Voice of the DBA

Tag: security

  • Prized PII

    If I asked you what specific type of information criminals would like to capture about you, what would be your response? Take a minute and think of something and then leave it in a comment after reading the rest of this.

    I know that usually more than one piece of data about me is needed, and while most of this data is probably somewhere in a database, and perhaps leaked in a breach, it’s not necessarily organized. I still think it’s good to protect information where I can. Every year my wife laughs as people wish me Happy Birthday in Facebook, on a day that’s not my birthday. I think any day is as good as any other to wish me well, and so I disclose April 1 to my friends. In fact, I often disclose a slightly incorrect birthday when sites and organizations ask me, unless I have some legal obligation to type in my real date.

    There was an article that caught my eye about the data that thieves most often want. It opens with a story about pharmacists using personal data to bill insurance for non-existent medications, which is criminal activity for sure, but there’s not much you can do about these people using your data. The piece then goes on to talk about the value of healthcare fraud and how data related to this is even more valuable than credit card numbers.

    That isn’t something I’d have expected, though, I do live in the US. With the high cost of healthcare, I shouldn’t be surprised. Fraud is big business, and there is a large volume of claims, providers, and statements that people have to review. If you’ve tried to go through your statements, they often don’t seem to be easily relate-able to the treatment you may have received. I think this creates opportunity for fraud, as it might not be something an individual can catch.

    I haven’t worked with healthcare data, but I suspect anyone that does will need extra protection on their systems, and certainly encryption along with the prevention of PII in non-production environments is important. I also think this is the type of data that you may want to be more careful about in your own life. Though how you can be more careful escapes me.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Completely Encrypted Data

    I remember reading about, and doing some message exchange, with PGP, in the 90s. At the time I worked in a utility company and my boss and I were interested in whether encryption might be something we should implement. At the time, the integration with mail clients, and the relatively unsophisticated users limited our options, and we never moved forward, but I’ve always been interested in encryption and how it fits into our digital world.

    The technical bits have gotten easier, with https encryption automatically enabling for most of us, though perhaps only preventing limited attacks. We’ve gotten more options in the data platform, some that work well, some that require a decent coding effort, but they do work to some extent. At least, they make auditors happy and prevent silly leakage from something like a lost disk drive.

    One of the main areas where encryption has been controversial is in real time communications. Governments and law enforcement want to be able to eavesdrop on criminal activity, or maybe other activity, and individuals want privacy. This seems to be an ongoing battle between technical companies and lawmakers as to how to implement features and what limitations should be enabled. I noticed a story recently where Google is rolling out end to end encryption in its messaging apps.

    That got me to thinking. We capture and store data, and we may have some sort of communications in our system. If users demanded, or application developers built, end to end encryption, do we care as data professionals? Certainly we would need to allow for binary storage, and we’d lack insight or indexing into the actual data, but certainly could work with metadata like user, time, etc.

    There are also other considerations for us. If we store encrypted data, is this more of a hassle in dealing with legal requirements? Do we want to have another sort of PII in a key or have to constantly explain to management or legal staff that we can’t read the data because we don’t store the key? There are non-technical burdens that we might not want to shoulder.

    I do think that more systems ought to allow end-to-end encryption for communications, and user-managed keys are a capability that plenty of us might want in a world where no one physically sees the database server or disks. While I do like the idea of secure enclaves, which are catching on in computing, I also think that key management, especially for users, needs to improve. Perhaps we need a password manager for certificates, with backup included, to ensure our end users can properly manage their certificates across devices and in the event of any personal disasters.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Detecting Logins

    Do you have a login on any of your SQL Server instances that is named “default”? If you do, you might have an issue with the MrbMiner malware that has infected a number of SQL Server instances. This adds a login with the name of default and the password of “@fg125kjnhn987.”.

    Stop and double check your instances now. If you use SQL Monitor, you can also add this custom metric to your alerts to look for this on an ongoing basis.

    I don’t know this is a SQL Server problem. It’s really a user/administrator issue. This works by looking for weak passwords, which is always a problem. It’s also an issue if you have an exposed SQL Server connected directly to the Internet. Shodan shows lots of SQL Servers on the Internet, and if you own any, you might be sure you have *very* strong passwords.

    Or remove them from public Internet access.

    While this is easy to detect, what if the login were stevejones? Can you detect if logins are added to your SQL Server. Sure you can, but would you really notice something strange? On my instances, where I add all logins, I would. In many organizations where I’ve worked, more than one person added logins, and logins could be added on a regular basis. Often these are associated with tickets in some system, like Jira, but even if they are, would you know an extra one got added?
    I bet most people wouldn’t notice, especially across their estate and with a team of administrators.

    That’s a problem, and it’s one where we ought to perhaps have good controls in place. There are a few places I know where every change is submitted to a pipeline of sorts, meaning that everything is logged, and given the integration with release management tools and ticketing systems, things could be audited. Maybe more importantly, approved logins could be added to a list that might be compared with the actual list on a server.

    Possible, but not necessarily simple to implement or get right. Maybe the low tech solution I’d use is a daily report that included changes from the previous day. All administrators could check it to be sure any new logins were added by one of them.

    You should know how to secure your SQL Server. Implement strong controls, and be sure that you periodically audit for anything unusual. At the very least, ensure you have monitoring so that any unusual or strange activity might be detected.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • The Real Life Software Movie Plot

    It wasn’t that long ago that Firewall was released. In it, a security executive has his family taken hostage, with the plot being that the executive will help the criminals rob the bank that he’s spent years protecting or his family will be killed.

    While I haven’t heard of this extreme happening in the real world, I wonder how far away we are from this. Recently, there was a less violent attempt at hacking, with someone offering a Tesla employee over US$1mm to slip ransomware into their network. The idea would have been to threaten Tesla with data release unless they paid up. The details are interesting, and supposedly the ransomware cost US$250,000 to build, but another company paid US$4.5mm to criminals, so maybe this would have been very profitable.

    I’m sure there have been some shady offline attacks against companies and their executives or privileged staff. I hope there haven’t been any violent ones, but I am sure that something has happened somewhere in the world.

    Ultimately, I bet that the best defense might be to limit the knowledge of who can access sensitive data, and perhaps even ensure that no one can. Only systems, and that all queries, all access, and certainly all backups, are handled by some automated system, logging everything. This might not prevent this movie plot from coming true, but maybe you’d get a similar ending, with the criminals caught quickly because some system logged the action and alerted people.

    Security is a tough world to work in and think about constantly. Many of us know this, dealing with the stress and concern on a regular basis. Hopefully none of us add in the moral dilemma that might come from an actual criminal contacting us. If they did, hopefully all of us would be able to do the right thing.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.