Voice of the DBA

Tag: security

  • Who’s Got Your Data?

    enigmaThe headlines lately have been filled with the plight of Edward Snowden, along with his disclosures on how the US National Security Administration (NSA) has been gathering, cataloging, and examining all sorts of data about people in the world. It’s not just terrorists, criminals, or anyone suspected of illicit activities, but also many ordinary people that may not feel they should have been subjected to this level of surveillance. Whether you think this was a proper way to disclose this information or not, there’s a separate issue here.

    We are producing a tremendous amount of data about ourselves all the time. There are so many ways in which companies can gather data points about us, often with logging activity that we might not find intrusive. Our houses produce logs of electrical activity along with the various types of services we might use (water, trash, etc.). We use cell phones, whose locations and usage are recorded, and we often use on line services for mail, research, entertainment, and more that all produce logs of our activities. Purchases on line are stored, and purchases off line might be stored if you use any type of loyalty card. I can imagine it not being long before any card purchase can be linked to the actual items themselves, regardless of whether you want this to occur.

    We can add in any services we use that store data in the cloud, from physical activity to medical information to even your location from status updates. While much of this data is stored separately, and not necessarily aggregated, that might not be the case in the future. The government could potentially request this data, which is unnerving to me, but what is more disconcerting is the idea that businesses might engage in complex deals to share much, or all, of your data without you knowing about it. This could be under the guise of providing better services, which makes sense, but that’s not what concerns me.

    What concerns me is the lack of care that so many companies take with our data. It’s lots constantly, and the more data that might be shared between companies, and need to be transformed and loaded into new data warehouses, the more people that will touch this data. And the more developers that will have copies of it on their laptops as they build new applications. It’s scary to think about the lack of control we have, and now many mistakes will be made in the future.

    I wish I had a good suggestion on how to improve the situation, but I don’t. However I do think disk encryption, for all machines that touch data, is a good place to start.

    Steve Jones

  • More Data Security Issues

    Employee issues are a big problem for IT security.
    Employee issues are a big problem for IT security.

    Insiders and human frailty are still a big problem in data security, according to a new study from Symmatec. Along with system issues these account for two thirds of data breaches. I suspect system issues means misconfiguration and poorly written code (from a security standpoint), though I can’t be sure there aren’t other factors that contribute. What’s disconcerting is that employee behavior problems seem to be rising.

    I think this is partly the result of attitudes and a lack of loyalty and respect from many companies towards their employees. It seems that job dissatisfaction is on the rise, and coupled with a lack of employment security, this makes it easy for some people to ignore regulations, not bother securing their systems, or even copy internal data themselves.

    I don’t know how we change the insider problems without fundamental employer/employee cultural changes. I’m not confident those will change in the short term, and I suspect next year’s report might look similar to this one. I do know, however, that we can each to a better job by learning more about secure coding, secure installation, and encryption. Many of these topics aren’t that hard to understand or even implement, but they do require some practice to build habits and become comfortable with the technologies and processes.

    Security is looking like a constant challenge for those of us working with technology for the foreseeable future. Learning more about how it works, and building the habits to implement it smoothly, in all our systems, or the challenge we should take on for ourselves.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • Don’t Use MD5

    “The hashing alone being MD5 tells me that they really don’t care about their passwords too much, so it’s probably some pre-generated site.”

    That was from this article on an Anatomy of a Hack. It’s an interesting quote, and it shows a few things.

    First, we have a history issue with our frameworks and the lack of updates as we learn more about a technology, or circumstances change. This could be that frameworks are not being updated. It could be that developers are not updating their frameworks. It could be that they are downloading the wrong versions.

    The bottom line is that older technologies, those that have vulnerabilities, are still being used. If you use encryption for passwords, don’t use MD5, and I’d say that SHA1 is a bad idea. If you are on a version of SQL Server prior to 2012, SHA2 is not available, but with the SQL CLR and SHA2 in .NET, you can write your own.

  • Lost in Space

    hammacher-lost-in-space-b9-robotToday’s editorial was originally published on Sept 2, 2008. It is being re-run as Steve is traveling today and out of the office.

    Well perhaps not lost in space, but according to this article, a number of US airports report over 600,000 laptops lost a year. Over 10,000 are lost each week at the 36 largest airports. That’s a lot of bits floating out there in the world. There’s some dispute as to these numbers in another article, so it’s hard to know who’s correct. I tend to think these numbers might be high.

    In any case, what might be even more amazing is that 65% of these laptops are not reclaimed. What’s scary is that 53% of people surveyed said confidential company information was on their laptop and 65% said no effort was taken to secure their data. I found this on Bruce Schneier’s blog, and he sees it as a huge dollar loss for the country if the numbers are correct.

    My wife travels quite a bit, 30-40,000 miles a year, and she’s not surprised by these numbers. She guesses that the main problem is that there is no good way to match a lost laptop with a traveler. Unless you lose it at your home airport, with a lack of staff and the time it might take for something to get your lost and found, it’s likely you would never be able to search for it.

    And how long would you search? After how many days would you just move on and file a claim and replace the laptop? I tend to carry my important data on a USB key (and likely will upload to some service for future travel), so I’d probably spend whatever time I had in the airport, or maybe a day here in Denver, but after that I’d be ordering a replacement and moving on.

    Information has a tremendous amount of value, but to many of us, the information also has a shelf life. We might move on quickly and just accept the losses as part of doing business. I understand that and agree with it for the most part.

    However I think we should all have some sort of encryption and protection for our data. You never know when you might have some letter to a bank you drafted with your account information, or something else. For most thieves, I’d guess that an encrypted laptop isn’t worth dealing with. They’d wipe it and move on.

    Steve Jones from SQLServerCentral.com

    » Join the debate, and respond to today’s editorial on the forums

    The Voice of the DBA Podcasts

    The podcast feeds are now available at sqlservercentral.mevio.com to get better bandwidth and maybe a little more exposure :). Comments are definitely appreciated and wanted, and you can get feeds from there.

    Overall RSS Feed: or now on iTunes!