Voice of the DBA

Tag: security

  • Check Twice, Update Once

    I was reading through this blog from the SQL Server PSS team (a must-follow), and found this note about the SQL Server Best Practices Analyzer (BPA). This isa tool that can examine an installation of SQL Server and report on any deviations from best practices according to Microsoft, as well as warn you of potential issues with your configuration. I had used it with previous versions of SQL Server and it helped me quickly determine if I’d missed anything during setup.

    Now I haven’t much thought about running this regularly. I’d assume this is something I just run once after installation to be sure I’ve configured, but the blog gives me a good reason to run this regularly, and especially whenever I have an issue. In the entry, it talks about not only noting that an error being returned by SQL Server and noting it’s fixed in a CU, but that a trace flag is also needed. Running the BPA would inform the user that the trace flag needs to be enabled.

    I think it’s great that this type of feature is being designed into a tool like the BPA that can really help a DBA. Knowing that this trace flag needs to be enabled is the type of knowledge that someone might gain with experience, but it’s short lived. At least it should be as I would hope the issue is corrected in a Service Pack w/o the need for a trace flag.

    Tools like this don’t eliminate the need for DBAs. We still need people that can make the decision about whether to apply this, perform testing, and more. These tools just make it easier for us to do our jobs more efficiently.

    Steve Jones

    Update: as noted in the discussion, the MS Baseline Configuration Analyzer is required for the BPA tool. MS BCA v2.0

  • Security Panics

    I went to host the Red Gate SQL Source Control webinar recently and had a snag. I downloaded the GoToWebinar software (why must I download this every time?) and when I ran it, I got an error.

    First it was a FireFox, “This security certificate is invalid” and I had to click the “I understand the risks” button to move forward. But then I got a dialog that said

    “This security certificate has been revoked”

    Now, a smart guy would click “cancel” because perhaps there’s some phishing or malicious behavior going on. Being in a hurry, I clicked “OK, move forward anyway, I don’t need no stinking certificates.” Maybe not smart, but it failed, so no big deal.

    Fortunately I had been trying to connect 30 minutes early, so I had time. I called Citrix, and they attempted a remote desktop session, which failed for the same reasons. We chatted for a few minutes and the tech support guy said that the certificate didn’t expire for years, and could I try another machine.

    I went out and was about to do so when I noticed that my clock said “8/19/2039”. It hadn’t registered before, but that time it did. 2039 is likely past the end of the Citrix security certificate’s lifetime.

    I reset my clock, and things went well.

    I’m not sure what happened. I used my machine early in the morning, took kids to school, and then came back to a machine that wouldn’t come out of suspend. I rebooted, and when it responded (some Java error on the screen, figures), things seemed to work. Except that the webinar didn’t.

    I don’t know what causes a clock to slide, but this actually happened last year one time as well. This is a Win 7, x64 machine, and it surprised me that I got this much drift, if 29 years is “drift”, but it did.

    On the bright side, the Win 7 year-changing dialog is kind of cool. You might play with it.

  • Windows 7 Run As

    One of the things that got us to switch OSes from W2K to WinXP when I was an administrator at JD Edwards was the Run As command. We had two accounts, regular and privileged, and needed to switch between them on a regular basis. I didn’t like the policy, but with WinXP, we had the “Run As” command when we right clicked things like the SQL MMC plugin, so we could access servers under the privileged account.
    In Windows 7, if you right click, you see “Run as Administrator”, which works great on my desktop. However what about a domain? What if you have two accounts and want to run something for testing or because you need different rights?
    I found a cool trick I wasn’t aware of since I haven’t needed it. If you hold down Shift when you right click the item, you get a new Context menu item. The Run as different user.
    ssms_runas
    Give it a try. I bet you find it handy.

  • PCI and Encryption

    It surprises me how often I see people posting questions about what type of encryption to implement for credit card data. If you are processing credit cards yourself, and storing the data, you need to comply with the PIC regulations that exist. Here’s a good place to get started: https://www.pcisecuritystandards.org/.
    Actually the place you need to start is with your bank or processing company. They should be able to guide you in what requirements need to be met for safe data storage.
    However if you’re running some service and perhaps trying to store a credit card for a customer to make it easy to charge them over and over, that doesn’t mean you don’t need to comply. You are holding financial information about a customer and if something happens to the data, you’re at fault. Your company could be liable, and possibly even you personally if you make the recommendation to build something yourself.
    Good security isn’t magical, and it isn’t secret. It involves you using well known algorithms, protecting the keys, and following best practices. There are some great encryption technologies in SQL Server 2005/SQL Server 2008, but don’t just implement them without learning a few things about what best practices are and how these technologies work.