Voice of the DBA

Tag: security

  • Fix Your Code

    If you have an ASP.NET site, you might want to double check how the data access is coded. No matter whether you’ve enabled TDE, column level encryption, have strong firewalls or anything else, if you are vulnerable to SQL Injection, someone will get through.

    Perhaps just for fun. Another massive attack took place recently. These attacks will get more automated, and if you are on a well known platform, then you might be vulnerable. Even if you are on custom software, it’s entirely possible a disgruntled employee or a kid engaging in vandalism might attack your site.

    It’s not hard to stop SQL Injection. You just need to learn how and code securely.

  • Data Farming

    This editorial was originally published on Oct 13, 2008. It is being re-run as Steve is out today, traveling to a SQL in the City event and SQL Saturday in Sacramento.

    It’s a fictional story, or at least I hope it is, but Bruce Schneier has a great piece on Identity Farming, a long term way to create false identities that would fit great in the spy world. Mr. Schneier doesn’t see a practical point in doing it, but it’s interesting from a data standpoint because he brings up a point. This could be done without a real person existing to back up all the data that’s created.

    The part that strikes me from this piece is that all too often we make assumptions about the people or entities that created all the data we use. One bad foreign key, orphaned child row, or incorrectly transformed piece of data could snowball downhill at a tremendous rate and it might be hard to determine what is wrong.

    The blog entry talks about our data shadows, which grow larger and larger all the time. Unless you are actively trying to limit yours, every day that are likely new entries in some database about your life. And more and more, various companies and institutions interact with our data shadows instead of us. Credit checks, marketing efforts, when we board an airplane or make a purchase, all of these require checks on the shadow of data in our lives, not necessarily ensuring that the shadow is tightly linked to each of us.

    I’ve had more than my share of confusion because of my name; it’s common, in almost every database, and shared by thousands, if not millions of people. On on hand it means that I’m a little lost in the flood of “Steve Joneses” out there. On the other hand it makes it hard to correct mistakes. If there are 6 people with the same name and you have an orphaned record, who do you link it to? Do you guess? Infer it from the other data? I’d like to think you need to somehow research this, contact me, and make a note that the quality of this data could be suspect.

    People working with information try to be accurate, but they get busy, and mistakes occur. I’m sure I’ll find more and more over time, and I don’t have a great solution for what might work better. I’d like to think that we would implement better checks for data quality, fuzzy searches, and somehow assign “risk” values to data. Something to let people know that there might have been some issue.

    It’s a thorny problem, one that’s not going away, and likely to become more problematic in the future.

    Steve Jones

    Video and Audio versions

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

    Follow Steve Jones on Twitter to find links and database related items and announcements.
    Steve Jones Windows Media Video ( 34.9MB) feed

    MP4 iPod Video ( 30.1MB) feed

    MP3 Audio ( 5.8MB) feed

    Feeds are available at iTunes and Mevio

    To submit an article, rant or editorial,
    log in to the Contribution Center

  • Password Ninjas

    For the time being, passwords are the way that we authenticate users and secure most of our systems. There might be a better system in the future, but for now everyone needs to manage a series of logins and passwords, even if you have authentication for many systems linked through an internal domain or external system, like OpenID.

    I think password managers are almost required these days to manage passwords for most people. I recently ran across an article on ArsTechnica where five security experts were asked how they manage their complex passwords across a multitude of services. Four of these experts use password managers of some sort, though there is quite a variety of them. One actually remembers passwords, though he tries to use proximity tokens and one time passwords when possible.

    Bruce Schneier, one of the security writers I’ve followed for a long time uses Password Safe, which is what I use. However he also likes to use his own advice of long sentences turned into passwords and keeping backups of passwords on physical paper. I don’t like writing down passwords, but if you can keep the paper secure (not stuck on a monitor or under a keyboard), it’s an easy solution to use.

    There are various ports on different operating systems and different methods to keep your files in sync, if you choose to do so. Two others use competing products (1Password and KeePass), but one uses a text file in an encrypted virtual disk image that he keeps on a USB key. I’m not sure I like that, but with proper backups, it’s not a bad solution.

    There is a variety of advice, but overall there’s one thing to keep in mind: security is serious business. All the more so as we use various services more and more to conduct business in our daily lives. Losing a password that you share across multiple services could severely compromise your life. Whatever method you choose, stick to it and be careful in choosing your passwords.

    Steve Jones

    Video and Audio versions

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

    Follow Steve Jones on Twitter to find links and database related items and announcements.
    Steve Jones Windows Media Video ( 14.5MB) feed

    MP4 iPod Video ( 20.2MB) feed

    MP3 Audio ( 3.6MB) feed

    Feeds are available at iTunes and Mevio

    To submit an article, rant or editorial,
    log in to the Contribution Center

  • Hack Resistant

    Security should be on the forefront of every data professionals’ mind. It doesn’t matter if you are developer, administrator, or other position, you ought to be considering the security implications of changes you make to the database. More and more data is being stored in databases, and often it’s moved between databases as well. Whether that’s to data warehouses, or development environments, we ought to be considering security to be more a part of our daily work and process rather than something limited to specific systems.
    Vendors are trying to make systems more secure. I see the encryption capabilities grow with each version of SQL Server, and new features have been added, like TDE, to help technology professionals secure their data. Other vendors have introduced other safety mechanisms, and one caught my eye by claiming to be “hack resistant“. It’s the ZenithVault database says it is practically impossible for hackers to gain access to storage systems and steal confidential information. It supposedly does this by “data splitting”, moving parts of data onto separate servers.
    It sounds like a good solution, in the same way that TDE is a good solution. If someone is able to access your physical files, they won’t be able to read the data in them. That’s a good precaution, and it works well in TDE’s case (I can’t speak for ZenithVault), but it’s also not hack resistant.
    The biggest hacking problem that I see in the world today is with SQL Injection. Since legitimate accounts can access your database, often through web-based front ends, and SQL Injection uses these same accounts to access data, none of the encryption and security capabilities you set up protect you. None of these items come into play when you have code that allows hackers to inject their own commands through your existing application, web based or not.
    Secure coding is important, and it’s something that we should all require and practice as we build software. Your application might not access secure data today, but that might change in the future.
    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.