Voice of the DBA

Tag: security

  • Performance Data

    monitoring in the cloud
    Are you worried about security for your performance metrics?

    A good DBA is monitoring their system, looking for problems on a regular basis. The best DBAs are pro-actively heading off future issues by tuning or adding resources to their systems before a problem surfaces. It seems, however, that it’s the rare DBA that is really on top of their environment all the time, examining performance metrics to look for indications of any abnormality. I guess the best DBAs have routines that look for deviations from baselines, alerting them of potential issues.

    SQL Server has grown over the years to add new features that make the administrator’s job easier. The addition of SQL Agent and its alerting capabilities have helped for a long time, and in recent versions we’ve gotten eventing as well as the development of tools like the Policy Based Management (PBM) framework to allow the instance to do work for the administrator.

    More recently we’ve seen Project Atlanta at Microsoft became the System Center Advisor. This is service that uploads metrics from your instances for evaluation by specialists, and presumably some expert systems, at Microsoft. I don’t know how well it works or how effective people feel it is, but it’s an interesting idea. Ignoring the effectiveness of the service for now, I’m wondering about something related this Friday.

    Do you feel your performance metrics need to be secured?

    I’m wondering how you would classify the data from System Monitor, from alerts, events, PBM, and more. Does it require a high level of security for your organization? Are you concerned about contracting with someone to analyze the data and report back to you about things that might improve performance? Many people contract with consultants like SQLskills for Health Checks, but that’s at an individual level.

    Let me know this Friday how you feel.

    Steve Jones

    If you’re interested in trying out a hosted monitoring service, sign up for updates on the new SQL Monitor SaaS Edition.

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • Security is Improving

    multiple locks
    Increasing security isn’t this easy in the digital world.

    I have written many times that we need to improve the security of our systems. We should be adhering to best practices, and limiting access where we can, and most of all, forcing all developers and DBAs to write better code that limits the security vulnerabilities, especially for SQL injection. Apparently we are getting better, according to a recent White Hat survey, which found a dramatic decline in the vulnerabilities that are on the sites they monitor. There are still issues, but fewer of them.

    I think that the increased press and attention given to attacks, as well as the focused efforts of hackers are forcing companies to pay more attention to security. I hope this translates into more testing, better training and more careful deployments rather than the haphazard, slap-dash approach that many companies have taken. It’s great that companies can change their look and feel, adding new features and flashy images, but they need to include secure coding efforts and careful review along with everything else.

    Personally, I’d like to believe that developers are getting better about coding in a secure manner, using the patterns and practices that will limit SQL injection or other vulnerabilities. They see the headlines and are spending time working on their coding skills, particularly in the security area. I hope that’s the case, and that we are maturing our industry into one that is making fewer and fewer mistakes as we build new applications.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • Security and Honesty

    Ladder of Disclosure
    I really think we need better disclosure on security issues.

    Information is power. That’s been a saying I’ve lived by as a data professional for years. That has guided me to capture additional data in applications, often data business users did not think was important initially. The power of information led me to monitor my servers, and proactively look for ways to improve performance. Using resources like SQLServerCentral allowed me to learn about what others were doing, what worked, and what didn’t. The dissemination of information has helped me to have a successful career as a DBA.

    When I see articles like this one, where companies are not disclosing the security issues they face, I worry that our industry is not advancing as quickly as it can. It’s important for us to share technical challenges and solutions among as many people as possible in technology. Our systems are complex, the sheer number of technologies is overwhelming for any one person or even company. The vulnerabilities, bugs, and attacks outweigh the technologies by far, yet our employers so often do not want to disclose any issues for fear of bad publicity.

    It’s time that this was required. Every company gets attacked, and probably most get hacked in some way. Rather than prevent that they are invulnerable, make the information public, or at least public to other IT workers. It doesn’t have to be a press release from your company, but companies should be required to disclose the problems they’ve had, the vulnerabilities they faced, and the mitigation measures. I don’t want to invite attacks, but I also think that we are building more and more poorly developer applications on top of poorly architected foundations.

    Within a reasonable time, companies ought to be forced to disclose the issues. They don’t have to fix them, but the disclosure might just encourage them to spend a little more time ensuring that their infrastructure is protected.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.

  • Password Help

    Keepass Logo
    Use Keepass, Password Safe, or some other password manager.

    In case you haven’t heard, LinkedIn passwords were hacked and posted online. If you haven’t changed your LinkedIn password since the attack, please stop reading and go do it now.

    In reading about the attack, I sent a few friends a note as well to remind them that not only should they change their passwords, but that they should not be using the same password in multiple places. With more and more services intertwined, and more logins needed, it’s no stretch to think that someone that manages to crack your password, or steal it, from one service might use it on another service. Especially banking services.

    As data professionals, it’s easy for us to preach to non-technical people the value of strong passwords, but it can be hard to get them to use them. Strong passwords are problematic for many people to remember and type, and we find that most people prefer the path of least resistance: one short password that’s easy to remember.

    This article talks about a few things that IT people can do to help educate others and make it easier for them to consider strong passwords. Inside of a company, we can try to implement more services and products that secure our systems, but if people continue to use the same password for their personal mail or favorite website, much of that might not matter.

    Ultimately I think the best thing we can do is set a good example, and choose strong passwords stored in a password manager. Once people see that it’s relatively easy to secure passwords with something like KeePass or Password Safe, they may give it a try. That may help keep our data just a little more secure.

    Steve Jones

    The Voice of the DBA Podcasts

    We publish three versions of the podcast each day for you to enjoy.