As we become more and more security conscious, it becomes more important not only to configure systems for better security, but also to add more monitoring and auditing to detect when problems occur. We know that at some point someone will attempt to hack our systems. Many of us have auditing set up to detect failed logins, but is that good enough?
If a hacker manages to gain access to your password hashes, and it’s not a stretch these days to think that they might, wouldn’t you like to know if they manage to find the plain text that corresponds to the hash? There’s an idea that systems could be written to store multiple passwords for user accounts, but only one of which is valid. A separate system detects attempts to log in with the false passwords and alerts administrators to a hacking attempt.
This is an interesting idea, and while it won’t solve all our problems, it will solve some. If a brute force attack occurs on an account, and multiple passwords are being tried, all of which are known to be false (the honeyword passwords), administrators can be notified, and warnings passed on to users. It doesn’t help if the hacker chooses the correct password to enter first, but with enough honeywords, you reduce the chances that they will.
I don’t know that I’d like to see this for SQL Server, but I certainly would like to see additional security features. Two factor authentication would be nice, perhaps even some sort of approval process enabled that required multiple approvals for some changes. The latter would help us prevent the cowboy DBA from making changes without anyone else being aware of them.
Detection of breaches, using something like honeywords, provide another layer of security. They don’t prevent hacks, but they can help us deal with them.
The Voice of the DBA Podcasts
We publish three versions of the podcast each day for you to enjoy.