Voice of the DBA

Tag: security

  • The Level of Security These Days

    Passwords aren’t going anywhere. While I would have thought there would be more advances by this time, and there are, the basic password is still required in many places, especially for resetting an account. Even those MFA places where I can click a notification or enter a code, I still sometimes need a password.

    That’s fine, and I think MFA is a good solution, but it doesn’t alleviate the need to have a strong password. Troy Hunt has written about this topic because we as a collective do a poor job of building passwords. Especially with regards to length. Some of that is poor app (and database) design where we unnecessarily limit password length. However, some of the issues are our fault, as we continue as a group to use poor habits and practices.

    There are many guidelines to use with passwords, one of which is the length. The length you should use keeps increasing because hardware power keeps growing. Because of new attacks and techniques, we ought to review what we think is strong on a periodic basis. My password manager defaulted to 8 characters when I started using it over 20 years ago. Since then I’ve increased that to 12, and now 15. I ask for mixed upper case, lower, and numbers, along with symbols. These are so random that every time I need to give one to my wife to enter in, she’s annoyed with the length and mix of keys that need to be pressed.

    I haven’t seen the brute force table from Hive Systems before, but I like the visual. It helps you determine how strong your password is with modern hardware. This is a similar graphic to the one I used in an encryption talk years ago, where it showed how much it would cost to rent compute power on AWS to brute force crack various algorithms. In case you were wondering, about 5 years ago you could crack a 512bit key on AWS for less than US$75.

    I like the graphic, and it shows that my 15 character passwords should be safe for years. This Friday, I’m wondering if you’re comfortable with your password lengths? Are they crack-able in less than a year? Take a look at the graphic and let us know.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • A Real World Security Reminder

    A saw a tweet from Brent Ozar about USB ports on slot machines to charge your devices. There are also wireless charging pads. Convenient, but also potential security problems, especially for IT workers that hold privileged access to code or data.

    Please, don’t use public USB ports for charging a device. You never know if there is any data access taking place. Yes, I know that most phones ask you to approve things, but have you ever hit the wrong button on your UI? Know how to turn it off? How quickly would data move or malware install? Just don’t plug in.

    Next, beware of physical security. My wife was using a wireless pad at a Starbucks a few years ago. She was sitting there talking with my daughter, and occasionally checking her phone (she gets LOTS of texts). Someone walked up and started talking with them, pleasantly and unassuming. After a few minutes, they walked away.

    A minute or two later my wife realized her phone was gone. They both looked around and then ran outside. They couldn’t find the person, and since this was a trip to visit colleges, she ended up purchasing a new phone. An expensive trip for us all.

    That reminds me of a few stories in the past from my former CEO, Simon Galbraith. He wrote a piece in 2005 about the issues of losing backup tapes. That used to be a problem, along with the loss of laptops. He also shared a story internally about finding a USB drive near our HQ. Our IT staff investigated the USB drive on an air-gapped computer since USB drives are sometimes spread around with malware.

    In this case, we found that it had been lost by our auditor. No Redgate information was on it, but there was data on it from another client. An accident, but one that could have had severe consequences if someone else found the drive. A good reason to be sure that any data you move around outside of production is masked or anonymized, no matter how secure you think your development laptop or mobile device is in your possession. Mistakes happen.

    We also need to be careful with devices. These days, with BYOD and MFA, it’s especially important that we secure devices and limit the disclosure of data on locked screens. Whether for a practical joke or malicious purpose, having someone else get access to our credentials is not something we want to explain to our employer.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • Most of Us Are Vulnerable

    I saw this study recently, where most people think they are better-than-average drivers in the US. I thought about it myself afterward, and I think I’m maybe average. I do pay attention most of the time, I try to be more careful when it’s wet or snowy and give myself more time to slow down. I  try to be aware of the other cars and obstacles on the road. I also usually have a drink (coffee, soda, water) with me, and I certainly mess with the music player. The Tesla reminds me constantly when I’ve strayed near a line, so a few months of driving seems to tell me I’m not great. Certainly not above average.

    I would expect that most of us think we’ve done a good job with security for our systems.  We don’t expect to get hacked or deal with ransomware. I don’t know how realistic that is, as a recent set of penetrations tests shows the vast majority of networks are vulnerable.

    It sounds bad, and it is. It also is not likely to change as the complexity of many networks is high. There are so many devices, constant additions and changes to services and applications, and regular requests to grant access to a new group. It’s amazing there is any security at all, given how quickly people want to access systems and how impatient they are when they can’t connect.

    The data doesn’t show that every system is wide open, but there are ways in which every network can be disrupted. Whether this is significant or not is hard to assess, but given the reports I see in media, as well as private notes from friends, I suspect that most companies have plenty of work to do.

    It’s not all had work, however. I think many people that configure networks are careful and are wary of opening firewalls. The bigger problem, which continues to exist, is likely simple passwords from far too many people. That, combined with a lack of multi-factor authentication being rolled out, means that there a lot of simple changes that could make a big difference. I know my company rolled out a corporate password manager recently to all employees. This, combined with our MFA app on mobile devices means that we should have strong passwords and better verification of legitimate access for most systems.

    At least, I hope we do.

    Steve Jones

     

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • Teams Security Issues

    At some point during my career sharing files and links in email became a security concern. There were all sorts of malware problems and issues that spread throughout organizations because someone unknowingly clicked on or forwarded a malicious item. At a couple of large organizations, we had to turn off email for days while we cleaned out systems. Fortunately, antivirus and other types of scanning software improved to prevent most of these problems.

    It seems that not all developers learned the lessons of the past. Microsoft Teams has a few vulnerabilities inside it based on link sharing in the chats. One of the issues is that the preview features aren’t well implemented, though Microsoft security doesn’t think this is a problem as a user would notice the link would be incorrect. I think that’s a huge leap and not a very safe one to make.

    I don’t use Teams often, and as a Slack user, I find it rather confusing, busy, and unintuitive. I know lots of others that like Teams and find it very productive in the Microsoft world, and I’m glad we can have the choice of a way to collaborate with others. However, no matter which type of communication mechanism is used inside of your organization, the security protections ought to be very strong. We are often busy with work and distracted. We are often expecting the information in Slack or Teams to be safer than browsing sites on the public internet. Perhaps that’s not the way things should be, but it is.

    Attack vectors that use code inside a webpage are very common, and I dislike many of the “preview” features that I’ve seen in various pieces of software. They slow down the application, especially on a mobile network, and take up unnecessary space. As someone that often can see bandwidth constraints, I’ve prefer that all of these features were optional. Let me decide if I want a preview.

    The trend to build richer experiences in applications and pre-fetch data can make the experience better, but there is a tradeoff. There are potential security concerns, but apart from those, these features can make the experience more enjoyable or unnecessarily slow things down and interfere with the way we use an application. More isn’t always better, especially when the pattern for an individual user might not match what the majority does. If 51% of users often use a feature, I’m not sure the other 49% view this as a positive way of architecting the system.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.