Tag: security

The Security of Interconnected Systems

It’s a scary world in the wild, wild west of the Internet. Many days I think that’s a closer metaphor to the World Wide Web than the relatively ordered Kensington High Street in London. There are lots of bad people out there that are scraping identities, hacking systems, copying data, and more on a daily basis. Indeed the power of computers means that these malicious behaviors can be done at a speed and on a scale never before seen in the world.

I ran across this account of a blackmailer stealing a Twitter name using a variety of hacks across interconnected systems. What’s worse than the attack against someone’s digital assets is that fact that so many of the companies on the Internet have no good way of recognizing ownership. It’s almost as it could be back in the gold rush days when you had to be vigilant and constantly inhabiting your property to protect the assets. At least in that time you could file a claim that would be honored. I’m not sure a Facebook name, a Twitter handle, a SQLServerCentral login, or any name on the Internet can actually be “registered” by most of us.

The problem isn’t so much the ownership of some digital asset as it is the potential cascade of problems when we can’t own an asset and possession of a username and password seem to be what matters. I’d like to think that corporate assets are better protected, and corporations are usually more able to take legal action against attackers, but it’s entirely possible they aren’t. Especially when many of the companies that provide services to both individuals and companies aren’t providing support. The “Google” method of building automated systems that provide support looks like “hope for the best and too bad if it’s the worst” from my perspective.

As we connect more and more systems together, whether through sign-on systems, automated feeds, or other methods, the ability to protect the entire system is dependent on the weakest link. The ability to resolve ownership and security issues, however, seems to have no protection at all.

Steve Jones

The Voice of the DBA Podcast

Listen to the MP3 Audio ( 2.5MB) podcast or subscribe to the feed at iTunes and Mevio .

The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

February 18, 2014

Encrypt Everything

Security is a problem with so many of our applications and systems. There are numerous ways that we handle access and protection of data, often with access rights or encryption (or both) being applied to data in order to limit who can access the data. However neither of these systems is perfect for a variety of reasons and no matter how we configure our security, it seems there are always issues.

Yahoo announced recently that they are trying to improve their security by encrypting all data that moves between their data centers. Other large internet companies do this, though not all. However, this doesn’t necessarily mean that your data is much more secure than it was before. This should make it more difficult to access data while it is transiting networks outside of Yahoo’s control, but there are still potential issues. Just as with TDE, any legitimate user inside a data center that has access to the LAN or systems inside the data center can still potentially read the data.

I’m not picking on Yahoo here as the same issues might exist with Microsoft, Google, or any service provider that encrypts data between its facilities. This system also suffers from the potential compromise of the keys used to encrypt traffic if any employee were to sell, disclose, or lose a copy of them on laptop.

However this is a good start, and it does mean that the NSA or any other organization that looks to read data in transit must work harder to access your data if it’s encrypted. I think it’s such a good idea that I think we ought to start encrypting all traffic by default. LAN, WAN, whatever. We’ve had tremendous advances in hardware and I’d argue that most of us have more powerful hardware than we need. If we decided t take the hit to encrypt all traffic now, we’d become used to the overhead and we’d have better security overall.

I’d love to encrypt all data on disk, but I know people get nervous about losing data. A good start, however, would be to ensure all data in transit is protected.

Steve Jones

Video and Audio versions

Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

Follow Steve Jones on Twitter to find links and database related items and announcements.

Windows Media Video ( 19.2MB)

MP4 iPod Video ( 22.4MB)

MP3 Audio ( 4.6MB)

Feeds are available at iTunes and Mevio

To submit an article, rant or editorial,
log in to the Contribution Center

December 16, 2013

PVPs

I had it happen to me. We had an SSL certificate for a website that one of my employers ran. I actually purchased the certificate, and it secured our communications for a couple years until one day it didn’t. The certificate expired and the website stopped accepting connections. If I had noticed, it might not have been a big deal. However when the owner of the company gets a call from one of his large customers, it’s an much bigger issue.

If you worked at Microsoft last year when their security certificate expired, it was an even bigger deal. It’s not that an affected customer that sends a note; it’s affected, unaffected, and potential customers that hear about the issue from the media. It seems like tracking private virtual properties (PVPs) ought to be easy, but it’s not. As pointed out in this piece, there are a number of issues at an organizational level, and while there are fixes, it takes some effort.

In many businesses that have periodic activities required for physical assets, there are often people dedicated to tracking, or performing the activity. Mechanics know about maintenance on vehicles, accountants renew leases, workers replace equipment nearing the end of service. Often the time lines and activities involved are understood, and individuals understand their responsibilities.

This showcases another area in which technology is woefully immature. Need a certificate? It takes a person with specialized knowledge to understand what’s needed, purchase it, and install it. This person either then moves on to a new role without leaving instructions behind, or isn’t well equipped to understand the need to track the expiration and replacement of the technical item. There often isn’t even a system set up to handle replacements of these items, which might be superseded or replaced by some entirely new type of technical wizardry.

Managing and tracking PVPs is hard, and I suspect, going to get harder. Security requirements increase, technical requirements grow, and specifications change. I’d like to say I’m confident Azure (or AWS or another large service) will never have another outage because of this, but I wouldn’t be surprised if they do.

Steve Jones

Video and Audio versions

Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

Follow Steve Jones on Twitter to find links and database related items and announcements.

Windows Media Video ( 20.5MB)

MP4 iPod Video ( 23.9MB)

MP3 Audio ( 4.9MB)

Feeds are available at iTunes and Mevio

To submit an article, rant or editorial,
log in to the Contribution Center

December 12, 2013

The Future of Auditing

I was reading Captain’s Share the other day and enjoying a quiet afternoon at home. It’s a science fiction book about one man’s journey in the future as a captain of a space freighter. It’s an interesting series from Nathan Lowell that I’ve enjoyed and recommended to other science fiction fans. In the book, there’s a scene where the main character is leaving his old ship as first mate and moving to a new ship as the captain. However he notes that the formal process is to deactivate his records on the old ship and ensuring they will be read only forever. The book notes they can’t be deleted because they are a part of the ship’s records, log entries, etc.

That seems to be a far cry from the way auditing takes place in current computer systems. Auditing of systems is under the control of the sysadmins (who are sometimes hackers) and can be altered, changed, etc. We, as software designers, haven’t done a good job of ensuring the integrity and longevity of log records. In some sense, it seems to be a fundamental flaw in OS and software design to not have separated out the auditing and recording of actions from the administration and rights of the rest of the system.

I’d hope that we would recognize that auditing actions and preserving this data is something that ought to be tightly linked to, but separate from, the rest of system operation. I’d like to think that fundamental changes and actions taken on the system should be written separately to an area that is easily marked as readable by non-sysadmins that are designated to review the information. I know we have the challenges of managing the space and the problems of spurious actions being generated to fill (or rollover) logs, but I’d think after 50+ years of computing we would have considered some sort of event log that isn’t under the control of the people whose actions it is recording.

SQL Server has improved its auditing features and capabilities, but far too much is still linked invariably to the sysadmin, often the same person the auditing should be watching. This is certainly one area that I hope matures in future versions as the need grows to track and review actions taken by privileged accounts.

Steve Jones

Video and Audio versions

Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

Follow Steve Jones on Twitter to find links and database related items and announcements.

Windows Media Video ( 19.5MB)

MP4 iPod Video ( 23.7MB)

MP3 Audio ( 4.6MB)

Feeds are available at iTunes and Mevio

To submit an article, rant or editorial,
log in to the Contribution Center

December 5, 2013