|
| Featured Contents |
| Question of the Day |
|
| The Voice of the DBA |
Daily Coping Tip Free up time in your diary by cancelling any unnecessary plans I also have a thread at SQLServerCentral dealing with coping mechanisms and resources. Feel free to participate. For many of you out there working in a new way, I'm including a thought of the day on how to cope in this challenging time from The Action for Happiness Coping Calendar. My items will be on my blog, feel free to share yours. |
The Best Security for Database Administrators A short while ago, Twitter got hacked. I wrote about this, as did Denny Cherry. I think Denny's piece was more interesting, as he speculates about the security measures that Twitter may, or may not, have had in place. One of the things Denny brings up is air-gapping administrative machines. I've rarely seen this in organizations, and perhaps see this less and less in the pandemic world. There are some high security places that do this, but could your organization do this? How many of us use cloud or co-location facilities where we can't even physically enter the premises? I suppose we can use some strong network security controls, perhaps even requiring static IP addresses for people at home and specific routes for certain administrators. I do know some companies that do require specific laptops for access, with limited software, but this certainly isn't the norm. Too often a general laptop used for most work performs double duty as an administrative workstation with access to production data. Another thing Denny mentions is jump hosts, without any cut/copy/paste functionality from the remote machine to the host. This is something I am starting to see from customers, even smaller ones, as a way of limiting the chance or ransomware or some security breach. Multi-factor authentication gets an administrator onto a remote desktop session on a jump host, from which they can access production systems with limited tools. This certainly isn't perfect, and it is annoying for administrators, but it is a good security layer, and it forces organizations to use good, compliant, database DevOps practices to deploy changes. Perhaps the best part of Denny's article is the title of the last section: good security shouldn't be user friendly. It shouldn't be for administrators. While we might make things slightly easier for average users, anyone that can access bulk amounts of data, especially in a privileged fashion, should have strong security, which is a bit cumbersome. I think the hassles of strong security would be a good thing for more of us to have to deal with. Steve Jones - SSC Editor Join the debate, and respond to today's editorial on the forums |
|
| Featured Contents |
