November 28, 2012 at 3:36 pm
TravisDBA (11/28/2012)
It's not just unencrypted data that auditors ding you on nowadays. Wearing many hats at once and doing things outside your job description can definitely get you dinged as well. SarBox standards are very picky on this nowadays..For example, we had an IT guy once caught moving furniture around in his cube and the auditors jumped all over that with managment and the man was reprimanded over it. Not in his job description, don't do it again. If you are a little shop you can still get away with a "Jack-of-all-trades" guy (I don't know for how long though), but that is no longer permitted at most larger shops or government agencies that fall under the strict auditing standards of today. Heck, the auditors dinged us for having our production clusters on the second node, left there after a failover!!!!! Picky, picky...:-D
My impression is that most "auditors" have no idea what they are doing, and just make things up like "no moving furniture if it isn't in your job description".
November 28, 2012 at 4:16 pm
John Hanrahan (11/28/2012)[hr:-D]I have been through several SOX audits and have never heard of that. I would have have said stick it, see the job description says "and other duties as requir:-Ded" which I think is in every single job description I have seen for years. The whole point of SOX is to document what you do and how you do it an:-DWwwd make sure everyone knows (including shareholders and regulators). It has always seemed overblown to me. Next they'll say you can't get up to get water to quench your thirst because you have to operate the water fountain.
Have you ever worked for the government lately?
"Technology is a weird thing. It brings you great gifts with one hand, and it stabs you in the back with the other. ...:-D"
November 28, 2012 at 4:31 pm
David.Poole (11/28/2012)
Regulation is a cloud that can have a bright silver lining.Lets suppose that you have old systems ridden with tech debt and propped up by manual processes.
Those powers that be are so used to the situation that the idea that the tech debt or the manual processes are a problem just doesn't register. They are chasing the new shiny ball.
All of a sudden regulation comes along and lifts up the rock and shines a bright light underneath it and reveals the superating horrors squirming underneath!
Too many people have too much access to too much data almost certainly meaning a failed regulatory audit.
All of a sudden you have the impetus and support to fix a load of old problems and simplify the way your systems work. Do this well and not only will you pass regulatory inspection but you will also demonstrate the art of the possible, how good things could be if the prime focus was delivering something maintainable, scalable, flexible.
+1000
I just went through a post where the OP (a DBA) was feeling a bit hog-tied because the company required even him to do "change controls" for most things. I told him to revel in the process and that they hopefully have a ticketing system where he can enter what he does. It's a rare opportunity for his chain of command to actually find out what the hell a DBA does all day and to be able to "brag" about it without seeming like a "brown noser".
For those of you reeling from the idea, it takes only a minute or two to open a ticket, get permission to proceed, and close the ticket leaving a trail of undisolvable breadcrumbs that will come in mighty handy at review time. 😉
--Jeff Moden
November 28, 2012 at 4:34 pm
Michael Valentine Jones (11/28/2012)
TravisDBA (11/28/2012)
It's not just unencrypted data that auditors ding you on nowadays. Wearing many hats at once and doing things outside your job description can definitely get you dinged as well. SarBox standards are very picky on this nowadays..For example, we had an IT guy once caught moving furniture around in his cube and the auditors jumped all over that with managment and the man was reprimanded over it. Not in his job description, don't do it again. If you are a little shop you can still get away with a "Jack-of-all-trades" guy (I don't know for how long though), but that is no longer permitted at most larger shops or government agencies that fall under the strict auditing standards of today. Heck, the auditors dinged us for having our production clusters on the second node, left there after a failover!!!!! Picky, picky...:-DMy impression is that most "auditors" have no idea what they are doing, and just make things up like "no moving furniture if it isn't in your job description".
I can't help moving furniture. I'm old and it just happens every time I have a bout with gas. 😛
--Jeff Moden
November 28, 2012 at 4:37 pm
It has been 15 years since I have gotten a gov contract. I suppose you are going to tell me it is really that bad. 😀
November 28, 2012 at 4:37 pm
David.Poole (11/28/2012)
Its amazing what happens if you wave the possiblity of nuking old dead systems in front of a DBA. Their wrinkles vanish, an unfamiliar expression (happy smile) crosses there face and they hit keys faster than a teenager in a Halo death match.I suspect I may have started something here!
Uh huh.... right up 'till the point where we find that they're not actually going to nuke the legacy system and that the rewrite is going to be done by a known 3rd party the wrote the first shedload of hooie. That's when you add the 4th band to your pork chop launcher. 😉
--Jeff Moden
November 28, 2012 at 4:41 pm
I worked for a stock trading firm pre-SOX and I thought it odd when the compliance officer opened mail addressed to me. Those were the easy days and since then I've been on the vendor side of public companies in banking and insurance. In this way I've had it easy with the exception of hosted servers in-house. One such client still allows xp_cmdshell. I know, I know but it is important to note that while encryption and such is certainly important, it is equally important that nothing breaks thru the "gates" to get the data. You can't place all the burden on a DBA.
