Voice of the DBA

Tag: security

  • A SQL Server Bug and Data Security

    This week I saw a post from Microsoft Tiger Team on the issues with backup compression and TDE databases. Apparently when they added compression, they didn’t test a few edge cases. Or a few regular cases, like WITH INIT. There is a possibility that your data could be corrupted, which is a major problem. I have found the SQL Server backup and restore capabilities to be very solid over the years, so this is disturbing. If you use TDE, apply SQL 2016 CU7 for RTM or SP1 CU4 ASAP. Test your restores, and be sure you know what you can recover and what you can’t. If Mr. Murphy has anything to say about it, you’ll have an issue soon, so test your restores.
    Overall, SQL Server security is very good, but there are certainly issues with applications and devices that connect to SQL Server. You never know when some item that queries or alters data in SQL Server will cause issues. This week there were a couple notes from Bruce Schneier on FaceID and Bluetooth security, the latter of which has a vulnerability issue. Be sure you are aware of issues here to actually help protect yourself with your devices, but I was amazed to see this piece on infrared camera hacking. A POC on using light to jump air gaps is truly frightening. It seems that truly anywhere that we are processing data, we need to be thinking about security.
    The last few weeks are especially scary for many people, particularly with the Equifax breach. I know they have released numbers on people’s data, but I’d assume that everyone who has ever had credit in the US has a potential issue. I know I am being careful with credit and watching for issues myself. You should, too, and demand better security from companies you do business with. We can improve systems, but it will take more pressure to get companies to put more emphasis on better software and security.
    Steve Jones

  • A Data ID

    It sounds good. A universal ID that can be used for your identifiable data, in case you happen to lose your paperwork. Paperwork? When will that term become lost to history? These days, less and less of anything is available as a physical media, and if it is, it’s often because someone generates a copy from a printer. How secure or valid is that? After all, with Photoshop and other tools, we can reproduce almost anything that’s indistinguishable from the original.

    The UN wants a universal ID for humanitarian reasons. In case you can’t get your personal documents because you’re a refugees. They’re lost, they’re stolen, or just still in the desk drawer because you had to flee your residence. Digital representations of these papers might be the only way for many people to prove anything about their lives. Certainly a concern in today’s world.

    As we should know by now, anything that can be built in the digital world can be stolen. In fact, I’m fairly convinced that the vast majority of people that come up with good ideas don’t know how to evaluate them in terms of the horrible ways that others will abuse the system. Creators are optimistic and look to solve problems. They’re not nearly devious enough to think of the various permutations that a hacker mind might envision.

    A universal way to track and verify identity information would be great. I already worry about losing track of digital assets, and some way to query a number of systems to verify I own them would be great. However, the security aspects worry me. Even having governments or the UN provide digital lockers that entail backups of records is problematic. Any centralized system can be abused, and certainly this data would be abused. Or leaked. We see data breaches from government all the time. Can you imagine losing control of passport verification at a large scale?

    Each individual needs to come up with their own backup of precious documents, in a way that ensures they are encrypted and protected. However, we do need ways to authenticate and verify these digital assets. Maybe free signing certificates should be used when assets are provided to individuals, with public keys being disclosed by the government and escrowed by the UN, or maybe every other government. We ought to be able to verify a digital document in an open, transparent way, while leaving the storage to the individual. That would allow us to develop ways to protect our own assets, but ensure multiple entities can verify authenticity.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.7MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Auto DevOps

    As much as I like DevOps, this scares me. There are a lot of employees (20%) at BMW that are software engineers. They want to increase that to a larger percentage, which I assume means that we’ll have more and more code in our automobiles, with more systems tightly integrated. We’re even gathering more and more data in modern vehicles. Maybe there are good database job opportunities for some of you with automakers.

