Voice of the DBA

Tag: security

  • Cyberwar

    There are no shortage of books about cyberattacks and hackers. Some of these fictional stories even postulate that countries will build armies and engage in digital war with other countries. Some of this has come true, with the US and Israel attacking Iranian targets, suspected Chinese hackers targeting the US, and the announcement that Britain is building their own cyber army.

    While there are certainly no shortage of attacks made on corporations every day, how long before countries make determined efforts to disrupt their enemies’ economies with digital war? It’s a scary thought, and given the poor security habits of so many developers, it’s possible that many companies might find themselves struggling to conduct businesses while under attack. It might not be any different than if conventional weapons were being used near our facilities.

    The state of coding by so many “developers” today is somewhat scary. It’s not even old applications that are vulnerable to SQL Injection, but even new systems that have poor security practices being used that are vulnerable.

    I think that secure coding practices like these should be implemented by anyone writing software. I think examples, frameworks, and presentations about coding shouldn’t use simple passwords and bypass checks. Yes, it’s a pain for those that teach, but it also means that shoddy coding practices aren’t proliferated as people borrow your code and alter your examples.

    Security is a problem, but I think a lot of the issues would be minimized if we, as an industry and professionals, learned to write more secure code as a matter of habit, not as an additional feature to be added later.

    Steve Jones

    Video and Audio versions

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

    Follow Steve Jones on Twitter to find links and database related items and announcements.
    Steve Jones Windows Media Video ( 17.0MB) feed

    MP4 iPod Video ( 19.9MB) feed

    MP3 Audio ( 4.1MB) feed

    Feeds are available at iTunes and Mevio

    To submit an article, rant or editorial,
    log in to the Contribution Center

  • Encrypting T-SQL Code

    This editorial was originally published on April 10, 2009. It is being re-run as Steve is on vacation.

    I recently engaged in a discussion with someone that was building an application on SQL Server. This person had a bunch of SQL code that was being put in stored procedures and then being sent to client sites. The developers were worried about clients modifying their code and wanted to send “secure updates” to the client by encrypting the stored procedures and giving the clients the encrypted text.

    Apart from the hassles of getting this to work, I asked by would they bother. There are decryption routines available and this isn’t meant to be a secure way to hide your code. Heck, even application code can be decompiled, and if they’re likely to mess with the code, they likely have the skills to get the source.

    So for this Friday’s poll, I’m wondering about how you feel about encrypting code in SQL Server. I want to know what you think.

    Is there a point?

    Is there a reason to encrypt stored procedure code? After all, there are many, many vendors that sell applications built on SQL Server, with stored procedures.  Most of that code isn’t encrypted and it’s usually not a problem. Most customers don’t mess with the code and there are usually prohibitions written into support agreements.

    Personally I don’t think there are many great ideas, and likely very, very few in the database space, that are worth securing. Someone doesn’t buy a software package so the can learn how you wrote it. Most of them buy software because it solves a problem and saves them time. If you can deliver a well performing, and good looking application, no one cares about the code.

    But I’m curious what the rest of you think, both end users and software developers. Is there really a good reason to worry about encrypting your code?

    Steve Jones

    The Voice of the DBA Podcasts

    Everyday Jones

    The podcast feeds are available atsqlservercentral.mevio.com. Comments are definitely appreciated and wanted, and you can get feeds from there.

    You can also follow Steve Jones on Twitter:

    Overall RSS Feed:  or now on iTunes! 

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

  • Letting People Go Securely

    This editorial was originally published on Mar 15, 2009. It is being re-run as Steve is away on the 2013 SQL in the City tour.

    The world economy appears to be in shambles, with many companies cutting back in all facets of their business. We hear regularly in the US that people are being let go from their jobs as positions are trimmed and companies look to save money.

    When someone is let go, typically they are asked to leave the premises on the day. I’ve seen escorts that walked people out or watched them pack up. In some extreme cases I’ve seen people escorted out the door while another employer packed their things and brought them out. For IT workers, it’s a little different since they often have privileged access to systems. In addition to removing their personal belongings, having  an IT worker leave means that passwords and possibly accounts need to be changed to ensure that the company is safe.

    However when someone resigns and gives their two weeks’ notice, I often see that many people are expected to work their final two weeks, brain dump their knowledge to others, perform documentation, or even continue doing their job. In all of the positions I’ve resigned from I’ve worked out my time, even doing some last minute SQL Server development on a Friday afternoon, my final day of work, with plans to leave town the next morning for a new job.

    There was only one place that I worked with a different policy. In that company, if someone with above normal privileges, which included upper management and IT administrators, they were escorted out of the building immediately if they gave notice to terminate their employment. That surprised me, but I understood it. People were paid for their two weeks notice, but management didn’t want anyone to have access to company funds or systems if they planned on leaving. I saw an article recently that provides some justification for this, with a survey showing 59% of people leaving a company steal data.

    On the surface this makes sense, but does this help prevent data loss? I don’t think so. What happens is that employees that are likely to steal data will just take the data before they give their notice. You haven’t changed their behavior, but by not allowing them to work out their notice, you punish the remaining employees who have to suddenly pick up work from their ex-colleague.

    There isn’t a good way to protect data from employees that want to steal it. But you can put in place auditing, and smarter systems that allow monitoring and auditing of your systems. They won’t prevent issues, but hopefully they’ll allow you to detect and respond to them.

    Steve Jones

    The Voice of the DBA Podcasts

    Everyday Jones

    The podcast feeds are now available atsqlservercentral.mevio.comto get better bandwidth and maybe a little more exposure :). Comments are definitely appreciated and wanted, and you can get feeds from there.

    Overall RSS Feed:  or now on iTunes! 

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

    I really appreciate and value feedback on the podcasts. Let us know what you like, don’t like, or even send in ideas for the show. If you’d like to comment, post something here. The boss will be sure to read it.

  • IT Security

    IT security is a concern for many businesses. At least that’s what a survey at the recent Black Hat conference concluded. Most of the respondents couldn’t be sure that a foreign state-sponsored attack had not occurred in their networks. About half of the people were not confident that their staff could even detect an attacker. That’s a little scary as many of the people felt their systems might come under attack within the next year.

    Digital technology has changed the world in many ways, but one of the most amazing to me is how it has leveled the environment in which all of us can interact. No longer does communication, publication, research, even war require the resources of a country or even a large organization. In the cyber world an individual can make as much impact as a large entity. As with most things, this is a double edged sword, and I’m sure many of us will find that vandalism, as well as malicious attacks on our systems will increase in the future.

    However the threats, or perhaps the consequences, aren’t severe enough yet. Most companies allow shoddy code, vulnerable to SQL Injection, to pervade their internal (and sometimes external) applications. Security training is limited, and review of third party applications is extremely lax. The respondents at Black Hat are making efforts, but those are a self-selective group. Most organizations would never send an employee to Black Hat events or even monitor the trends and information published by groups like SANS.

    I do believe that security will become more and more of an issue. I suspect, however, that until businesses are liable, and decide to purchase insurance, we won’t see much change. Once insurance premiums start to depend on the level of security you implement, I suspect we’ll see the quality of application code increase.