good as Jeff Moden or Itzik Ben-Gan? Or maybe closer to their level?

    The goal is to become better at your craft. Like the woodworker who improves their skills in shaping wood, or the chef becoming better at creating more tasty recipes, or maybe the weekend race car driver who learns to shave seconds off their lap times with improved driving technique.

    If it isn’t important to you to become the best in your team, maybe this will help. The cloud, AI, and competition from younger people will ensure that if you don’t improve your skills at all, you’ll slowly fall behind and your current manager, or the one that takes their place, might find a way to replace you with someone that does the job better, faster, and cheaper.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

  • TryHackMe Advent of Cyber

    I posted that I was thinking about the AdventOfCode this year, but wasn’t sure I’d spend the time. Someone then posted a link to the TryHackMe advent calendar.

    I decided to give it a try.

    There’s a fairly long (10min) video intro and then you sign up.

    Day 1

    One of the good things was that the video has some spoilers to help you solve the challenge. If you skipped the video, watch it now. Or try.

    There are three questions we need answered, and we then have to fool the AI/ML chatbot. The video shows how, but essentially you need an email address, a server room password and a project name.

    The interesting thing is this shows how a poorly secured and trained chatbot might disclose this information. For the email address, you just ask. For the password, you need to find an employee’s name and then tell the chatbot you’re that person and need the password. It seems silly, but I bet this works on some chatbots people have created with wizards or templates and not secured or limited the training data.

    The last one is interesting, you ask the machine to go into maintenance mode and you get the name of a project. Getting into the maintenance side of applications or mainframes used to be a way to attack them. Unfortunately, too many people didn’t secure many early systems and this was too easy.

    Day 2

    Day 2 is about using Jupyter notebooks. A good portion of the tutorial is helping you understand how notebooks work. Hopefully you’ve read my article on notebooks. If not, this helps you figure out how to use them. It also has a short tutorial on some python that you use to perform data analysis on a csv. While many of us might like to do this in SQL, the experience in python isn’t bad.

    This ends up helping you understand how to count, summarize, and group data in python.

    Day 3

    This day was interesting. Now we are learning about some security tools. In this case, we learn about hydra, which is a tool to brute force logins against a web page. This is a fantastic tutorial that should teach you that unlimited retries on a page without some timer is a bad idea. This should also help you understand that you need to track failed logins and do something about them, especially from weird IPs.

    Day 4

    Continuing on, we learn how to use cewl to create customized wordlists and then use those to brute force in a smarter way.

    Again, scary for a non-security person. These tools are likely good for security folks, but terrifying in that perhaps criminals use them every day.

    Summary

    The first few days of the challenge were interesting and it was neat to spend some time thinking about the world from a cybersecurity point of view.

  • The Stagnant Career

    Do you feel stagnant in your career? Or maybe the better question is do you care if you feel stagnant in your career?

    You might need to define what that means to you, as what might feel stagnant to one person could be comfortable to another. Apparently, there was a study of tech professionals, who despite a tight labor market, are citing lack of salary increases and dim promotion prospects as reasons to leave their jobs. The survey was across a number of larger technology companies, and likely answered by more talented employees. After all, good talent can usually find jobs and is less worried about leaving. Less talented people usually cling to their jobs.

    A lack of salary increase could be a problem. Everyone, or most everyone, wants regular raises. However, depending on where your salary bracket is and your living expenses, you might not rate this as a very important criterion for sticking with a job. Someone making USD$40,000 might be more concerned about a raise every year than someone making USD$200,000, but perhaps not.

    Having a career progression was more important to me at 30 than it is after 50. Again, the varies among people, but I find a lot of people like their jobs and don’t really want to change. Many of them would likely be happy to keep working at their level as long as they can get raises. I see people complaining about their current position when they’ve bumped up against a salary limit for that position, but otherwise, they’re satisfied.

    The work matters. I do think there are plenty of people who are unhappy with the work they do and want to be challenged, or at least interested, in the work. At the same time, lots of people are happy to just do a minimal variety of work day after day. I think this is why I encounter lots of people who seem to have 4-6 months of experience repeated 10+ times.

    My view is that you ought to make your career what you want, and that means actively managing it. Spend time thinking about what you want, ask others about their work, and make plans to move in the direction that matters to you. Implement those plans and find a balance between advancing your skills and living your life. It’s easy to do too much of one or the other, but often that’s not the problem, it’s the motivation and effort to actually improve yourself.

    I can’t tell you how to structure you career or what to learn or what to improve. You have to decide what is interesting to you and what fits in your life, and then make an effort to move in that direction. Sharpen your saw, improve your craft, and learn those soft skills that help you work with others. That’s how you find the career you want, which will never be stagnant.

    Note: We do have a career forum on SQL Server Central. If you want advice or have questions, post something and I (or someone) is happy to answer.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.