Voice of the DBA

Tag: security

  • It’s Almost Always the Humans

    Today we have an editorial reprinted from Sept 19, 2005 as Steve is on vacation.

    Most breaches of security, stolen data, etc. are almost always the result of some breakdown in the human factor of the equation. By that I mean some interaction between the human “bad guys” and some human in the company. It could be stealing a laptop, sorting through trash or even paying for it. Or perhaps this method.

    I saw this article about bank fraud, but not the kind I expected. After all, I got called last year by my cell phone provider in a similar situation. You are late on your bill, make a telephone payment, presumably because you’re short of time. In my case I didn’t even call them back, which I should have. In this case, the individual writing just called and made a payment over the phone.

    A short time later a suspicious charge appeared. The person tracked it down to customer service that had been outsourced and someone at the outsourcing company was selling or passing along information to criminals that would use it in some type of identity theft crime. No word on what is happening with the investigation or even which company it is.

    To me, this the worst method of saving money, and if this results in security breaches, the name of the company should be publicized. Most of these corporations are not losing money. They are racing to make more, increase the stock price, whatever, and in doing so, they are sending out a piece of their core business. Customer service should be a cornerstone of any company. That is how you show that you are the place someone wants to do business. I’m not sure I even agree with outsourcing IT since that data is critical and vital to your company as well, but there is no way customer service is not a core part of your business.

    If you’re missing that point, you’re missing the function of a business in the world.

  • ETL Security Holes

    The addition of DTS to SQL Server meant that more and more of us could grab data from a variety of sources, easily, and move it to SQL Server systems. SSIS enhanced our capabilities and made it fairly simple for non-programmers to grab web service data, and other formats, and quickly decompose them into relational formats. This made it more likely that we would build data warehouses or reporting systems, and easily keep them up to date with data from our OLTP systems.

    However the ease of using ETL (extraction, transformation and loading) processes to move data did not include the moving the same security controls and restrictions to these new systems. That can create a big security holes, especially when you have secondary systems used for decision support that might not be contained in the production network and not audited to the same level as other production systems.

    Whenever you move data around, there ought to be some set of guidelines for the security protocols required. That can be hard to track when you are pulling data from a secure system and your connections look like every other connection. One of the dangers that I suspect we will run into with Powerpivot is that secure data will be downloaded to Excel worksheets on insecure systems, and all of the controls that we have in place for protecting sensitive information are ignored when we pull data for analysis elsewhere.

    Our data security has gotten better, but we have a long way to go. If you are working with ETL processes, and especially with end-users, make sure that some sort of security policy is in place to help protect this data from being accidently disclosed. It’s not a great suggestion, but until we have better security tools to allow policies to follow the data, that is all we can do.

    Steve Jones

    (originally published at http://www.sqlservercentral.com/articles/Editorial/72157/)

    Podcasts

  • In Case of Breach


    What would you do if you received a phone call in the middle of the night saying that one of your databases had been hacked and data released? Do you know what to do as a first responder? There’s a report from Dark Reading that talks about some of the things you might want to consider.

    Crisis situations, and this is definitely one, require some planning and thought ahead of time. You ought to have some sort of “run book” similar to the one you have for disaster recovery, that helps you decide how to handle the situation. Unlike many troubleshooting situations, rebooting a server might be the worst thing you can do.

    I used to think that database people were more insulated from responding to these types of crisis situations. It seemed early in my career that we would be backups for the system administrators, and not necessarily need to respond to a midnight call. However the last 5 years have shown that this type of call is more and more likely for all data professionals.

    As we store more and more data, of great importance to the organization, we should be more prepared to respond to these types of incidents. Financial, identity, medical, and other types of data are becoming mixed in with all sorts of business data. As we build warehouses and transfer data among more systems, the likelihood we have data needing strong protections increases.

    At the very least, we must educate ourselves on our legal responsibilities as the data profession moves forward. More and more laws are being passed and regulations applied to data, and a good data professional in the future needs to be aware of their responsibilities in this area.

    Steve Jones

  • Getting a Dedicated Admin Connection

    Did you know you can easily get a Dedicated Admin Connection (DAC) in SSMS? I didn’t assuming that I’d need to use a command line and SQLCMD. However while studying for the MCM, I learned that there’s an easy way.

    I tested this on a SQL Server 2008 instance, having a normal connection, as seen in the lower status bar:

    admin_connection2

    Right click in the query window, and select “Change Connection”. In the dialog, not add “Admin:” before the server name, as shown below.

    admin_connection

    When you connect, you’ll have an admin connection, which you can see in the status bar.

    admin_connection1 

    Pretty cool.