Voice of the DBA

Tag: security

  • Power Tools at Work

    This editorial was originally published on Jan 17, 2007. It is being republished as Steve is on vacation. 

    Now this could be fun. Just imagine your boss comes to your cube with an electric drill, a sledgehammer, and a circular saw. Oh, and don’t forget the safety glasses. You’ve got work to do.

    That’s what is happening in some IT shops as old data drives need to be destroyed with no hope of the data being recovered. I saw this article on data demolition and thought that might actually be a fun afternoon at work. Destroy some old data drives, ending their usefulness like the fax machine in “Office Space” 🙂

    Data security is becoming a bigger issue all the time in the corporate world. And as more companies store more and more data on disk, the issues with disposal must be dealt with by more and more IT groups.

    I guess you could hire a firm and get this before and after picture:

    Now this might be fun.

     

    but I’d think that defeats the purpose somehow. It’s the physical access outside your company that can be the problem. Going to a vendor specializing in destruction could be a problem since it gives criminals a single source (or a smaller source) or vendors they can bribe to get critical data. Better off letting different people in your company destroy the data at random intervals. That way no one can predict where and when the data will be destroyed.

    Plus it would be fun 🙂

  • More SQL Injection

    If you can't prevent this in your application, you need to think about upgrading your skills.

    One milly-yon sites hit by a SQL Injection attack. That happened according to a headline I saw recently, with an attack similar to Lizamoon affecting seven figures worth of ASP.NET sites. How can this still be happening on large scales? I’d like to think that this was mostly at small sites that people had set up for themselves, but I’m sure some decent sized companies were involved in this.

    This isn’t good for your brand as a developer. If you don’t know what SQL Injection is, you shouldn’t be developing software. If you don’t know how to code to avoid it, you shouldn’t be hired by anyone to build software. If you can’t write a stored procedure around a query or built a parameterized call to a database engine, you need to learn how or find another career.

    It’s sad that years after we’ve had the SQL injection problem make headlines, and change the way many companies write software, we will have thousands of applications being used every day that are still vulnerable to this type of attack. There is a lot of old code out there, but it can’t remain. We are regularly adding new data to our systems, and new data to applications. There’s no excuse for companies not making a complete review of older code and updating it to avoid unvalidated input or passing through queries that could be hacked.

    Educate yourself, save these headlines for your boss, and ask that no new applications, including third party ones, be purchased if they haven’t updated the code to prevent SQL Injection attacks.

    Steve Jones

    The Voice of the DBA Podcasts

  • The First Thing To Do After Creating Keys

    I’ve been looking at some security code in preparation for a few talks I plan on doing next year and there’s one thing I don’t see in many of the samples: backups.

    When you get ready to encrypt data in a table, or you enable Transparent Data Encryption (TDE), you will end up creating a key of some sort, or a certificate. Some of these keys, especially the database master key, needs to be backed up. Otherwise you won’t be able to decrypt your database or data later on if you recover this database on another server.

    As soon as you create a key for security, make sure you back it up right then. You might forget later, and then it might be too late. A little preparation will go a long way here.

    The commands are simple, and linked below:

    Securing these keys can be complex, but I would recommend that you place them in an administrative folder with limited access from anyone.

     

     

     

     

  • Laptop Boy Scouts

    Are you prepared for remote work?

    This editorial was originally published on Jan 10, 2007. Steve is at DevConnections, so it is being republished. 

    So class, for today’s protection mechanism you’ll need: a mouse, a loop of wire, a lock, a key, and a link. Sounds like MaGyver, huh? This article on hot spot security gives you some software hints and covers most of the items I listed above. The exception is the loop of wire.

    If you’re working for some time at a place, especially a place that’s traffic’d well, you might want to lock your computer to the desk or table. It will discourage iJacking or the chance that someone will walk by, grab your laptop and run. This is more likely in a cafe or Starbucks than an airport, but you never know.

    The advice is good and it makes sense that most of the discovery and openness of Windows is rapidly becoming a liability. Even out here in the country, where I live and my nearest neighbor is nearly 1/4 mile away, I have keys on our wireless routers. I know it’s not the best security, and I did get some complaints about making everyone have a key until a neighbor’s router showed up on our computers. Makes you realize just how far away someone could be and reach your system.

    As handy as all the capabilities are in wireless networking, as with anything else, they need to be secured and they should be turned off by default. Use them when you need them, but the rest of the time, try to be a bit more secure and limit access to your system.