Voice of the DBA

Tag: security

  • Who’s Responsible

    This is really scary. Someone being sued for downloading a porn movie illegally. I have nothing against porn, and I certainly think that downloading stuff that’s a copyright violation shouldn’t be mainstream as in Amazon giving away movies for free without compensating owners of the copyrights.

    Setting that aside, there’s something fundamentally disturbing about our computing devices, which are assumed to be under our control, but may not be, even when they are.

    I need to write more, but as a quick analogy, if I’m using my car, no one else can use it. At least not without me being somewhat aware of the actions. Someone could hide contraband in my trunk, where I rarely look, but they’re not going to get it transported anywhere I’m not going.

    Contrast that with your computer. You could be infected with a virus (as an all-encompassing term for rouge processes) that could potentially be downloading (or uploading) something you don’t expect, including copyrighted content, or even attacking other computers (for example, as part of a DDOS botnet). It could do this while you were working on a flyer for your kid’s birthday party in Word, or checking your email.

    Is that your fault? If you use an A/V program? If your kids hit a site returned in a Google search that installed malware? If you bought a piece of software that had it embedded? I’m not avoiding responsibility here, but it’s a thorny issue as to who’s at fault, and more importantly, to what extent do we expect people to be aware of what’s happening?

    Tough times ahead if we don’t get a handle on security and digital laws.

  • Password Resets

    I read this piece from Troy Hunt, which is a long look at the password reset process for a web application. It’s one of the first that I’ve seen which talks about the different implementations, along with the pitfalls and advantages of each.

    It’s a great look at passwords, and there are definitely a few things in there I think should be built into authentication frameworks. I know we need to change a few things at SQLServerCentral and I’ve added them to the list.

    Pass this one along to your developers. They should be aware of this stuff.

  • Performance Data

    monitoring in the cloud
    Are you worried about security for your performance metrics?

    A good DBA is monitoring their system, looking for problems on a regular basis. The best DBAs are pro-actively heading off future issues by tuning or adding resources to their systems before a problem surfaces. It seems, however, that it’s the rare DBA that is really on top of their environment all the time, examining performance metrics to look for indications of any abnormality. I guess the best DBAs have routines that look for deviations from baselines, alerting them of potential issues.

    SQL Server has grown over the years to add new features that make the administrator’s job easier. The addition of SQL Agent and its alerting capabilities have helped for a long time, and in recent versions we’ve gotten eventing as well as the development of tools like the Policy Based Management (PBM) framework to allow the instance to do work for the administrator.

    More recently we’ve seen Project Atlanta at Microsoft became the System Center Advisor. This is service that uploads metrics from your instances for evaluation by specialists, and presumably some expert systems, at Microsoft. I don’t know how well it works or how effective people feel it is, but it’s an interesting idea. Ignoring the effectiveness of the service for now, I’m wondering about something related this Friday.

    Do you feel your performance metrics need to be secured?

    I’m wondering how you would classify the data from System Monitor, from alerts, events, PBM, and more. Does it require a high level of security for your organization? Are you concerned about contracting with someone to analyze the data and report back to you about things that might improve performance? Many people contract with consultants like SQLskills for Health Checks, but that’s at an individual level.

    Let me know this Friday how you feel.

    Steve Jones

    If you’re interested in trying out a hosted monitoring service, sign up for updates on the new SQL Monitor SaaS Edition.

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • Security is Improving

    multiple locks
    Increasing security isn’t this easy in the digital world.

    I have written many times that we need to improve the security of our systems. We should be adhering to best practices, and limiting access where we can, and most of all, forcing all developers and DBAs to write better code that limits the security vulnerabilities, especially for SQL injection. Apparently we are getting better, according to a recent White Hat survey, which found a dramatic decline in the vulnerabilities that are on the sites they monitor. There are still issues, but fewer of them.

    I think that the increased press and attention given to attacks, as well as the focused efforts of hackers are forcing companies to pay more attention to security. I hope this translates into more testing, better training and more careful deployments rather than the haphazard, slap-dash approach that many companies have taken. It’s great that companies can change their look and feel, adding new features and flashy images, but they need to include secure coding efforts and careful review along with everything else.

    Personally, I’d like to believe that developers are getting better about coding in a secure manner, using the patterns and practices that will limit SQL injection or other vulnerabilities. They see the headlines and are spending time working on their coding skills, particularly in the security area. I hope that’s the case, and that we are maturing our industry into one that is making fewer and fewer mistakes as we build new applications.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.