August 18, 2008 at 10:21 am
But if I can't read it, how can I verify my backups?
(I love playing devil's advocate and have no problem arguing multiple points of an issue)
In a multi-DBA shop, perhaps you could lock down the file system and make it write-only, making your senior DBA responsible for backup tests and restores. But in a single-DBA shop, you don't have that luxury and, as has been stated in previous columns and discussions about ethics, you're at the mercy of the ethics of the DBA.
I think MS could benefit from taking a more holistic look at security monitoring for all its products to better integrate some safeguards and logging. SQL Server only runs on Windows, each is a known quantity to the other. There's no reason why the server couldn't know who is a DBA/sysadmin and increase monitoring/reporting accordingly.
-----
[font="Arial"]Knowledge is of two kinds. We know a subject ourselves or we know where we can find information upon it. --Samuel Johnson[/font]
August 19, 2008 at 7:29 am
checksums
8 )
August 19, 2008 at 8:22 am
cyplesma (8/19/2008)
checksums8 )
Absolutely. I checksum both the data and the data structures before I do backups. But if you can't restore a backup because you don't have read permissions, then you can't recalculate the checksums and compare them to what's on file.
-----
[font="Arial"]Knowledge is of two kinds. We know a subject ourselves or we know where we can find information upon it. --Samuel Johnson[/font]
August 19, 2008 at 8:31 am
Perhaps we need to move you to half salary and hire a watcher for you, Wayne 😉
Good points, and there's not a good solution. I think bonding DBAs, having them incur some liability for misconduct is probably the only way to deal with this. It won't likely stop the hardcode criminal, but it should deter most people from the temptation to steal data.
August 19, 2008 at 8:48 am
A base slander, Mr. Jones, you shall be hearing from my seconds presently. Might I suggest paintball guns at PASS? 😀
But we come back full circle to Quis custodiet ipsos custodes? (Who Watches The Watchmen?)
I think bonding is a good idea, but I have no idea what the costs are for such, and if the employer pays the cost of the bond, then there is no disincentive to steal. If I'm coming off an extended period of unemployment, I might not be able to afford a bond to get the job. Licensing isn't viable as you'd have to have tough standard tests along the lines of what professional engineers have to pass before they design bridges. If I'm licensed and steal data and am convicted for it, I lose the license and won't be employable at that level again. Strong disincentive, but not really practical.
-----
[font="Arial"]Knowledge is of two kinds. We know a subject ourselves or we know where we can find information upon it. --Samuel Johnson[/font]
Viewing 5 posts - 31 through 34 (of 34 total)
You must be logged in to reply to this topic. Login to reply