Voice of the DBA

Tag: security

  • You Need to Manage Passwords

    I saw a note this week from CNet about a system built to crack passwords (also on ArsTechnica). It reminded me of the story of the guy that cracked Googles DKIM key at 512bits. Not insignificant, until you get to the point of renting that power from AWS for tens of dollars.

    Here’s a great comic on the subject of passwords: Password Strength. It’s got some good advice, but there’s more to it than just having a good strong password. You need to manage your passwords, as in you need to have lots of them.

    Doubt that? Here’s a good piece from Troy Hunt.

    You need a password manager. Whether you use 1Password, KeePass, or PasswordSafe (my choice), choose one and set the defaults to something long. I’ve been using 12characers, but I’ve moved to 16 for my passwords. All of these work cross platform, and you can sync your files between devices.

    One more thing: you need to rotate passwords. Not just on your password manager, but on your various sites. If someone gets a copy of your password manager file, then it’s just a matter of time before they can crack it. Within months, they could have all the passwords in your file if they were determined.

    Lots of passwords I’m not overly worried about, but some I am. Banks, mail, a few of my profiles, these are important to me, and so I rotate the password periodically on them, using new passwords from my manager.

    Security is hard, and passwords aren’t going away anytime soon. Tell your friends, family, and make sure they all consider using some type of password manager and improving their security.

  • Regulators, Mount Up

    Warren G - Regulate
    More auditing of regulation compliance is coming for data professionals working in health care.

    I have an encryption talk that I give and usually find a few people in the audience that have implemented encryption. In almost every case this has been because of PCI or HIPAA regulations that dramatically reduce penalties if data is encrypted. Whether you agree with the regulations or not isn’t important. There are rules that some of us have to follow because of our data and my guess is that the number and scope of those rules will increase in the future, not just in these industries, but others as well.

    If you are covered by HIPAA law, you may have gotten some increased scrutiny this year. There are audits underway from the Office of Civil Rights (OCR) for 115 organizations that will help them to ensure they comply with regulations. Penalties aren’t supposed to be assessed unless there are serious violations, but starting in 2013, the  Health Information Technology for Economic and Clinical Health (HITECH) Act requires that the auditing program will be enforced with surprise audits.

    For those managing health care data, you should be sure that you are complying with HIPAA regulations. If you’re not, you ought to make sure your boss is aware that next year you could have a surprise audit and should be ensuring that you meet the laws regulations. The OCR has released their audit protocol, and you should be sure that you understand what is being evaluated.

    If you aren’t regulated by PCI or HIPAA, you might still check over the protocol as much of it is good practice for securing any data. It can be general, but if you abide by the spirit of the criteria, I’d bet that will pass an audit by your security group.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • How Application Roles Work in SQL Server

    One very interesting security technique available in SQL Server is the application role. It’s an interesting way of applying security to a user, and perhaps a way of preventing users from accessing data with unauthorized applications.

    An application role is a role just like any other role. It has a default schema, and it can contain specific rights on securables. Below you can see I have an application role that has rights to a specific table in my database. In this case, at the bottom you can see this table has SELECT rights.

    approle2

    I could grant other rights, but in this case I haven’t.

    How is this different than a normal role? On the “General” page of this dialog, you can see something different.

    approle1

    In a normal (database) role, there are members on this page. Here we just have schemas and a password. This password is what gives you the power of this security feature.

    If I connect as a normal user to my database and issue a SELECT, I get this:

    approle3

    This user has no rights in this database for this table. However if I invoke the application role, I can select from the table.

    approle4

    Application roles are assigned to a user when the user executes sp_setapprole, with the role name and the appropriate password. Previous permissions are removed, and these permissions are granted.

    This can be very handy, as assigning a user rights to connect to an instance, but no rights in a database allows them to connect, but not perform any data manipulation. This means a user connecting from Access, Excel, etc. cannot work with data.

    If the user connects with an application that is configured to execute sp_setapprole after the connection, if there are rights for DML assigned to that application role, the user can perform the data manipulation needed for users.

    It’s not a perfect security mechanism, and it requires the password to be kept secret along with application programming, but it can be a good way to prevent users from working with your data outside of an application.

  • Locking Your Disk

    disk drive
    You should be protecting your disks with encryption.

    This editorial was originally published on Feb 28, 2008. It is being re-run as Steve is on holiday.

    With the tremendous growth in disk sizes and the trend towards more and more people using laptops, someone sent me a note about protecting that data that got me thinking. The SQL Server space has grown tremendously, and not just up. We have SQL Server Express and SQL Server Compact Edition, both of which are designed to run on smaller devices, with (supposedly) smaller data sets. However my phone has more storage than quite a few hard drives I’ve owned in my life and my new laptop rivals the storage in my 3 year old desktop.

    It seems that often that administrators don’t think about the data that gets moved off their servers and with new replication and ETL technologies, a significant amount of data might be duplicated on other instances of SQL Server away from your primary database.

    And your boss might be expecting that you’ve ensured its security.

    So this Friday, I had a poll to see who’s thinking about the issue.

    Do you use disk encryption?

    Or do you think it’s important? Should you be using it for your laptops?

    My laptops really just carry my writings, articles I’m editing, books, etc., and no financial information. I do have Password Safe on them with databases, and I suppose that someone could crack that if given enough time. However since I’m not carrying around data that involves other people, I haven’t worried about it.

    I used to have an encrypted disk when I worked for JD Edwards. At first I thought it was a pain, but after a month or so, it wasn’t a big deal. Except when I had booting issues one morning. Talk about being anxious for a few hours. Fortunately the manufacturer has included utilities and a help desk person was able to get my disk unencrypted and then re-encrypted again.

    Disk encryption is a good idea and it definitely protects accidentally releases of data. If you carry around client data, financial information, or identity information, I’d highly recommend you use some type of encryption to protect the data. However, as this article shows, that might not be enough.

    Steve Jones

    The Voice of the DBA Podcasts

    Everyday Jones

    The podcast feeds are now available at sqlservercentral.podshow.com to get better bandwidth and maybe a little more exposure :). Comments are definitely appreciated and wanted, and you can get feeds from there.

    Overall RSS Feed: or now on iTunes!

    Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

    I really appreciate and value feedback on the podcasts. Let us know what you like, don’t like, or even send in ideas for the show. If you’d like to comment, post something here. The boss will be sure to read it.