Voice of the DBA

Tag: security

  • The Endless Upgrade Cycle

    Security posts are always interesting to me, and this one on Tesco security is no exception. It’s an analysis from the outside of a number of problems that are blatantly obvious with the way Tesco deals with passwords for their web systems. A great read, one that even your managers might use to better understand why some security processes should be followed. Developers certainly should read this as well, and I’d recommend this as one post to pass around.

    There is one point in the piece that I want to talk about.  In the post, Mr. Hunt mentions that the server software and development platform in use are old, 7 and 9 years old respectively. This section rightly points out that these technologies have been vastly improved, and security has changed. The company should have upgraded.

    Or should they? Obviously if they were really worried about the security of their systems they should have, but how often do they upgrade? When is the upgrade treadmill from software vendors a costly path with little benefit and when is it really necessary? I’d argue that some of the security issues in software should be back ported and fixed. After all, vendors sold these products with the promise they’d work and be supported. Microsoft offers 5 years of mainstream support and 10 years of security support, so at least for the web server, Tesco should be OK.

    I find myself torn on this issue. I certainly understand that software companies need to sell new versions of their products to maintain their businesses, but I also think they bear some responsibility for the security worthiness of their previous versions. Where and how we draw this line, I’m not sure, but I certainly don’t think the answer is as simple as “just upgrade.”

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.3MB) podcast or subscribe to the feed at iTunes and Mevio . feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

  • Privacy and Data

    Privacy. Security. Encryption. Protection. Responsibility.

    All big words, with many connotations. Unfortunately, the meanings behind the words seem to be dwarfed by one other word: profit. Data brokers and even departments inside various organizations make a lot of money from their data, and I don’t expect they’ll want to see that stop anytime soon.

    So much of our data is being collected, sold, and (arguably) poorly secured. Citizens are complaining and governments are taking some notice. The US Congress has a committee investigating how some of the large data brokers are handling data. The committee compiling the report doesn’t have much power, and I’m not convinced that much will change, regardless of the conclusions they reach.

    However I do think that those of us that work as data professionals should be aware that we may find ourselves bound by new rules and regulations over time. I wouldn’t think anyone would preemptively prepare for more control by changing their systems or processes, but I would expect that data professionals might want to ensure they understand how their data is being handled and secured, just in case anyone asks.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 1.6MB) podcast or subscribe to the feed at iTunes and Mevio . feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

  • Maintaining High Performance When Using Encryption

    Summary: Encryption is becoming required in more and more environments, but implementing encryption can dramatically affect performance. Learn how you can maintain high performance while using encryption in your database.

    Abstract: Encryption is becoming required in more and more environments, but implementing encryption can dramatically affect performance. Learn how you can maintain high performance while still protecting your data with encryption. This session will examine communications, Transparent Data Encryption and a technique for using Symmetric Key encryption without a high performance penalty.

    Length: 75 minutes

    Slides: (coming soon)

    Code: (coming soon)

  • How Many Passwords?

    How many user names and passwords do you have? If you’re like me, you have a lot of them. Actually I don’t have too many user names, sticking with “Steve Jones”, “sjones” or my well known “way0utwest” for my logins. However I do try to have as many passwords as I have logins. Using my Password Safe utility, I count 265 items in my personal safe and 176 in my business one. Some of those are old and dead, but quite a few of them I use on a regular basis.That’s similar to what Keith Combs notes in his blog post on IDs and passwords. He has 172, though I’m sure that number has crept up since he wrote the post. The piece links over to a few identity discussions from others at Microsoft that are trying to make identifying users and managing security easier. In the Microsoft world I think that works well, but the larger world outside of Microsoft software requires a bit more work for most of us.

    The original piece was written awhile back, and since that time, I’ve come to find that more and more of my logins are authorization links from one of the large companies (Microsoft, Google, Facebook, Twitter), with some sort of token that allows me to login. I have my Live account working on a number of Microsoft based services, but my Google account crossing their platform to Gravitar and StackExchange. My Twitter and Facebook accounts are linked to a few places, though I’m careful about which one of those I link to which application or service.
    Using passwords, moving to application links from a platform, and even now adding two factor authentication with a mobile phone makes me think that we are not necessarily finding a better way of managing authentication. Perhaps we are making things much more complex without creating any more security.

    I don’t know what the future will bring, but I suspect that many of our current methods of providing security will prove to be inadequate. I’m hoping that we find out on some services like Funny or Die or ESPN, and not because people find ways to jump from external applications to internal servers like Exchange or SQL Server.Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.0MB) podcast or subscribe to the feed at iTunes and Mevio . feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.