Voice of the DBA

Tag: encryption

  • Algorithm Secrecy is not Security

    Should we disclose this information on websites?
    Should we disclose this information on websites?

    I find the field of cryptography and encryption to be fascinating. I present a talk on encryption and  constantly find people that don’t realize the security of an encryption algorithm doesn’t depend on what the algorithm is or knowing how it works. I can tell you that I’m using an AES or RSA algorithm and that doesn’t make it any easier to decipher the plaintext.

    This week Troy Hunt wrote a piece where he called for disclosure by websites (and really all applications) of the password storage mechanism. The badge above is an example of what he’d like to see posted on all websites. His explanation of what this might change in terms of Internet security is great, and while this might not actually make applications more secure, I’m not sure that many companies would want to be forced to disclose they are storing passwords in plain text. Consumers are becoming more savvy and realize this is a poor way of managing systems. I suspect that people will quickly learn what are strong and no-so-strong algorithms.
    Real security still requires developers to not only implement strong algorithms in their applications but also make these algorithms upgradeable. We used to use MD5 everywhere (now a bad idea), and in SQL Server 2008 R2, we are limited to SHA1. This algorithm is known to have problems and SHA2 is recommended. Unfortunately you would have to upgrade to SQL Server 2012 in order to use this algorithm. You can write your own implementation, and if you have high security requirements, I’d encourage you to do so.
    Key security is important, and this is to systems what password security is to individuals. Protecting your keys (and passwords) is ultimately the way in which we can dramatically increase the level of security in applications. This is the hardest part of managing encryption in your application, and I’d encourage you to seek out someone with experience to help you understand how to best handle  this.
    Ultimately a lot of security depends on layers, with some secrecy in place, but the secrets you keep should be the exact design and implementation of your entire infrastructure, not the algorithms used. If you build encryption into your systems, please do not design your own algorithm. On a regular basis the vendors and developers who think they’ve implemented strong encryption by hiding the details of their algorithm are usually unaware of how flawed this approach is. Please use well known, public algorithms for encryption, which have been tested and probed by mathematicians in a public forum.
    Steve Jones

  • Encryption Not Restriction

    Encryption will be more important in cloud computing
    Encryption will be more important in cloud computing

    I believe in encryption. I have an encryption talk that delivers the very basics of what encryption options exist in SQL Server, and I would think that most data professionals that develop or manage databases should understand encryption and how to enable it. I find lots of people don’t understand, and I’m glad that I can try to teach them a few things about when encryption is and how it works in SQL Server.

    Cloud computing use is growing, and while we don’t have a good definition for what a cloud computing means, more and more organizations are considering looking at moving some of their applications, and data, to the cloud. As we move this data, many DBAs have concerns over the security of the data they are supposed to protect. These are valid concerns, and they should be at the forefront of your mind if you plan on moving anything to any type of service provider.

    One interesting point brought up in this op-ed is that customers ought to have their data encrypted, but the keys used for the encryption should be controlled by the customer, not the service provider. That’s sound business strategy, and it should be the case with all your data, not just data sent to the cloud. If you use a service to rotate and store your tape backups, you ought to have encryption on those tapes, with keys managed by your company. Just as you ought to have the keys inside your company if you use locks on the shipping containers holding the tapes.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • The $50,000 Laptop

    Hopefully you won't lose this amount of data.
    Hopefully you won’t lose this amount of data.

    I wrote a long time ago about the value of the data on a laptop being worth more than the hardware. That’s certainly true for me, and I very much worry more about losing the data on my devices than the any of the devices themselves. I use sync services to keep a backup of most things, but I still worry about losing any of my bits.

    There was a large study competed recently, called The Billion Dollar Lost Laptop Program, which examined 329 organizations. The idea was to find out the economic costs of lost laptops related to various public and private entities. The conclusion? The average value of a lost laptop, just one laptop, is $49,000. The conclusions say that least expensive part of losing a laptop of replacing the hardware.

    As we would expect, most losses occurred away from the office, however it’s not known how many of these losses might be targeted thefts. Many of the losses did occur through theft, which is disturbing when most of these disks did not have encryption in place. This was true even when confidential data was contained on the laptop.  It is nice to see that companies that realize they were targets of theft, as opposed to losses, typically do use encryption.

    As the study shows, there are a lot of costs that go into replacing a laptop. Many people don’t think of all of these costs, and even if the costs are double what they should be, these are still substantial costs for companies to absorb. The costs will only go up in the future, especially as more and more people move from desktop workstations to laptops.

    The one positive note? Encrypting the laptop almost cuts the loss in half. A good reason to require encryption on all laptops.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • Locking Your Disk

    disk drive
    You should be protecting your disks with encryption.

    This editorial was originally published on Feb 28, 2008. It is being re-run as Steve is on holiday.

    With the tremendous growth in disk sizes and the trend towards more and more people using laptops, someone sent me a note about protecting that data that got me thinking. The SQL Server space has grown tremendously, and not just up. We have SQL Server Express and SQL Server Compact Edition, both of which are designed to run on smaller devices, with (supposedly) smaller data sets. However my phone has more storage than quite a few hard drives I’ve owned in my life and my new laptop rivals the storage in my 3 year old desktop.

    It seems that often that administrators don’t think about the data that gets moved off their servers and with new replication and ETL technologies, a significant amount of data might be duplicated on other instances of SQL Server away from your primary database.

    And your boss might be expecting that you’ve ensured its security.

    So this Friday, I had a poll to see who’s thinking about the issue.

    Do you use disk encryption?

    Or do you think it’s important? Should you be using it for your laptops?

    My laptops really just carry my writings, articles I’m editing, books, etc., and no financial information. I do have Password Safe on them with databases, and I suppose that someone could crack that if given enough time. However since I’m not carrying around data that involves other people, I haven’t worried about it.

    I used to have an encrypted disk when I worked for JD Edwards. At first I thought it was a pain, but after a month or so, it wasn’t a big deal. Except when I had booting issues one morning. Talk about being anxious for a few hours. Fortunately the manufacturer has included utilities and a help desk person was able to get my disk unencrypted and then re-encrypted again.

    Disk encryption is a good idea and it definitely protects accidentally releases of data. If you carry around client data, financial information, or identity information, I’d highly recommend you use some type of encryption to protect the data. However, as this article shows, that might not be enough.

    Steve Jones

    The Voice of the DBA Podcasts

    Everyday Jones

    The podcast feeds are now available at sqlservercentral.podshow.com to get better bandwidth and maybe a little more exposure :). Comments are definitely appreciated and wanted, and you can get feeds from there.

    Overall RSS Feed: or now on iTunes!

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

    I really appreciate and value feedback on the podcasts. Let us know what you like, don’t like, or even send in ideas for the show. If you’d like to comment, post something here. The boss will be sure to read it.