Everyone needs sixteen in the clip and one in the hole when it comes to security.
Cheers
November 29, 2012 at 8:50 am
Jeff Moden (11/28/2012)
I can't help moving furniture. I'm old and it just happens every time I have a bout with gas. 😛
I know a story about a lady who was in a cafe reading a book and listening to music when she realised she needed to pass gas. Not wanting the embarrassment of being caught and knowing the piece of music she decided to wait for the Crescendo before letting go a real knicker ripper.
On seeing the shocked look on the other customers faces she suddenly realised that she had been listening to her iPod.:w00t:
November 29, 2012 at 9:28 am
I have no IPod, do not kick the old or take candy from babies, but I do encrypt data. Not all data but that in the sensitive class of data. It is not hard to do, it is easy to decrypt and salting with an appropriate key is not that hard either. When needed it is done. Real simple. The cost is not that much if you standardize on how the data is encrypted. A developer can write a service to both encrypts and decrypt without a lot of pain. And by passing a code you can do one of many types of encryption and/or hashing.Then once done you have the vehicle ready and all you need to do is standardize your approach and start using.
Also I appreciate your comment Steve, just because you encrypt you are not immune to other hacks or attacks. Believing that if you hash or encrypt you do not need other precautions is like believing that if you wear a hat your feet will not get wet. It is odd how we convince ourselves otherwise.
M.
Not all gray hairs are Dinosaurs!
November 29, 2012 at 12:45 pm
Miles Neale (11/29/2012)
I have no IPod, do not kick the old or take candy from babies, but I do encrypt data. Not all data but that in the sensitive class of data. It is not hard to do, it is easy to decrypt and salting with an appropriate key is not that hard either. When needed it is done. Real simple. The cost is not that much if you standardize on how the data is encrypted. A developer can write a service to both encrypts and decrypt without a lot of pain. And by passing a code you can do one of many types of encryption and/or hashing.Then once done you have the vehicle ready and all you need to do is standardize your approach and start using.Also I appreciate your comment Steve, just because you encrypt you are not immune to other hacks or attacks. Believing that if you hash or encrypt you do not need other precautions is like believing that if you wear a hat your feet will not get wet. It is odd how we convince ourselves otherwise.
M.
I hadn't considered the possibility of doing custom encryption/decryption. I know that SQL Server has a way of encrypting data, but it is a one-way encryption, unless I'm mistaken. Interesting thought, Miles, thank you.
Kindest Regards, Rod Connect with me on LinkedIn.
November 29, 2012 at 2:14 pm
Custom encryption should use industry standard algorithms. You can search for blowfish, AES, etc. or use the implementations that are build into Windows. As Miles noted, it's not that hard. There's a whole namespace in .NET that works well: http://msdn.microsoft.com/en-us/library/system.security.cryptography%28v=VS.71%29.aspx
The hard part is key management. If you are going to do this in the app layer (and you can), be sure you protect those keys well. If they are easily decompiled from your app, you're not doing it right.
They can be stored in the db layer, in which case most of the time you need a password to protect them, and that needs to be protected as well.
Follow me on Twitter: http://www.twitter.com/way0utwest
Forum Etiquette: How to post data/code on a forum to get the best help
My Blog: www.voiceofthedba.com
November 29, 2012 at 2:18 pm
John Hanrahan (11/28/2012)
It has been 15 years since I have gotten a gov contract. I suppose you are going to tell me it is really that bad. 😀
Yes, it is that bad. the government bureaucracy and rules are almost mindblowing, it has grown to elephantine proportions..:-D
"Technology is a weird thing. It brings you great gifts with one hand, and it stabs you in the back with the other. ...:-D"
November 29, 2012 at 3:24 pm
Steve Jones - SSC Editor (11/29/2012)
Custom encryption should use industry standard algorithms. You can search for blowfish, AES, etc. or use the implementations that are build into Windows. As Miles noted, it's not that hard. There's a whole namespace in .NET that works well: http://msdn.microsoft.com/en-us/library/system.security.cryptography%28v=VS.71%29.aspxThe hard part is key management. If you are going to do this in the app layer (and you can), be sure you protect those keys well. If they are easily decompiled from your app, you're not doing it right.
They can be stored in the db layer, in which case most of the time you need a password to protect them, and that needs to be protected as well.
Thank you, Steve.
Kindest Regards, Rod Connect with me on LinkedIn.
Viewing 13 posts - 16 through 27 (of 27 total)
You must be logged in to reply to this topic. Login to reply