Tag: security

Lawsuits and Data Breaches

After the breach of the Target payment systems, a class action lawsuit was filed against the company. The action alleges that Target failed to implement strong enough security. Regardless of the merits of this action, it does bring to light a few things that we, as data professionals, should be aware of.

The first is that if our companies store any PII, financial, medical, or other sensitive data, we need to ensure that our management is aware of potential security pitfalls we see, as well as the possibility for legal action if the data is somehow disclosed. The risk and mitigation actions taken need to be weighed by management, and we should approach this as we might any other upgrade or enhancement to a system. With logic, and rational discussion about the issues, providing guidance and potential solutions.

However we also should be aware that no matter what security efforts we undertake, criminals are going to be finding ways around our defenses. As this piece notes, Target likely had security in place, but it’s never going to be enough because the attack vectors and techniques are out-pacing the ability of security techniques to provide protection. The solution, or at least a potential mitigating action, is one that data professionals can help with.

We, and the businesses that employ us, should be incorporating analytics into our defenses to detect abnormal actions, by both external and internal, users. We should be looking for potential ways that data is disclosed, and perhaps even scanning the Internet for potential leaks of data. We won’t prevent all problems, but if we can detect them early, we can limit the damage.

Steve Jones

The Voice of the DBA Podcast

Listen to the MP3 Audio ( 2.5MB) podcast or subscribe to the feed at iTunes and Mevio .

The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

February 25, 2014
Auditing Matters

There’s been some reporting about Yahoo Mail getting hacked and potential issues recently. I ran across this piece that talks about what happened and it’s an interesting read, but there’s one quote that stuck with me: “Yahoo reported on its Tumblr that it had detected “a coordinated effort”—basically, an attack—by somebody trying to gain access to user accounts.”

It’s not the notification or the proactive resetting of accounts, but the detection that resonates with me. We’ll never stop all hack attacks. We’ll never plug all the holes in software. We’ll never anticipate the ways in which our systems might be compromised, but we can detect issues. I think more often than not we can deal with any hacks or attacksif we are aware they took place.

We have some login auditing in SQL Server, an auditing and eventing framework, and the ability to capture and store this data. However we don’t have good proactive tools to help us detect issues. I’d like to see enhanced tooling to allow us to review log data, write alerts that look for patterns, and more. While much of this can be built by DBAs, it requires use to develop and maintain software, and even then it’s easy to miss potential attack vectors if you don’t constantly supplement your knowledge and enhance your tools.

Given what we have to work with, I’d encourage you to learn a bit about the different frameworks and gain some basic skills with the tools. I’d also encourage you to think about writing queries to look for potential hacking issues, like updating all of your lookup values to the same string, or embedding script tags in your data. I’d encourage you to write or speak about what you learn, and how you use the information. If you’d like to write software to make the task easier, that would be great.

I’d also encourage you to befriend your network or security administrators and teach them how to query their own lo data. Lots of their tools collect data, but provide poor query tools for the information. Perhaps you can even build them a data warehouse that allows them to tighten security by examining their own data.

Steve Jones

The Voice of the DBA Podcast

Listen to the MP3 Audio ( 2.4MB) podcast or subscribe to the feed at iTunes and Mevio .

The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

February 24, 2014

The Security of Interconnected Systems

It’s a scary world in the wild, wild west of the Internet. Many days I think that’s a closer metaphor to the World Wide Web than the relatively ordered Kensington High Street in London. There are lots of bad people out there that are scraping identities, hacking systems, copying data, and more on a daily basis. Indeed the power of computers means that these malicious behaviors can be done at a speed and on a scale never before seen in the world.

I ran across this account of a blackmailer stealing a Twitter name using a variety of hacks across interconnected systems. What’s worse than the attack against someone’s digital assets is that fact that so many of the companies on the Internet have no good way of recognizing ownership. It’s almost as it could be back in the gold rush days when you had to be vigilant and constantly inhabiting your property to protect the assets. At least in that time you could file a claim that would be honored. I’m not sure a Facebook name, a Twitter handle, a SQLServerCentral login, or any name on the Internet can actually be “registered” by most of us.

The problem isn’t so much the ownership of some digital asset as it is the potential cascade of problems when we can’t own an asset and possession of a username and password seem to be what matters. I’d like to think that corporate assets are better protected, and corporations are usually more able to take legal action against attackers, but it’s entirely possible they aren’t. Especially when many of the companies that provide services to both individuals and companies aren’t providing support. The “Google” method of building automated systems that provide support looks like “hope for the best and too bad if it’s the worst” from my perspective.

As we connect more and more systems together, whether through sign-on systems, automated feeds, or other methods, the ability to protect the entire system is dependent on the weakest link. The ability to resolve ownership and security issues, however, seems to have no protection at all.

Steve Jones

The Voice of the DBA Podcast

Listen to the MP3 Audio ( 2.5MB) podcast or subscribe to the feed at iTunes and Mevio .

The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

February 18, 2014

Encrypt Everything

Security is a problem with so many of our applications and systems. There are numerous ways that we handle access and protection of data, often with access rights or encryption (or both) being applied to data in order to limit who can access the data. However neither of these systems is perfect for a variety of reasons and no matter how we configure our security, it seems there are always issues.

Yahoo announced recently that they are trying to improve their security by encrypting all data that moves between their data centers. Other large internet companies do this, though not all. However, this doesn’t necessarily mean that your data is much more secure than it was before. This should make it more difficult to access data while it is transiting networks outside of Yahoo’s control, but there are still potential issues. Just as with TDE, any legitimate user inside a data center that has access to the LAN or systems inside the data center can still potentially read the data.

I’m not picking on Yahoo here as the same issues might exist with Microsoft, Google, or any service provider that encrypts data between its facilities. This system also suffers from the potential compromise of the keys used to encrypt traffic if any employee were to sell, disclose, or lose a copy of them on laptop.

However this is a good start, and it does mean that the NSA or any other organization that looks to read data in transit must work harder to access your data if it’s encrypted. I think it’s such a good idea that I think we ought to start encrypting all traffic by default. LAN, WAN, whatever. We’ve had tremendous advances in hardware and I’d argue that most of us have more powerful hardware than we need. If we decided t take the hit to encrypt all traffic now, we’d become used to the overhead and we’d have better security overall.

I’d love to encrypt all data on disk, but I know people get nervous about losing data. A good start, however, would be to ensure all data in transit is protected.

Steve Jones

Video and Audio versions

Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.