Voice of the DBA

Tag: data privacy

  • The Test Mistake

    Last year a company was testing their software in a dev/test environment and accidentally sent out an “Integration email” to their customers.  They blamed this on an intern, though a little jokingly, and plenty of people shared their own stories about making mistakes.

    I did this once, and only once. I was doing some software testing on a copy of the production database and accidentally sent out thousands of emails to customers. I hadn’t scrubbed the email addresses in the copy, but since I also hadn’t scrubbed the data, customers got an “extra” email for their account and few complained. My boss, however, complained quite a bit and with good reason.

    These days using production data in dev/test environments isn’t really an acceptable practice. Plenty of organizations do it, and hopefully, they are taking precautions. Kendra Little wrote a little about what happened and what should be done, including scrubbing out sensitive data. Not enough people do this, though I am seeing more and more companies looking for solutions that prevent data release.

    This isn’t an intern’s issue. I appreciate someone making a bit of a joke here, and hopefully, there were engineers that taught the intern something. The bigger issue is that we make mistakes as humans and our protocols and processes should expect that. This is one reason why adopting automation in our software process is important. Whether that’s deploying code to the right production server or refreshing the non-production databases, we want to be sure that we limit the number of human mistakes.

    There are always places where we will use humans to perform a process. Whether that’s typing code or clicking something. It’s entirely possible someone clicks the wrong button or types the wrong item. As much as possible, we can use automation to provide a safety net to prevent these issues from reaching customers. We can’t prevent every mistake, but we can continue to improve our process but adjusting it over time. At the very least, we ought to prevent the same mistake from happening over and over.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • T-SQL Tuesday #144–Data Governance

    tsqltuesdayThis month’s topic is something I wouldn’t have considered a decade ago. Especially in the US, this isn’t something that I’d actually have cared about for most of my career. Even when companies talked about governance, it was more a checkbox exercise.

    Dr. Victoria Holt brings us this invitation from the UK, and I think it’s a great one. This is a data topic that will impact more and more of us in the future. Not all of us, but certainly plenty of us.

    If you haven’t thought about this topic, I’d urge you to write something, even if it’s a view that this isn’t necessary. Share your thoughts, this month or in the future.

    Data Governance Effort

    My employer, Redgate Software, has been interested in this for a number of years. We are a UK company, and when the GDPR passed, we knew this would be a concern for us and our customers.

    We built a product to help customers classify and understand their exposure in databases. I hope this expands out to other sources, because I feel this is a constant challenge. While lots of data is in database, we are constantly pulling it out and sharing it in files, reports, and more.

    Security is hard, and I don’t know that we’ll end up completely controlling the access and data, but I do think that we need to understand where our risk and exposure are as we share data.

    This is a hard job, and a boring one. I can’t see many people enjoying the process of dealing with data governance. We need to make this easy to do, in a distributed fashion by many people as they notice something is not being managed. At the same time, I think that we need to be regularly reviewing and examining security against policies. We have far too many public access points being used to share information when things should be secured.

    I don’t know how we reconcile those things, and decide on the value of doing them. Some products may work well, some I think are too targeted, and some too expensive.

    I believe data governance matters, but not sure how we actually get to a place that it’s well done in many organizations. Especially in the US.

    I hope I’m wrong.

  • Tracking, Privacy, and Lots of Data

    Half of all advertising dollars are wasted. We just don’t know which half.

    That’s a common view from people purchasing advertising, and it’s why I expect that this saying is what has led to complaints from Google, Facebook, and other large firms that track people across different sites and apps. They have built frameworks that make it easy to add metrics to other software and derive advertising revenue for a vendor. As a result, many people building mobile apps use some framework from a large vendor.

    Apple has been fighting back a bit. I don’t know Apple is terribly altruistic here, but I do think their changes to implement some privacy controls for users are good. The article linked here talks about some of their recent changes in iOS and the complaints from vendors. There are also some notes about the way this impacts everyone.

    There is an Apple white paper about why Apple is changing, and its story is a bit disturbing, showing how a few common daily actions result in data being tracked. It certainly is something I know happens as I’ll see ads for Redgate products on a volleyball site or ads for the bike in which I was interested on a technical database article. It’s annoying and frustrating. I get the idea of making many advertising impressions to influence me, but it’s also distracting when I’m doing something unrelated. Maybe more annoying is that once I buy something, I’m no longer interested, but I still see the ads.

    I don’t mind a company tracking me on their site and showing me something that is possibly related to what I am doing. I do mind having apps do this across apps, and companies aggregating and selling this data. I know this has happened for years, but the scale of today is more problematic. For me, this truly is an issue that needs to be addressed with more control and respect for the human rather than the organization.

    I loved my iOS devices for years, until they removed the headphone jack. I switched the Android, and I’ve been happy, but now I’m in the same situation as the last few Android phones don’t have headphone jacks. I like the choice I get, but that freedom comes with a price in this space. I’m not sure I see Google, or really most manufacturers using Android, making a good choice here for humans. I’m not sure Apple is a lot better, but this is a little better.

    I’d like to see more platforms open, but with also some accountability and responsibility from vendors that doesn’t just make the customer the product. Instead, let the customer choose what data to allow, and then you can adjust prices accordingly. If someone wants to give up all their information for less cost, fine.

    However, let me also choose privacy if the value is there for me. I’ll happily pay for it in many places.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • Continuously Classify and Protect Your Senstive Data

    Abstract:

    Many data breaches come about from less secured development and test databases. Redgate has integrated SQL Data Catalog and Data Masker to allow you to continuously improve your classification and protection process for those environments. In this session Steve Jones will show how this process can be refined over time and distributed across a team of individuals in your organization.

    Length: 60-75 minutes

    Slides: ContinuousClassify.pptx