Voice of the DBA

Tag: security

  • Maintaining High Performance When Using Encryption

    Summary: Encryption is becoming required in more and more environments, but implementing encryption can dramatically affect performance. Learn how you can maintain high performance while using encryption in your database.

    Abstract: Encryption is becoming required in more and more environments, but implementing encryption can dramatically affect performance. Learn how you can maintain high performance while still protecting your data with encryption. This session will examine communications, Transparent Data Encryption and a technique for using Symmetric Key encryption without a high performance penalty.

    Length: 75 minutes

    Slides: (coming soon)

    Code: (coming soon)

  • How Many Passwords?

    How many user names and passwords do you have? If you’re like me, you have a lot of them. Actually I don’t have too many user names, sticking with “Steve Jones”, “sjones” or my well known “way0utwest” for my logins. However I do try to have as many passwords as I have logins. Using my Password Safe utility, I count 265 items in my personal safe and 176 in my business one. Some of those are old and dead, but quite a few of them I use on a regular basis.That’s similar to what Keith Combs notes in his blog post on IDs and passwords. He has 172, though I’m sure that number has crept up since he wrote the post. The piece links over to a few identity discussions from others at Microsoft that are trying to make identifying users and managing security easier. In the Microsoft world I think that works well, but the larger world outside of Microsoft software requires a bit more work for most of us.

    The original piece was written awhile back, and since that time, I’ve come to find that more and more of my logins are authorization links from one of the large companies (Microsoft, Google, Facebook, Twitter), with some sort of token that allows me to login. I have my Live account working on a number of Microsoft based services, but my Google account crossing their platform to Gravitar and StackExchange. My Twitter and Facebook accounts are linked to a few places, though I’m careful about which one of those I link to which application or service.
    Using passwords, moving to application links from a platform, and even now adding two factor authentication with a mobile phone makes me think that we are not necessarily finding a better way of managing authentication. Perhaps we are making things much more complex without creating any more security.

    I don’t know what the future will bring, but I suspect that many of our current methods of providing security will prove to be inadequate. I’m hoping that we find out on some services like Funny or Die or ESPN, and not because people find ways to jump from external applications to internal servers like Exchange or SQL Server.Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.0MB) podcast or subscribe to the feed at iTunes and Mevio . feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

  • Lawsuits and Data Breaches

    After the breach of the Target payment systems, a class action lawsuit was filed against the company. The action alleges that Target failed to implement strong enough security. Regardless of the merits of this action, it does bring to light a few things that we, as data professionals, should be aware of.

    The first is that if our companies store any PII, financial, medical, or other sensitive data, we need to ensure that our management is aware of potential security pitfalls we see, as well as the possibility for legal action if the data is somehow disclosed. The risk and mitigation actions taken need to be weighed by management, and we should approach this as we might any other upgrade or enhancement to a system. With logic, and rational discussion about the issues, providing guidance and potential solutions.

    However we also should be aware that no matter what security efforts we undertake, criminals are going to be finding ways around our defenses. As this piece notes, Target likely had security in place, but it’s never going to be enough because the attack vectors and techniques are out-pacing the ability of security techniques to provide protection. The solution, or at least a potential mitigating action, is one that data professionals can help with.

    We, and the businesses that employ us, should be incorporating analytics into our defenses to detect abnormal actions, by both external and internal, users. We should be looking for potential ways that data is disclosed, and perhaps even scanning the Internet for potential leaks of data. We won’t prevent all problems, but if we can detect them early, we can limit the damage.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.5MB) podcast or subscribe to the feed at iTunes and Mevio . feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

  • Auditing Matters

    There’s been some reporting about Yahoo Mail getting hacked and potential issues recently. I ran across this piece that talks about what happened and it’s an interesting read, but there’s one quote that stuck with me: “Yahoo reported on its Tumblr that it had detected “a coordinated effort”—basically, an attack—by somebody trying to gain access to user accounts.”

    It’s not the notification or the proactive resetting of accounts, but the detection that resonates with me. We’ll never stop all hack attacks. We’ll never plug all the holes in software. We’ll never anticipate the ways in which our systems might be compromised, but we can detect issues. I think more often than not we can deal with any hacks or attacksif we are aware they took place.

    We have some login auditing in SQL  Server, an auditing and eventing framework, and the ability to capture and store this data. However we don’t have good proactive tools to help us detect issues. I’d like to see enhanced tooling to allow us to review log data, write alerts that look for patterns, and more. While much of this can be built by DBAs, it requires use to develop and maintain software, and even then it’s easy to miss potential attack vectors if you don’t constantly supplement your knowledge and enhance your tools.

    Given what we have to work with, I’d encourage you to learn a bit about the different frameworks and gain some basic skills with the tools. I’d also encourage you to think about writing queries to look for potential hacking issues, like updating all of your lookup values to the same string, or embedding script tags in your data. I’d encourage you to write or speak about what you learn, and how you use the information. If you’d like to write software to make the task easier, that would be great.

    I’d also encourage you to befriend your network or security administrators and teach them how to query their own lo data. Lots of their tools collect data, but provide poor query tools for the information. Perhaps you can even build them a data warehouse that allows them to tighten security by examining their own data.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.4MB) podcast or subscribe to the feed at iTunes and Mevio . feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.