Voice of the DBA

Tag: security

  • Would You Want to be on the Red Team?

    In the world of cybersecurity, a red team is a team of hackers that try to infiltrate a company, but at the request of the company. The idea is they look for vulnerabilities and issues and find them before criminal hackers do. They are the opposite of the blue team, who is trying to stop the red team and create defensive measures that prevent the red team from accessing data.

    Many large companies use red teams. Microsoft maintains a red team (and a blue team) that are constantly competing to break into their systems and defend them (depending on which side you are thinking about). I’m sure Amazon, Google, and other large companies do the same thing. It’s an interesting idea, though I bet this is a lot of repetitive work where you constantly repeat similar attacks with slight variations. There certainly is some creativity and research as well, and some acting if you social engineer situations, but it’s not the type of work I would want to do. I doubt it’s as exciting as Hollywood movies portray hacking.

    An organization could assemble a red team from external resources and use them to evaluate the security of your software, your infrastructure,  or even your people. There’s an article this week on getting started with a red team. Since companies are seeing more and more attacks against their systems, I would expect more to be proactive and either assemble or hire someone to test them. In fact, I bet there will be lots of cybersecurity people setting up their own companies to help here.

    Many of us might feel we are careful with security, and that we check for issues. I’m sure we do some of that, and many of us know how to secure things well. However, it’s easy to make a change and make a mistake. It’s easy to forget to include a group, or include the wrong group, in a security ACL. It’s easy to forget to check a setting or leave access open while we test and forget to go back and secure it properly.

    Attackers think differently. We can learn to do this, but it might be helpful to have someone else doing the attacking and then giving us a report on what to fix.

    Steve Jones

  • The Level of Security These Days

    Passwords aren’t going anywhere. While I would have thought there would be more advances by this time, and there are, the basic password is still required in many places, especially for resetting an account. Even those MFA places where I can click a notification or enter a code, I still sometimes need a password.

    That’s fine, and I think MFA is a good solution, but it doesn’t alleviate the need to have a strong password. Troy Hunt has written about this topic because we as a collective do a poor job of building passwords. Especially with regards to length. Some of that is poor app (and database) design where we unnecessarily limit password length. However, some of the issues are our fault, as we continue as a group to use poor habits and practices.

    There are many guidelines to use with passwords, one of which is the length. The length you should use keeps increasing because hardware power keeps growing. Because of new attacks and techniques, we ought to review what we think is strong on a periodic basis. My password manager defaulted to 8 characters when I started using it over 20 years ago. Since then I’ve increased that to 12, and now 15. I ask for mixed upper case, lower, and numbers, along with symbols. These are so random that every time I need to give one to my wife to enter in, she’s annoyed with the length and mix of keys that need to be pressed.

    I haven’t seen the brute force table from Hive Systems before, but I like the visual. It helps you determine how strong your password is with modern hardware. This is a similar graphic to the one I used in an encryption talk years ago, where it showed how much it would cost to rent compute power on AWS to brute force crack various algorithms. In case you were wondering, about 5 years ago you could crack a 512bit key on AWS for less than US$75.

    I like the graphic, and it shows that my 15 character passwords should be safe for years. This Friday, I’m wondering if you’re comfortable with your password lengths? Are they crack-able in less than a year? Take a look at the graphic and let us know.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • A Real World Security Reminder

    A saw a tweet from Brent Ozar about USB ports on slot machines to charge your devices. There are also wireless charging pads. Convenient, but also potential security problems, especially for IT workers that hold privileged access to code or data.

    Please, don’t use public USB ports for charging a device. You never know if there is any data access taking place. Yes, I know that most phones ask you to approve things, but have you ever hit the wrong button on your UI? Know how to turn it off? How quickly would data move or malware install? Just don’t plug in.

    Next, beware of physical security. My wife was using a wireless pad at a Starbucks a few years ago. She was sitting there talking with my daughter, and occasionally checking her phone (she gets LOTS of texts). Someone walked up and started talking with them, pleasantly and unassuming. After a few minutes, they walked away.

    A minute or two later my wife realized her phone was gone. They both looked around and then ran outside. They couldn’t find the person, and since this was a trip to visit colleges, she ended up purchasing a new phone. An expensive trip for us all.

    That reminds me of a few stories in the past from my former CEO, Simon Galbraith. He wrote a piece in 2005 about the issues of losing backup tapes. That used to be a problem, along with the loss of laptops. He also shared a story internally about finding a USB drive near our HQ. Our IT staff investigated the USB drive on an air-gapped computer since USB drives are sometimes spread around with malware.

    In this case, we found that it had been lost by our auditor. No Redgate information was on it, but there was data on it from another client. An accident, but one that could have had severe consequences if someone else found the drive. A good reason to be sure that any data you move around outside of production is masked or anonymized, no matter how secure you think your development laptop or mobile device is in your possession. Mistakes happen.

    We also need to be careful with devices. These days, with BYOD and MFA, it’s especially important that we secure devices and limit the disclosure of data on locked screens. Whether for a practical joke or malicious purpose, having someone else get access to our credentials is not something we want to explain to our employer.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • Most of Us Are Vulnerable

    I saw this study recently, where most people think they are better-than-average drivers in the US. I thought about it myself afterward, and I think I’m maybe average. I do pay attention most of the time, I try to be more careful when it’s wet or snowy and give myself more time to slow down. I  try to be aware of the other cars and obstacles on the road. I also usually have a drink (coffee, soda, water) with me, and I certainly mess with the music player. The Tesla reminds me constantly when I’ve strayed near a line, so a few months of driving seems to tell me I’m not great. Certainly not above average.

    I would expect that most of us think we’ve done a good job with security for our systems.  We don’t expect to get hacked or deal with ransomware. I don’t know how realistic that is, as a recent set of penetrations tests shows the vast majority of networks are vulnerable.

    It sounds bad, and it is. It also is not likely to change as the complexity of many networks is high. There are so many devices, constant additions and changes to services and applications, and regular requests to grant access to a new group. It’s amazing there is any security at all, given how quickly people want to access systems and how impatient they are when they can’t connect.

    The data doesn’t show that every system is wide open, but there are ways in which every network can be disrupted. Whether this is significant or not is hard to assess, but given the reports I see in media, as well as private notes from friends, I suspect that most companies have plenty of work to do.

    It’s not all had work, however. I think many people that configure networks are careful and are wary of opening firewalls. The bigger problem, which continues to exist, is likely simple passwords from far too many people. That, combined with a lack of multi-factor authentication being rolled out, means that there a lot of simple changes that could make a big difference. I know my company rolled out a corporate password manager recently to all employees. This, combined with our MFA app on mobile devices means that we should have strong passwords and better verification of legitimate access for most systems.

    At least, I hope we do.

    Steve Jones

     

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.