Key risks and options for operating systems and database security assessments

Tonight I attended the local CPA Australia IT discussion group. The presentation was from David Levi, managing director of e-Sentinel.

The presentation focussed on threats, vulnerabillities, and net nasties. He highlighted particularly databases and techniques like sql injection and trusted connections. He advocated systems assurance services and audit of your IT environment. As usual, a really good session highlighting the role of assurance in the IT/business interface.

When the system’s tail wags the organisation’s dog

This article was written for BDO’s business briefing for Autumn 2003. The article is reflective of a common theme that we find – businesses often resort to writing software as a first resort rather than a last resort, and end up working even harder to make their business work. It’s not that I’m against homegrown software, but I do see it cause enough grief that I suggest clients have a Bex and a good lie down before developing their own software. The article is also published at http://michealaxelsen.com/blog/publications/articles/when-the-systems-tail-wags-the-organisations-dog/. Enjoy.

Read more

IT outsourcing – selecting the ‘best’ infrastructure model

This article was published on CEO Online a month or two ago, and I did promise I would post it here eventually.  And as I am of course absolutely certain that there is a raft of readers out there who would like to see the full article on the basis of that promise (delusionment is a wonderful thing) I am posting the article here.

In order to keep us all sane, you will need to click through to see the full article.

Read more

Comparing Database Management Systems (and how not to)

December 2005’s issue of Australian Technology & Business magazine (published by ZDNet Australia) compares the Oracle, IBM, Microsoft and MySQL offerings.  Somewhat surprisingly to me, I noted that Steven Turvey of RMIT IT Test Labs compared the entry level of all four products.  This result meant that the $8,000 ($206 per user + $1000 per server) Express Edition of IBM DB2, the free version of Microsoft SQL Server Express (Beta2), MySql (which is free, so hence the top-of-the-line version), and Oracle 10g Release 1 Standard Edition ($19,814 or $396 per user).

Usually I am very much a fan of RMIT Test Labs, but in this case I am not too sure about the comparison made, given the price differential.  In particular, it is interesting that MySQL won the Editor’s Choice award for the scenario set out in the review.  In particular, Microsoft SQL Server came out at the bottom of the pile, which is surprising to say the least, although perhaps to be expected given that the express edition is the deliberately-limited version of SQL Server.  A more relevant comparison, to my mind, would be the actual next step up of SQL Server – particularly since the review points noted the limitations of the express version.

At any rate I would need convincing that MySQL was the ‘winner’ given issues such as:

  • Difficulty of finding someone qualified to operate MySQL to employ to operate it.
  • The lack of available, qualified, support staff
  • The lack of commercial-grade software that is based upon MySQL such that you will inevitably need to have at least two databases that use it (e.g. your custom software has been built for MySQL, but your accounting software uses MSSQL – suddenly, you have to have two skill sets in the same application arena)
  • The fact that until this last version (Released 24 October 2005), MySQL did not have support for the standard database functionality requirements such as views (!), stored procedures (!), triggers (!), cursors (!), and a whole mess of other things – when the competitors discussed have supported these things for a Very Long Time.

I am a big supporter of open-source software, but reality does need to prevail.  The ‘new features’ of MySQL should have been there from the start – views and triggers in particular are core elements of Codd’s original outline of a relational database.  It would be a brave consultant who recommended to a client that they adopt a brand-new database management system that has had core database functionality added in only the past three months.

I think MySQL is a very good product, but I am not too convinced that it will suit all businesses equally well, and would be concerned if any businesses leapt from their commercial software to MySQL without thinking it all the way through.  A very good product, and this review is prompting me to take another look at MySQL, but I think it’s still a watching brief if the data to be managed is in any way critical to the business.