Tag: security

I saw this post recently about security and preparing for a data breach. The title caught my eye because it implies that we’re all doomed. Do the rest of you think that? Is it a question of when we’ll have a security breach not if?

Given the headlines, the news we find out about companies not disclosing security issues, the back doors and poor code in much software, is it any wonder that people think it’s a “when” and not an “if”? Given the lack of realization from many companies that suffer incidents that they were even attacked, perhaps that’s an assumption worth making.

We’ve been hacked at SQLServerCentral in the past. I don’t think we’ve been hacked in many years, but I also have no way of knowing. That’s the difficult part of dealing with bits. If they get copied, there’s not necessarily a trace of anything amiss. It’s quite possible that many of us have no idea that our bits are being copied. Every read is a copy of data and how long did the NSA read data without most of us being aware? How sure are we that they, or some other organization, hasn’t been reading much more than was disclosed?

I’d hate to think that our systems are so porous that we’re all likely to get hacked at some point. It’s probably technically possible, but hopefully not likely for most of us. However we should consider that it will happen and ensure we have some handle on our data security. It’s hard, and complex for most of us, and I’d like to think that Microsoft will recognize this and build better controls and features into future versions of Windows and SQL Server that enable easier auditing, granular permissions, and separation of duties.

Steve Jones

The Voice of the DBA Podcast

Listen to the MP3 Audio ( 2.0MB) podcast or subscribe to the feed at iTunes and LibSyn. 

The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

Does your organization have some policy around data security on mobile devices? Do your fellow employees care about data security? A new study says that most organizations don’t, and potentially that’s an issue.

Many of us are data professionals, and we might have no idea how much data a user can access using today’s modern mobile devices. Potentially we can help them understand that the $500 smartphone they use can actually contain and access much more than $500 worth of data. If their device is the cause of a data breach, the cost could easily be much closer to $50,000 than $500.

Security is always a big gamble, and rather than the old models of controlling all devices and limiting access, we need to learn to educate users, work with them to secure their devices and report losses quickly. The survey shows that most employees don’t even know how to report the loss of a device that might cause a data breach. At the very least, we can establish some procedures that will allow an account to be quickly turned off. And to ensure productivity doesn’t suffer, we need a procedure that also engages a new account for a user quickly.

My guess is a lot of security issues could be handled quicker if we ensured that users were aware of issues and penalized for ignoring them, but made sure those penalties were balanced with an understanding that there it is inevitable people will make mistakes and accidents. Forgive mistakes and ask for reports of potential issues quickly.

Steve Jones

Privacy. Security. Encryption. Protection. Responsibility.

All big words, with many connotations. Unfortunately, the meanings behind the words seem to be dwarfed by one other word: profit. Data brokers and even departments inside various organizations make a lot of money from their data, and I don’t expect they’ll want to see that stop anytime soon.

So much of our data is being collected, sold, and (arguably) poorly secured. Citizens are complaining and governments are taking some notice. The US Congress has a committee investigating how some of the large data brokers are handling data. The committee compiling the report doesn’t have much power, and I’m not convinced that much will change, regardless of the conclusions they reach.

However I do think that those of us that work as data professionals should be aware that we may find ourselves bound by new rules and regulations over time. I wouldn’t think anyone would preemptively prepare for more control by changing their systems or processes, but I would expect that data professionals might want to ensure they understand how their data is being handled and secured, just in case anyone asks.

Steve Jones