Voice of the DBA

Tag: security

  • The Biggest Data Breech (For Now)

    I keep reading the words “the largest data breach in history” in a variety of stories. In fact, given the tremendous growth of data acquisition, I’m guessing that this headline will continue to repeat itself over and over. I think I’m getting to the point where I’d rather just see a story say that xxx million customers were affected. At least then I’d be able to easily put some scale to the loss of data.

    What’s interesting in this case involving JP Morgan is there are indictments being handed down, to at least two men that somehow participated in hacks that copied over 100million people’s data. JPMorgan admits 76 million households and 7 million small businesses were compromised, which isn’t 100, but perhaps there’s something I’m missing. However the data wasn’t just sold, but rather hackers used the information to market stocks to the individuals compromised. That’s an interesting level of sophistication, and a scary one.

    Can you start to imagine criminals using the information intelligently to not directly sell the data but to make a secondary use of the information. Perhaps they will enagage social engineering by bundling the information with other data to perform some other attack on individuals? It’s entirely possible that we will see more sophisticated uses in the future as criminals work to evade or avoid the fraud detection systems that have been put in place.

    I have no doubt that bigger data breaches are coming. Perhaps we could reduce the impact and frequency with better security frameworks and development practices, but I’m not sure that any company out there will place a high priority on security over ease of access and speed of development. I do continue to hope that market forces will drive companies to build better detection and protection mechanisms, and our vendors will build better security mechanisms into all platforms.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.4MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • Private Data

    I think that as we evolve into a more digital world, we really need to modify and enhance the various legal systems around the world to cope with the challenges of digital information. The world changes when vast troves of information can be gathered, indexed, easily maintained, queried, and copied without anyone being aware, or few people understanding how any particular data is used. Data fundamentally is different in the digital world precisely because the costs and barriers to its movement are so low.

    I’ve been concerned with this for a few reasons. One is that I like my personal privacy and would like to ensure that data collected about me and my family is something I have some say in. Or at least some understanding. However as a data professional, I also have concerns about the responsibilities and potentials liabilities of managing data in the future. There’s also the not-so-little concern about employers pressuring employees to deal with data in a way that might conflict with their personal ethics, or even the local laws.

    I’m glad someone at Microsoft is taking a stance, asking the US and EU to recognize the privacy of digital data as a right we have as individuals and corporations. The request asks that governments treat digital data like they treat analog data, serving subpoenas and warrants to the owners of the data, not the custodians. While this isn’t what always happens in the real world, we certainly should have more protections for digital data than we have now.

    I’d like to see governments amend their laws to also exclude IT workers from liability in working with data that they are custodians of. We often don’t make the decisions about what data to gather or how it should be managed and moved. We just implement the decisions, often under coercion from our employers. Liability should rest with those employers, not those the employers have hired.

    I don’t have hope that things will change anytime soon, but I hold out hope they will at some point.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.4MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • Rogue Software Changes

    Could a group of software developers make changes that fundamentally alter the way a software system should work without management being aware?

    That’s the question being asked of VW right now. Most people are skeptical, but I ran across a piece that wants to lend credence to the idea that a few software engineers acted with few people being aware. They did this, not because they wanted to defraud everyone, but they wanted a solve a problem that they couldn’t do in other ways. They also didn’t see the alteration of test results as much of an issue because they thought the tests were too stringent.

    I’m not sure I believe that’s what happened. Certainly there is some disagreement from various parties, but with my experience in software projects, management always wants to know how things are proceeding, with more and more questions whenever the applications don’t work as expected. When problems are solved, natural human curiosity leads more managers to ask for details, even when they don’t understand. In this case, I can’t imagine lots of VW management weren’t aware that software was being used to pass tests. Many people report to many others, and everyone would have wanted to know how VW solved this engineering problem.

    The stakes for organizations will continue to rise in a global economy, and software will play increasing roles in many companies. Will we see more and more pressure to manipulate our world with software, even in criminal ways? I suspect so, and I sympathize with those that might face the loss of employment for not complying with the requirements they’re given.

    Ultimately I think transparency of software is the best way to bring about better software that complies with regulations and rules. Transparency also ensures that copyrights aren’t violated (since violators code is available), and we can determine if security is being built into systems. Perhaps best of all, developers can all learn from each other, seeing exactly what works and doesn’t in each system.

    I doubt we’ll get there, but transparency would be a nice place to be.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.7MB) podcast or subscribe to the feed at iTunes and LibSyn.

  • The Lost Laptop Crisis

    I wrote about the dangers of travel awhile back, where I had concerns about information when crossing the borders of a country. However that’s a case that most of us encounter rarely. However many of us do move information around on a regular basis with our devices, carrying them wherever we go. Each time we change locations, there’s a chance we’ll forget a device, or that one might be stolen from us.

    There is a limited amount of information in our phones and tablets, but in many laptops, we can carry more information, and often do. No shortage of us keep database backups or imports/exports of data for development purposes. Our clients certainly have reports or data in Excel, but often that’s a limited amount of data compared to what some of us might keep on our machines. In thinking about this, I wanted to ask this question:

    What would you do if you lost your laptop?

    I’m talking about the main laptop that you use for work. What’s on it? What’s important? How would you react? Have you even thought about it?

    I have, and I’ve had laptops die, though never stolen. However I have taken some precautions. When I get a new laptop, the first thing I do is enable the whole disk encryption in Windows or OSX. I keep backups of the recovery codes at home and I make sure I’ve taken advantage of strong passwords and other encryption for information I carry. I don’t have passwords saved for any VPN or other secure connections to banks or work.

    It’s not a perfect solution, but it’s a start. Let me know today if you take other precautions.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.1MB) podcast or subscribe to the feed at iTunes and LibSyn.