Tag: security

I’m glad I have well water. Not that it protects me, but it provides some insulation in the event that the local water company’s systems were hacked and unclean water released. That hacking could happen, and the person in this piece speculates it is happening after a water authority honeypot attracted hackers from all over the world. It’s scary to think how the world may change when any individual, as well as any country, could attack our digital systems. It means security is more and more important all the time.

As I read the article, I looked for a positive in the experiment. Was there something to take away from this research? The thing I thought of was the way in which hacker traffic was drawn to this system. Not that hackers were not also investigating other systems, but if honeypots existed, perhaps in enough places, would the additional targets provide more security?

That’s an interesting idea. What if you had CRM/Sales/Inventory systems that were available for port scans, and hacks, but didn’t connect to banking systems and had test/dummy data? Would a few of these provide some security by luring hackers into spending their resources on these systems instead of real systems? What if you had 4 or 5 instances of SQL Server, probably Express, responding to port scans and providing a relatively easy target. You could monitor these systems, and perhaps be more prepared for real attacks when they occur.

I have long felt that we can’t completely eliminate threats and secure our systems from any unauthorized access. What might be worse is that we may not be able to separate real queries from fake ones. What we need is better monitoring and awareness of the traffic to our systems. Perhaps if we had honeypots that we could monitor, we would be able to draw some hacking traffic, identify users that were unauthorized and then use that information to better protect, or audit, our real systems.

Steve Jones

Video and Audio versions Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com. Follow Steve Jones on Twitter to find links and database related items and announcements. Windows Media Video ( 15.5MB)  MP4 iPod Video ( 18.3MB)  MP3 Audio ( 3.8MB)  Feeds are available at iTunes and Mevio To submit an article, rant or editorial, log in to the Contribution Center

Think your office is secure? You have guards during the day checking badges, you have key card systems to control and audit access and alarms set at night. You don’t worry if you have various system names or passwords scribbled on scratch paper. After all, who would target your office?

You never know. With the large number of people working in technology, there are bound to be a few people with less than prefect morals. The turnover of employees in technology can be high, and it might not be as easy to recognize an outsider as you think.  Even in companies that only have 50 or so employees, it’s easy to assume the person you see in the company is new hire, contractor, or other individual that has reason to be there.

Especially if that person gets into your locked server room because they’ve hacked the alarm or key card system. At the Black Hat conference, hackers demonstrated how they can get past many alarm systems and talked about their methods for cloning RFID cards by walking near someone. The fact that these technologies are available, relatively cheap, and can be implemented by people that have some knowledge of the systems means we have to be more careful than ever about the physical security of our systems.

Be aware of the authorized users that can physically access systems. Ensure that you don’t have passwords or other critical information easily available, and encrypt your systems. Even if someone breaks into your data center, they won’t want to spend a lot of time there. If someone can easily get information, or copy files, they will. Adding a few security hurdles to bypass might mean the difference between keeping control of your data and losing it.

Steve Jones

Video and Audio versions Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com. Follow Steve Jones on Twitter to find links and database related items and announcements. Windows Media Video ( 14.4MB)  MP4 iPod Video ( 17.5MB)  MP3 Audio ( 3.5MB)  Feeds are available at iTunes and Mevio To submit an article, rant or editorial, log in to the Contribution Center

I hope that SQL Injection becomes a disease of the past at some point in the future, one that is eradicated from the world except for very rare, isolated cases. However that’s not the state of the world now, and probably not what we’ll see anytime soon. I don’t often see large scale attacks, but I wasn’t surprised when a piece from Denny Cherry appeared recently.

What was disconcerting was the attack he referenced, which was automated and self-spreading, but injecting code into hacked sites that more and more users would end up with code that joins their system to a botnet.

What’s worse? Most virus detectors didn’t pick up the code.

What’s really, really bad? Bored hackers, criminals, or anyone else could get details of the exploit on the Internet and start searching for injected machines they could easily alter or take control of in their own creative way.

In Denny’s piece, he gives advice that’s easy to follow, and shouldn’t delay development time. Most developers could easily build templates to use when writing queries, or formatted the parameterized queries. Not doing so is laziness or ignorance, and it’s dangerous.

It’s 2013. I’d say that if you write code after today that’s susceptible to SQL Injection, you ought to be fired. Plenty of people would argue that if you’ve written code in the last couple of years you should be let go, but I’m offering amnesty. Go buy Denny’s book. Go read about secure coding. Learn how to write code that doesn’t make this kind of attack easy.

Steve Jones

Video and Audio versions Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com. Follow Steve Jones on Twitter to find links and database related items and announcements. Windows Media Video ( 14.6MB)  MP4 iPod Video ( 17.9MB)  MP3 Audio ( 3.6MB)  Feeds are available at iTunes and Mevio To submit an article, rant or editorial, log in to the Contribution Center