Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 
        
Home       Members    Calendar    Who's On


Add to briefcase ««123»»

Regulators, Mount Up Expand / Collapse
Author
Message
Posted Wednesday, November 28, 2012 8:46 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Friday, September 12, 2014 12:27 PM
Points: 4, Visits: 68
So, the topic of data encryption comes up every day in my daily duties. More so than earlier in my travels when folks were oblivious to what was stored in the data layer nor cared about how it was stored, just who and what systems had access to "the data". I'm now delighted to hear business units actively address secure data access AND encrypted data. One of the most surprising dialogs was between a VP of Marketing (whose interest was in mining customer data), a 3rd party resource (who was designing the middleware) and architects actually PLANNING to improve the data hardware to compensate for overhead need to encrypt data as well as designating what data elements needed to be encrypted.

How does this help me as the DBA in these instances? It's a excellent step towards insuring that whatever measures we take to secure the data are understood and done with a suitable level of transparency that everyone in the project is comfortable with and that's a good thing.

I'm only saying this to say that increased awareness and implementation of encryption, albeit a bit more work, is an excellent topic well worth the resources spent.

By the by, kudos for the song references. Still don't think this album got the recognition it
deserves may throw it on the playlist-of-the-day just because...
Post #1389859
Posted Wednesday, November 28, 2012 9:17 AM
SSCrazy

SSCrazySSCrazySSCrazySSCrazySSCrazySSCrazySSCrazySSCrazy

Group: General Forum Members
Last Login: Today @ 9:02 AM
Points: 2,915, Visits: 1,849
Its amazing what happens if you wave the possiblity of nuking old dead systems in front of a DBA. Their wrinkles vanish, an unfamiliar expression (happy smile) crosses there face and they hit keys faster than a teenager in a Halo death match.

I suspect I may have started something here!


LinkedIn Profile
Newbie on www.simple-talk.com
Post #1389898
Posted Wednesday, November 28, 2012 9:55 AM


SSC-Dedicated

SSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-Dedicated

Group: Administrators
Last Login: Today @ 4:16 PM
Points: 31,284, Visits: 15,748
One note on encryption. I heard a discussion from some devs and architects that were under the impression that encryption would prevent sql injection issues. Not likely to happen, so be sure that good coding practices are still being followed.







Follow me on Twitter: @way0utwest

Forum Etiquette: How to post data/code on a forum to get the best help
Post #1389937
Posted Wednesday, November 28, 2012 10:54 AM


Ten Centuries

Ten CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen Centuries

Group: General Forum Members
Last Login: Tuesday, September 16, 2014 2:03 PM
Points: 1,334, Visits: 3,069
It's not just unencrypted data that auditors ding you on nowadays. Wearing many hats at once and doing things outside your job description can definitely get you dinged as well. SarBox standards are very picky on this nowadays..For example, we had an IT guy once caught moving furniture around in his cube and the auditors jumped all over that with managment and the man was reprimanded over it. Not in his job description, don't do it again. If you are a little shop you can still get away with a "Jack-of-all-trades" guy (I don't know for how long though), but that is no longer permitted at most larger shops or government agencies that fall under the strict auditing standards of today. Heck, the auditors dinged us for having our production clusters on the second node, left there after a failover!!!!! Picky, picky...

"Technology is a weird thing. It brings you great gifts with one hand, and it stabs you in the back with the other. ..."
Post #1389998
Posted Wednesday, November 28, 2012 3:20 PM
SSC-Addicted

SSC-AddictedSSC-AddictedSSC-AddictedSSC-AddictedSSC-AddictedSSC-AddictedSSC-AddictedSSC-Addicted

Group: General Forum Members
Last Login: Today @ 8:49 AM
Points: 413, Visits: 1,074
I have been through several SOX audits and have never heard of that. I would have have said stick it, see the job description says "and other duties as required" which I think is in every single job description I have seen for years. The whole point of SOX is to document what you do and how you do it and make sure everyone knows (including shareholders and regulators). It has always seemed overblown to me. Next they'll say you can't get up to get water to quench your thirst because you have to operate the water fountain.
Post #1390167
Posted Wednesday, November 28, 2012 3:36 PM
Hall of Fame

Hall of FameHall of FameHall of FameHall of FameHall of FameHall of FameHall of FameHall of FameHall of Fame

Group: General Forum Members
Last Login: Today @ 3:34 PM
Points: 3,109, Visits: 11,516
TravisDBA (11/28/2012)
It's not just unencrypted data that auditors ding you on nowadays. Wearing many hats at once and doing things outside your job description can definitely get you dinged as well. SarBox standards are very picky on this nowadays..For example, we had an IT guy once caught moving furniture around in his cube and the auditors jumped all over that with managment and the man was reprimanded over it. Not in his job description, don't do it again. If you are a little shop you can still get away with a "Jack-of-all-trades" guy (I don't know for how long though), but that is no longer permitted at most larger shops or government agencies that fall under the strict auditing standards of today. Heck, the auditors dinged us for having our production clusters on the second node, left there after a failover!!!!! Picky, picky...