    If there’s one thing we’ve learned in a few decades of writing software, it’s that large monolithic systems are a mess. They contain vulnerabilities, and more importantly, they are very difficult to patch and change. All of the DevOps success stories I’ve seen from large systems have either been a complete rewrite, or a long term refactoring that removes dependencies and tight couplings between modules.

    In cars, we’ve seen all sorts of hacking issues. Hackers can attack a vehicle remotely and a faulty (or hacked) update might leave you in trouble. Granted these things aren’t that likely, yet, though I think this piece understates the potential problems. I think that because once a hack is discovered, how sure are we that a) it will be reported to vendors (hackers might just exploit it), or b) that a fix will certainly be developed that works well and doesn’t cause any issues (remember 10s of millions of lines of code current year cars), and c) consumers will apply the patch. That last item worries me, especially if cars become more connected and share data about operation or as we move to autonomous (semi- or total) vehicles.

    Personally I’m not against code in vehicles. I’m not even against some connected systems. What I am against is a monolithic, tightly coupled system. I don’t want engine control or drive by wire sharing a network or code with a CD player or navigation system. I don’t want one computer controlling vehicular functions, entertainment, and climate control. I also want to be sure that there is some protection for all this data, to be sure it doesn’t overwhelm any system. I’ll also admit I like idea of upgrading or replacing parts from different vendors, some of whom might do a much better job of building systems.

    We’ve learned a lot about software and complex systems. While I don’t want all manufacturers to use one system or have tight regulations, I would like to see some mandates that separate critical systems from each other. Both in code, and physically. We don’t need to specify code standards, or encryption, or any details, but let’s ensure that a base bar of building software is being used in any of the mass produced vehicles, planes, trains,  automobiles, or anything else of substantial size that is operated by the general public.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 4.7MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Advancing Security

    One of the topics that is very important to many technology professionals is security. Security also might be one of the least understood aspects of our jobs. It’s an area that requires regular learning, monitoring, reactions, and vigilance. A healthy dose of paranoia makes a good security mindset, but this an easily devolve into greater stress and worry than might be appropriate, or the feeling that one should throw their hands in the air because of all the potential issues, attacks, and vulnerabilities.

    I think as individuals our part is to learn to write better code and scripts with security in mind, perhaps implementing best practices, but really the ways we will get better security is when vendors and platforms develop better ways to implement their security for us. They need people that study the issues and build fixes applicable to protect systems. This means we need good interfaces and basic contracts that ensure we can build software on top of platforms, but we will need to outsource this part of our security.

    Microsoft is one company that has been working to help us implement better security through defense in depth, through partnerships with other firms, and is making a difference. They’re not perfect, and there are still flaws in their software, but they are addressing and fixing them quicker and quicker. The world is changing, and Microsoft is a very different company than the one that build SQL Server 2008 R2, or even SQL Server 2012. They are maturing and becoming more responsive, and to me, more responsible about their place in the technology industry. They are striving to produce higher quality products, and when there are issues, they look to fix their mistakes quickly.

    Many of us that have struggled to believe in this new Microsoft and apply patches in a more timely manner. I’ll admit that I still rarely apply CUs unless I have a need for a fix, but mostly that’s because I don’t want any unexpected issues to crop up when I’m presenting and I don’t have time to test that regularly. Like you, I have multiple versions of SQL Server. I do catch up periodically, and I certainly try to apply Service Packs within a few weeks of release, if not sooner. As much as Windows updates can be annoying, this is more a matter of timing than concern over quality, and I do try to keep up with these.

    Will Microsoft and other vendors make mistakes with updates? Sure, sometimes there will be a patch that causes a problem with some, maybe many systems. However, we do need to grow and advance the security of our systems, which will always have vulnerabilities. Therefore, we need good quality updates from vendors like Microsoft, which I do think has happened. However, we also need customers to apply those patches. You can be slow and conservative, but don’t be negligent and try to avoid them completely. That makes the security situation worse for all of us.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 5.1MB) podcast or subscribe to the feed at iTunes and Libsyn.