Will You Be Paying For That With Your Identity?

Today I am revisiting a subject that I've tackled previously - that of data security. Specifically, network encryption - the kind of data security that protects sensitive information as it traverses a network. The kind of data security that some organizations still have not figured out is key to the success of their IT security strategy.

First, there was the story of the data breach at Hannaford, an East Coast-based supermarket chain. Over 4 million credit card numbers were exposed as part of the data breach which resulted in 1,800 cases of fraud (was that all?). Last week we hear about a similar breach at the restaurant chain Dave & Busters, where hackers used a simple packet sniffer to capture patron credit and debit card payment information. In both cases, sensitive information was transmitted across a network in an unencrypted format.

Now, I don't want to come down too hard on the principals involved in these two incidents. I'm willing to bet that the lack of network encryption in both cases was due to a combination of possible factors:

• A lack of network encryption support when the systems were initially brought online
• Overconfidence in the data protection offered by use of an external firewall or other security measures
• Simple oversight
  

There may be other factors that I am not listing here, but I believe that the reality of what gave rise to these two situations is covered by one or more of those items.

The question that I have is, how many of these news items like this will those who work for corporate IT organizations have to read about before they start to take network encryption seriously? The repercussions of data breaches are serious enough that I would think IT organizations of all shapes and sizes would implement a regular security audit process. Ideally it would encompass determining the sensitivity of data moving through or contained within the corporate network and review whether adequate end-to-end security measures are in place to protect the data. Perhaps it would include review of other factors and considerations as well. What I'm mentioning is really the minimum for what folks should be doing.

So the takeaway of all of this is (for those who still haven't gotten it), if the data is something you or your customers wouldn't want someone else seeing / accessing / using without your permission, for the sake of Pete - encrypt it before you send it across the network. If you don't, I will list you as an additional offending party here (and I can't promise I will be as charitable in my criticism the next time around).

I'd be interested in anyone's thoughts on what other steps organizations can take to avoid data breaches like that. Perhaps you have some feedback on other incidents as well. I welcome all comments on this subject.



Technorati Tags | | data+breach encryption data+encryption data+security network+encryption

MySQL, MyPresentation, MyThoughts

Like the picture? It's not really relevant to anything contained in the following post except that it is an excellent visual aid for describing my professional life of late. "To leave whatever you're doing, you have to change your course." Yep, that about sums it up.

Let it never be said that I can't be motivated to do things. Roughly a month and a half has passed since my last post and at last the combination of guilt over my silence and my overwhelming need to be heard has driven me into action. I'm leaving out the indirect financial motivation (job-based compensation) for me to stay on top of this but it also comes into play as well. All of it adds up to me being prodded into action.

I did want to revisit my experience at the 2008 MySQL Conference & Expo. My attendance could be summarized this way: I attended, I spoke, I met, I listened, I left. Unfortunately taking this approach would leave out a lot of details that breathe a little more life into my retelling of the experience.

First off, let me just say that despite a technical hitch that delayed the start of my presentation by 10 minutes, I managed to keep an audience of around 20 people around long enough to sit through the entire session. This is a personal victory and a milestone. The last time I spoke at a conference, it was to a rapt audience of 3 people - 1 fast asleep, 1 who was sitting down to rest his weary legs (before he too, fell asleep, presumably) , and 1 person from my company who was essentially, paid to be there. Yes, I've come a long way, and while I was not offered any barleywine by any of the attendees (*tsk tsk*), I appreciated the attentiveness and polite questions afterward.

If you missed my presentation and for some crazy reason would like to see my slide deck, have at it, and don't forget to let me know what you think or share any comments or questions that you might have: MySQL%202008%20SOA%20Data%20Access%20Presentation.ppt

I was an attendee at a couple of sessions at the conference myself - the most interesting one for me was MySQL, LINQ and the ADO.NET Entity Framework, a presentation by Dave Sceppa, who is a Program Manager at Microsoft (I came late, so I just caught the tail end of Dave's intro where he explained that Reggie Burnett couldn't make it due to an injury he suffered during the trip? I'm not sure what happened). Dave had a lot of interesting things to present about ADO.NET and LINQ in particular. I had an opportunity to meet and introduce myself him after his presentation - very nice guy and one that I would recommend anyone who is interested in ADO.NET seek out at trade shows.

I was also at the MySQL Partners meeting where it was announced that MySQL was considering rolling out some new MySQL features (specifically ones related to backup and encryption) into MySQL Enterprise only. Jeremy Cole, whose blog more or less broke this news, was at the meeting and was pointed in his requests to the MySQL executive team for clarification and confirmation of the facts around this decision. Based on the rash of comments on his post and the prolific blogosphere hand-wringing over this announcement, it was clear that a lot of people in the MySQL community weren't happy about it. In fact, some claimed that Sun, who had just completed their acquisition of MySQL was now starting to close source it. In the software world, close sourcing an open source product is seen as the equivalent of Darth Vader freezing Han Solo in carbonite. While Han (MySQL) is technically still alive after his imprisonment, his state is considered unchangeable and subject to the whims of the Empire (Sun). It should be noted that after all of the fuss over this consideration, Sun seems to have backtracked on this a bit, but there's still debate over Sun's intentions with regards to making dividends on their billion-dollar investment in MySQL.

I was not as shocked and dismayed by this announcement / consideration as others apparently were. To me, it comes down to simple economics: why wouldn't Sun be looking for ways to add value to MySQL Enterprise and thus help justify why customers should pay for it versus simply downloading and using a free edition? Of course, some may argue that as an employee of a software company that makes money on closed source software, my perspective is easily dismissed. Without wanting to explain DataDirect's business model in great detail, I'll just say that if our products did not demonstrate value over our competition (which is almost always free or ridiculously cheap), we would have gone out of business a long time ago. So yeah, I guess I'm not afraid to say that because value is what differentiates software companies that make money on their products and services (and stay in business for over 20 years) and the ones that don't make money (and consequently, fail to stay in business). ;)

My final thought on my trip is a bit lighthearted - any of you who consider yourselves beer snobs (a la, yours truly) and find yourself hunting for a place to buy and sip great beer in Bay Area would do well to consider showing up at the City Beer Store in San Francisco. The owners were terrific - extremely friendly and helpful, and the selection was terrific (I scored 2 bottles each of Russian River Beatification (Batch 002) and Supplication!). I managed to stuff my suitcases full of enough bottles of deliciousness that the TSA saw fit to inspect my bags, though I am happy to report that they did so professionally and did not "borrow" any of my precious goodies for themselves. (THANK YOU!!)

I'm planning to move up to a more regular update schedule, so look for a new entry well within the month and a half long interval that I established previously. Oh, and look for things to get alternately more business-focused AND more whimsical. You were warned. ^_^




craft+beer barleywine MySQL SOA Data+Access ADO.NET speaking+opportunity