My impression is that most "auditors" have no idea what they are doing, and just make things up like "no moving furniture if it isn't in your job description".


Post #1390174
Posted Wednesday, November 28, 2012 4:16 PM


Ten Centuries

Ten CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen Centuries

Group: General Forum Members
Last Login: Tuesday, September 16, 2014 2:03 PM
Points: 1,334, Visits: 3,069
John Hanrahan (11/28/2012)[hr]I have been through several SOX audits and have never heard of that. I would have have said stick it, see the job description says "and other duties as required" which I think is in every single job description I have seen for years. The whole point of SOX is to document what you do and how you do it anWwwd make sure everyone knows (including shareholders and regulators). It has always seemed overblown to me. Next they'll say you can't get up to get water to quench your thirst because you have to operate the water fountain.


Have you ever worked for the government lately?


"Technology is a weird thing. It brings you great gifts with one hand, and it stabs you in the back with the other. ..."
Post #1390187
Posted Wednesday, November 28, 2012 4:31 PM


SSC-Dedicated

SSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-Dedicated

Group: General Forum Members
Last Login: Today @ 4:57 PM
Points: 35,593, Visits: 32,184
David.Poole (11/28/2012)
Regulation is a cloud that can have a bright silver lining.

Lets suppose that you have old systems ridden with tech debt and propped up by manual processes.
Those powers that be are so used to the situation that the idea that the tech debt or the manual processes are a problem just doesn't register. They are chasing the new shiny ball.

All of a sudden regulation comes along and lifts up the rock and shines a bright light underneath it and reveals the superating horrors squirming underneath!

Too many people have too much access to too much data almost certainly meaning a failed regulatory audit.
All of a sudden you have the impetus and support to fix a load of old problems and simplify the way your systems work. Do this well and not only will you pass regulatory inspection but you will also demonstrate the art of the possible, how good things could be if the prime focus was delivering something maintainable, scalable, flexible.


+1000

I just went through a post where the OP (a DBA) was feeling a bit hog-tied because the company required even him to do "change controls" for most things. I told him to revel in the process and that they hopefully have a ticketing system where he can enter what he does. It's a rare opportunity for his chain of command to actually find out what the hell a DBA does all day and to be able to "brag" about it without seeming like a "brown noser".

For those of you reeling from the idea, it takes only a minute or two to open a ticket, get permission to proceed, and close the ticket leaving a trail of undisolvable breadcrumbs that will come in mighty handy at review time.


--Jeff Moden
"RBAR is pronounced "ree-bar" and is a "Modenism" for "Row-By-Agonizing-Row".

First step towards the paradigm shift of writing Set Based code:
Stop thinking about what you want to do to a row... think, instead, of what you want to do to a column."

(play on words) "Just because you CAN do something in T-SQL, doesn't mean you SHOULDN'T." --22 Aug 2013

Helpful Links:
How to post code problems
How to post performance problems
Post #1390192
Posted Wednesday, November 28, 2012 4:34 PM


SSC-Dedicated

SSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-Dedicated

Group: General Forum Members
Last Login: Today @ 4:57 PM
Points: 35,593, Visits: 32,184
Michael Valentine Jones (11/28/2012)
TravisDBA (11/28/2012)
It's not just unencrypted data that auditors ding you on nowadays. Wearing many hats at once and doing things outside your job description can definitely get you dinged as well. SarBox standards are very picky on this nowadays..For example, we had an IT guy once caught moving furniture around in his cube and the auditors jumped all over that with managment and the man was reprimanded over it. Not in his job description, don't do it again. If you are a little shop you can still get away with a "Jack-of-all-trades" guy (I don't know for how long though), but that is no longer permitted at most larger shops or government agencies that fall under the strict auditing standards of today. Heck, the auditors dinged us for having our production clusters on the second node, left there after a failover!!!!! Picky, picky...


My impression is that most "auditors" have no idea what they are doing, and just make things up like "no moving furniture if it isn't in your job description".




I can't help moving furniture. I'm old and it just happens every time I have a bout with gas.


--Jeff Moden
"RBAR is pronounced "ree-bar" and is a "Modenism" for "Row-By-Agonizing-Row".

First step towards the paradigm shift of writing Set Based code:
Stop thinking about what you want to do to a row... think, instead, of what you want to do to a column."

(play on words) "Just because you CAN do something in T-SQL, doesn't mean you SHOULDN'T." --22 Aug 2013

Helpful Links:
How to post code problems
How to post performance problems
Post #1390193
Posted Wednesday, November 28, 2012 4:37 PM
SSC-Addicted

SSC-AddictedSSC-AddictedSSC-AddictedSSC-AddictedSSC-AddictedSSC-AddictedSSC-AddictedSSC-Addicted

Group: General Forum Members
Last Login: Today @ 8:49 AM
Points: 413, Visits: 1,074
It has been 15 years since I have gotten a gov contract. I suppose you are going to tell me it is really that bad.
Post #1390194
« Prev Topic | Next Topic »

Add to briefcase ««123»»

Permissions Expand / Collapse