Voice of the DBA

Tag: security

  • The Basic Security Model in SQL Server – Skill #3

    This series of blog posts are related to my presentation, The Top Ten Skills You Need, which is scheduled for a few deliveries in 2011.

    Users and Objects

    The basic security model diagram that I use is the one below. It’s not fancy, but it conveys the basics of security in SQL Server.

    security

    From left to right, users or clients are mapped to principals. Those principals are both in the instance (login) and database (user) as well as roles. Permissions are assigned to roles on objects.

    That’s essentially what the basic security model should be for most people. There are other types of structures (credentials, certificates, etc), but in terms of the 80/20 rule, here’s what most DBAs should do:

    • Create a login for a person (either Windows or SQL Server login)
    • Map this login to a user with the same name in those databases that person needs access to. Only pick those databases needed, not all databases.
    • Create a role in each database for each group of users/permissions.
    • Add the users to this role
    • Grant permissions on the objects needed to these roles.

    It’s not complicated, and sticking to this simple scheme, and not granting db_owner or sysadmin to logins or users will allow you to implement basic, easy to understand security in SQL Server.

    References

  • Virtual Security

    The State of New Mexico is being careful with virtual machine security

    I have a few friends that are working virtualize almost their entire computer infrastructures.  They work in large and small companies, but there is a constant push to avoid the bare metal installation of any operating system onto physical hardware, making every Windows or Unix machine a virtual machine on top of a hypervisor. I was surprised to hear that companies were being to aggressive, but the cost benefits can be huge, and when virtualization is done in a smart way, performance doesn’t suffer.

    However virtualization can change security, especially when you have VMs that are allowed to move from physical host to physical host. The state of New Mexico embarked on a similar project, and were concerned over security of the virtual machines. Their department had dismissed some employees because of a security breach a few years earlier and security was on the forefront of their minds. Additional security as well as network controls were used in their project, and I hope they also implemented strong auditing procedures.

    As we move to newer infrastructures that include virtualization, physical security becomes more important, and additional controls are needed. The ability for someone to potentially move a VM outside of a data center, or even to a less secure remote data center becomes a point of concern. Moving the storage itself might be an even bigger problem as virtual storage becomes more commonplace.

    Ultimately, however, we can’t all have dedicated security employees, nor can we expect every DBA, sysadmin or even security officer to be able to protect against and mitigate all attack vectors. Auditing is ultimately the best way to handle breaches. We can’t prevent all of them, but responding quickly, learning, and perhaps more importantly informing the appropriate people to be ready to respond to the information disclosure.

    Steve Jones

    The Voice of the DBA Podcasts

  • The Window Is Shrinking

    Security is important, but perhaps doubly so in the cloud.

    There have been a number of issues with Dropbox and their encryption process for files stored on their systems. This highlights some of the issues with cloud services, as I’ve talked about as well. I use Dropbox, but for any files that have identity information, I encrypt them locally and only store the encrypted versions.

    There have been quite a few issues with cloud-type services related to security, and at this point, I think it’s good. The press about the Sony hacks, the RSA issues, and others should be scaring consumers and management in companies into demanding better security from vendors. Without a strong emphasis on security from clients, cloud vendors have no reason to spend more effort on security than they do now. I am actually hoping that insurance doesn’t cover the Sony issues, which will help force companies to consider purchasing insurance specifically for security issues. That will force insurance companies to demand better security as well.

    That means the window for throwing together a service without a well thought out security plan is shrinking, and that’s good. We should have security on the mind as we write code. Building that habit takes training, but it also takes practice and requires management to buy into the need to spend some time implementing security throughout our code, and testing for potential issues.

    I look forward to the time when strong security exists in all applications, not bolted on as an afterthought, but designed in from the very beginning.

    Steve Jones

    The Voice of the DBA Podcasts

  • Hardware Hacking

    How safe are our chips?

    One of the reasons that we have so many gadgets at low costs, with a regular re-fresh and re-tool of the internals is that many of our computing chips and circuit boards are built overseas in factories that are optimized for low costs and rapid evolution to new technologies. That works fine for consumers, but it presents a problem for a government concerned with security.

    Since the fabrication plants are under the control of a foreign government, that means that the military and governments that want to use the same chips that consumers use must vet the designs, and then the end product. This piece talks about the problems with the supply chain that can come from foreign suppliers that might have incentives to allow hardware hacks into the designs at the request of their own governments.

    The world continues to grow closer economically, but we still have our own national patriotism and loyalty . We want our own countries to grow and do well, and our companies to grow inside of our own borders. As the stakes raise, will foreign supplies think about introducing backdoors or other hardware hacks into more of our chips? Imagine the problems we might have if our x64 chips contained a way for foreign companies to access our data?

    Criminals certainly would love these hardware hacks and as they get more and more sophisticated, I wouldn’t be surprised if this becomes an attack vector in the future. We might find in the future that we will not only have choices between Intel and AMD, but also choices between domestic produced and foreign produced chips.

    Steve Jones

     

    The Voice of the DBA Podcasts