Voice of the DBA

Tag: security

  • Don’t Use MD5

    “The hashing alone being MD5 tells me that they really don’t care about their passwords too much, so it’s probably some pre-generated site.”

    That was from this article on an Anatomy of a Hack. It’s an interesting quote, and it shows a few things.

    First, we have a history issue with our frameworks and the lack of updates as we learn more about a technology, or circumstances change. This could be that frameworks are not being updated. It could be that developers are not updating their frameworks. It could be that they are downloading the wrong versions.

    The bottom line is that older technologies, those that have vulnerabilities, are still being used. If you use encryption for passwords, don’t use MD5, and I’d say that SHA1 is a bad idea. If you are on a version of SQL Server prior to 2012, SHA2 is not available, but with the SQL CLR and SHA2 in .NET, you can write your own.

  • Lost in Space

    hammacher-lost-in-space-b9-robotToday’s editorial was originally published on Sept 2, 2008. It is being re-run as Steve is traveling today and out of the office.

    Well perhaps not lost in space, but according to this article, a number of US airports report over 600,000 laptops lost a year. Over 10,000 are lost each week at the 36 largest airports. That’s a lot of bits floating out there in the world. There’s some dispute as to these numbers in another article, so it’s hard to know who’s correct. I tend to think these numbers might be high.

    In any case, what might be even more amazing is that 65% of these laptops are not reclaimed. What’s scary is that 53% of people surveyed said confidential company information was on their laptop and 65% said no effort was taken to secure their data. I found this on Bruce Schneier’s blog, and he sees it as a huge dollar loss for the country if the numbers are correct.

    My wife travels quite a bit, 30-40,000 miles a year, and she’s not surprised by these numbers. She guesses that the main problem is that there is no good way to match a lost laptop with a traveler. Unless you lose it at your home airport, with a lack of staff and the time it might take for something to get your lost and found, it’s likely you would never be able to search for it.

    And how long would you search? After how many days would you just move on and file a claim and replace the laptop? I tend to carry my important data on a USB key (and likely will upload to some service for future travel), so I’d probably spend whatever time I had in the airport, or maybe a day here in Denver, but after that I’d be ordering a replacement and moving on.

    Information has a tremendous amount of value, but to many of us, the information also has a shelf life. We might move on quickly and just accept the losses as part of doing business. I understand that and agree with it for the most part.

    However I think we should all have some sort of encryption and protection for our data. You never know when you might have some letter to a bank you drafted with your account information, or something else. For most thieves, I’d guess that an encrypted laptop isn’t worth dealing with. They’d wipe it and move on.

    Steve Jones from SQLServerCentral.com

    » Join the debate, and respond to today’s editorial on the forums

    The Voice of the DBA Podcasts

    The podcast feeds are now available at sqlservercentral.mevio.com to get better bandwidth and maybe a little more exposure :). Comments are definitely appreciated and wanted, and you can get feeds from there.

    Overall RSS Feed: or now on iTunes!

  • Trust

    An interesting piece I found on Bruce Schneier’s blog that talks about security and trust, specifically with regards to the security of your passwords and hopefully, a password manager. There certainly are problems and potential issues with regards to security and passwords, no matter how you choose to manage those.
    However the part of the article that caught my eye was the opening, where it says “All these other industries we rely on have evolved codes of conduct, regulations, and ultimately laws to ensure minimum quality, reliability and trust. In this light, I find the modern technosphere’s complete disdain for obtaining and retaining trust baffling, arrogant and at times enraging.”
    Is that true? I know we find that there are more systems in place in pharmaceutical, construction, and other professions. These independent groups can provide some certification, evaluation, and standards for their members and practitioners.  I’m not sure how much more trust there is in these fields, and sometimes I think it’s just an illusion of more standards and practices. We find all sorts of moral, and professional failures in these businesses, though perhaps more accountability in the legal sense.
    Is it because these professions are more mature? Perhaps. In some sense, I think many of these fields benefit from the reality of their products and services. We can see, hear, feel, and touch the effects of decisions and actions in most fields. We can interact with our technological systems, but in many cases the complexity behind simple interactions is more like magic to most people that we’d care to admit.
    Plus we seem to be quite willing to build things that don’t work well, and then quickly change them to respond to issues. In some cases we might be more like the people that build quasi-useful products hawked on late night television than the engineers that construct bridges.
    Steve Jones

  • Honeywords in SQL Server

    honeypotAs we become more and more security conscious, it becomes more important not only to configure systems for better security, but also to add more monitoring and auditing to detect when problems occur. We know that at some point someone will attempt to hack our systems. Many of us have auditing set up to detect failed logins, but is that good enough?

    If a hacker manages to gain access to your password hashes, and it’s not a stretch these days to think that they might, wouldn’t you like to know if they manage to find the plain text that corresponds to the hash? There’s an idea that systems could be written to store multiple passwords for user accounts, but only one of which is valid. A separate system detects attempts to log in with the false passwords and alerts administrators to a hacking attempt.

    This is an interesting idea, and while it won’t solve all our problems, it will solve some. If a brute force attack occurs on an account, and multiple passwords are being tried, all of which are known to be false (the honeyword passwords), administrators can be notified, and warnings passed on to users. It doesn’t help if the hacker chooses the correct password to enter first, but with enough honeywords, you reduce the chances that they will.

    I don’t know that I’d like to see this for SQL Server, but I certainly would like to see additional security features. Two factor authentication would be nice, perhaps even some sort of  approval process enabled that required multiple approvals for some changes. The latter would help us prevent the cowboy DBA from making changes without anyone else being aware of them.

    Detection of breaches, using something like honeywords, provide another layer of security. They don’t prevent hacks, but they can help us deal with them.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.