Voice of the DBA

Tag: security

  • The Special Cloud

    A new Amazon cloud for the US government

    It’s not a short yellow bus special cloud, at least I hope not. Amazon is introducing a cloud for the US government, designed to meet their regulatory and compliance requirements. The idea here is that there are different needs for some sensitive information that the US government deals with, or at least some departments. I think most of us recognize this might be the case, and the same cloud infrastructure that some company like SQLServerCentral needs wouldn’t be appropriate for OSHA or some other department.

    Amazon introduced this US only cloud that is physically and logically accessible in the US only and adheres to some alphabet soup of regulatory requirements. It should allow more government organizations to store or process data in a cloud environment. I think this is a good move on Amazon’s part, and a potential benefit for some US agencies that might process lots of data at times, but not want the overhead of a large IT infrastructure to maintain permanently.

    This is a good step in the evolution of cloud computing, and I hope that Microsoft and other vendors start to develop specialized clouds as well. There are PCI compliant hosting services, but I can imagine that there might be semi-private clouds for medical, research, or other specialized data sets, which conform to the specific security and regulatory need of that industry. At some point I can imagine that Amazon or Microsoft might have parts of their data centers partitioned into different industry verticals that provide services according to different criteria.

    The cloud can provide a great place for periodic and bursty workloads for many applications and companies, but there are definitely security concerns that need to be addressed. The development of specific clouds for specialized needs seems to be a positive step in allowing more companies to take advantage of cloud computing in the future.

    Steve Jones

    The Voice of the DBA Podcasts

  • The Basic Security Model in SQL Server – Skill #3

    This series of blog posts are related to my presentation, The Top Ten Skills You Need, which is scheduled for a few deliveries in 2011.

    Users and Objects

    The basic security model diagram that I use is the one below. It’s not fancy, but it conveys the basics of security in SQL Server.

    security

    From left to right, users or clients are mapped to principals. Those principals are both in the instance (login) and database (user) as well as roles. Permissions are assigned to roles on objects.

    That’s essentially what the basic security model should be for most people. There are other types of structures (credentials, certificates, etc), but in terms of the 80/20 rule, here’s what most DBAs should do:

    • Create a login for a person (either Windows or SQL Server login)
    • Map this login to a user with the same name in those databases that person needs access to. Only pick those databases needed, not all databases.
    • Create a role in each database for each group of users/permissions.
    • Add the users to this role
    • Grant permissions on the objects needed to these roles.

    It’s not complicated, and sticking to this simple scheme, and not granting db_owner or sysadmin to logins or users will allow you to implement basic, easy to understand security in SQL Server.

    References

  • Virtual Security

    The State of New Mexico is being careful with virtual machine security

    I have a few friends that are working virtualize almost their entire computer infrastructures.  They work in large and small companies, but there is a constant push to avoid the bare metal installation of any operating system onto physical hardware, making every Windows or Unix machine a virtual machine on top of a hypervisor. I was surprised to hear that companies were being to aggressive, but the cost benefits can be huge, and when virtualization is done in a smart way, performance doesn’t suffer.

    However virtualization can change security, especially when you have VMs that are allowed to move from physical host to physical host. The state of New Mexico embarked on a similar project, and were concerned over security of the virtual machines. Their department had dismissed some employees because of a security breach a few years earlier and security was on the forefront of their minds. Additional security as well as network controls were used in their project, and I hope they also implemented strong auditing procedures.

    As we move to newer infrastructures that include virtualization, physical security becomes more important, and additional controls are needed. The ability for someone to potentially move a VM outside of a data center, or even to a less secure remote data center becomes a point of concern. Moving the storage itself might be an even bigger problem as virtual storage becomes more commonplace.

    Ultimately, however, we can’t all have dedicated security employees, nor can we expect every DBA, sysadmin or even security officer to be able to protect against and mitigate all attack vectors. Auditing is ultimately the best way to handle breaches. We can’t prevent all of them, but responding quickly, learning, and perhaps more importantly informing the appropriate people to be ready to respond to the information disclosure.

    Steve Jones

    The Voice of the DBA Podcasts

  • The Window Is Shrinking

    Security is important, but perhaps doubly so in the cloud.

    There have been a number of issues with Dropbox and their encryption process for files stored on their systems. This highlights some of the issues with cloud services, as I’ve talked about as well. I use Dropbox, but for any files that have identity information, I encrypt them locally and only store the encrypted versions.

    There have been quite a few issues with cloud-type services related to security, and at this point, I think it’s good. The press about the Sony hacks, the RSA issues, and others should be scaring consumers and management in companies into demanding better security from vendors. Without a strong emphasis on security from clients, cloud vendors have no reason to spend more effort on security than they do now. I am actually hoping that insurance doesn’t cover the Sony issues, which will help force companies to consider purchasing insurance specifically for security issues. That will force insurance companies to demand better security as well.

    That means the window for throwing together a service without a well thought out security plan is shrinking, and that’s good. We should have security on the mind as we write code. Building that habit takes training, but it also takes practice and requires management to buy into the need to spend some time implementing security throughout our code, and testing for potential issues.

    I look forward to the time when strong security exists in all applications, not bolted on as an afterthought, but designed in from the very beginning.

    Steve Jones

    The Voice of the DBA Podcasts