Voice of the DBA

Tag: security

  • The Problems with Gods

    When I was learning how to work with computers early in life, I ran across various documentation and writings that would liken the root account to being a god on the system. Over the years, I’ve seen other articles that note will describe “God mode” in various software systems. There have even been science fiction books describing the god-like abilities of a person that obtains a privileged account on a system.

    To me, this is one of those places where our industry is immature. Having an account that can perform any task on a system, with no limits, is indeed like a god. This account can do anything, which is a double edged sword. Someone can reconfigure, fix, patch, update anything to ensure the system runs well. Or they can “rm /rf” the system.

    Recently Verelox had their entire system wiped out by a former administrator. There are a variety of problems with this story, not the least of which is leaving old credentials active. Mike Walsh wrote about some of the issues from a backup perspective. I would add from a security perspective that this is why an individual’s credentials need to be disabled immediately, and any well known, long time passwords need to be changed. We do this in the physical world by changing locks. We need to do this in the digital work as well.

    However, I see a overreaching account with unlimited privileges as fundamentally a bad idea. Sure, this makes installing software or reconfiguring our system easier, but perhaps we should be required to use separate accounts for all sorts of options. This is especially true when we build a distributed system across multiple machines. As the number of services and systems increases, the value from having one account able to accomplish every task outweighs the potential issues.

    Humans make mistakes. We make inadvertent ones when we’re tired or distracted. We make malicious mistakes we regret; we make emotional mistakes by overreacting to a situation. We make mistakes based on incorrect information. If we have all the power over a shared system, then we may easily make mistakes that could cause an extraordinary amount of damage.

    Our modern systems should include the ability for a separation of all duties and more default accounts that we configure. At the very least we should separate administration from auditing, and perhaps security as well. A slight inconvenience during setup is worth accidental issues in the future. Having separate accounts for different functions will also help to slow down the potential problems in the future by ensuring no one user account can be used to perform every function on a platform if it’s compromised.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.7MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • A SQL Server Bug and Data Security

    This week I saw a post from Microsoft Tiger Team on the issues with backup compression and TDE databases. Apparently when they added compression, they didn’t test a few edge cases. Or a few regular cases, like WITH INIT. There is a possibility that your data could be corrupted, which is a major problem. I have found the SQL Server backup and restore capabilities to be very solid over the years, so this is disturbing. If you use TDE, apply SQL 2016 CU7 for RTM or SP1 CU4 ASAP. Test your restores, and be sure you know what you can recover and what you can’t. If Mr. Murphy has anything to say about it, you’ll have an issue soon, so test your restores.

    Overall, SQL Server security is very good, but there are certainly issues with applications and devices that connect to SQL Server. You never know when some item that queries or alters data in SQL Server will cause issues. This week there were a couple notes from Bruce Schneier on FaceID and Bluetooth security, the latter of which has a vulnerability issue. Be sure you are aware of issues here to actually help protect yourself with your devices, but I was amazed to see this piece on infrared camera hacking. A POC on using light to jump air gaps is truly frightening. It seems that truly anywhere that we are processing data, we need to be thinking about security.

    The last few weeks are especially scary for many people, particularly with the Equifax breach. I know they have released numbers on people’s data, but I’d assume that everyone who has ever had credit in the US has a potential issue. I know I am being careful with credit and watching for issues myself. You should, too, and demand better security from companies you do business with. We can improve systems, but it will take more pressure to get companies to put more emphasis on better software and security.

    Steve Jones

  • A SQL Server Bug and Data Security

    This week I saw a post from Microsoft Tiger Team on the issues with backup compression and TDE databases. Apparently when they added compression, they didn’t test a few edge cases. Or a few regular cases, like WITH INIT. There is a possibility that your data could be corrupted, which is a major problem. I have found the SQL Server backup and restore capabilities to be very solid over the years, so this is disturbing. If you use TDE, apply SQL 2016 CU7 for RTM or SP1 CU4 ASAP. Test your restores, and be sure you know what you can recover and what you can’t. If Mr. Murphy has anything to say about it, you’ll have an issue soon, so test your restores.
    Overall, SQL Server security is very good, but there are certainly issues with applications and devices that connect to SQL Server. You never know when some item that queries or alters data in SQL Server will cause issues. This week there were a couple notes from Bruce Schneier on FaceID and Bluetooth security, the latter of which has a vulnerability issue. Be sure you are aware of issues here to actually help protect yourself with your devices, but I was amazed to see this piece on infrared camera hacking. A POC on using light to jump air gaps is truly frightening. It seems that truly anywhere that we are processing data, we need to be thinking about security.
    The last few weeks are especially scary for many people, particularly with the Equifax breach. I know they have released numbers on people’s data, but I’d assume that everyone who has ever had credit in the US has a potential issue. I know I am being careful with credit and watching for issues myself. You should, too, and demand better security from companies you do business with. We can improve systems, but it will take more pressure to get companies to put more emphasis on better software and security.
    Steve Jones

  • A Data ID

    It sounds good. A universal ID that can be used for your identifiable data, in case you happen to lose your paperwork. Paperwork? When will that term become lost to history? These days, less and less of anything is available as a physical media, and if it is, it’s often because someone generates a copy from a printer. How secure or valid is that? After all, with Photoshop and other tools, we can reproduce almost anything that’s indistinguishable from the original.

    The UN wants a universal ID for humanitarian reasons. In case you can’t get your personal documents because you’re a refugees. They’re lost, they’re stolen, or just still in the desk drawer because you had to flee your residence. Digital representations of these papers might be the only way for many people to prove anything about their lives. Certainly a concern in today’s world.

    As we should know by now, anything that can be built in the digital world can be stolen. In fact, I’m fairly convinced that the vast majority of people that come up with good ideas don’t know how to evaluate them in terms of the horrible ways that others will abuse the system. Creators are optimistic and look to solve problems. They’re not nearly devious enough to think of the various permutations that a hacker mind might envision.

    A universal way to track and verify identity information would be great. I already worry about losing track of digital assets, and some way to query a number of systems to verify I own them would be great. However, the security aspects worry me. Even having governments or the UN provide digital lockers that entail backups of records is problematic. Any centralized system can be abused, and certainly this data would be abused. Or leaked. We see data breaches from government all the time. Can you imagine losing control of passport verification at a large scale?

    Each individual needs to come up with their own backup of precious documents, in a way that ensures they are encrypted and protected. However, we do need ways to authenticate and verify these digital assets. Maybe free signing certificates should be used when assets are provided to individuals, with public keys being disclosed by the government and escrowed by the UN, or maybe every other government. We ought to be able to verify a digital document in an open, transparent way, while leaving the storage to the individual. That would allow us to develop ways to protect our own assets, but ensure multiple entities can verify authenticity.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.7MB) podcast or subscribe to the feed at iTunes and Libsyn.