Sign in

Data Handling & Security

What data are we sending?

Any user of various Quest Software products can opt-in to send system configuration and performance metrics from their SQL Server or Oracle environment to SpotlightEssentials.com. Data is collected and then sent periodically. Once it's uploaded we store it for analysis and consumption by the end user. From the data and subsequent analysis SpotlightEssentials.com is able to generate a picture of your systems health and performance. The actual source of the data that these products send is documented below in Appendix A.

How are we sending the data?

The data is sent from the Spotlight Enterprise, Spotlight on Oracle, Toad for SQL Server, Toad for Oracle and Spotlight Extensions to SpotlightEssentials.com over the internet. We enforce SSL (https) on the API endpoints on the website so that all data sent to us is encrypted.

How is the data stored in SpotlightEssentials.com?

When we store your data at SpotlightEssentials.com, your data is uploaded as an XML (Atom feed), or JSON object and it is stored in Microsoft's Azure Cloud Platform. The datacenter we currently use is in the north central United States of America. This data may be geo-replicated to other datacenters within the United States. The raw data that is uploaded is kept in the blob store and is encrypted at rest. Processed data that is non-numeric (for example SQL text and plans (extracted from the uploaded data)) are encrypted at rest. This is done so that if our storage account(s) in the datacenter get compromised, none of the data is readable.

How are users authenticated on the Spotlight website?

Following registration with Spotlight each user is assigned a unique user name and password. Users are required to enter these credentials over an SSL (https) connection to login to the site.

How are users authenticated when using the Spotlight Mobile App

Following registration on the Spotlight website each user is assigned a unique user name and password, or if using a Windows device, a unique user token and password. Users are required to enter these credentials over an SSL connection to sign in to the Spotlight Mobile App.

Where can I find security and compliance information on the Windows Azure Platform?

The best place to go is the Windows Azure site itself.

Known Threats

The Spotlight website is not vulnerable to the threats posed by the “Shellshock” bug.

Shellshock is the name that’s been given to a security bug found in Bash, a command shell program commonly used on Linux and UNIX systems. The Spotlight web servers do not use Linux or UNIX systems and therefore are not vulnerable to the security bug found in Bash. Officially, the bug is documented as CVE-2014-6271 and CVE-2014-7169.

Is the Spotlight website vulnerable to the threats posed by Heartbleed?

No, the Heartbleed vulnerability issue is specific to OpenSSL. The Spotlight website uses Microsoft Azure Web Roles and these do not use OpenSSL to terminate SSL connections. Windows comes with its own encryption component called Secure Channel (a.k.a. SChannel), which is not susceptible to the Heartbleed vulnerability.

To see detailed product specific information about the data we are uploading*, choose from the product list below:
*It is expected that all columns of each view listed below are uploaded unless otherwise specified

Spotlight Enterprise

The data from your Spotlight environment is uploaded as XML (Atom feed).

The following data is collected by the Spotlight on SQL Server Diagnostic Server

  1. master.sys.sql_logins
    1. name,
    2. principal_id,
    3. type,
    4. is_disabled,
    5. create_date
    6. modify_date,
    7. default_database_name,
    8. default_language_name,
    9. credential_id,
    10. owning_principal_id,
    11. is_policy_checked,
    12. is_expiration_checked,
  2. sysdatabases
  3. sys.dm_exec_cached_plans
  4. sys.dm_os_sys_info
  5. sys.configurations
  6. backupmediafamily
  7. backupset
  8. backups
  9. sys.data_spaces
  10. sys.datadatabases
  11. sys.master_files
  12. sys.dm_db_missing_index_groups
  13. sys.dm_db_missing_index_group_stats
  14. sys.dm_db_missing_index_details
  15. sys.objects
  16. sys.dm_os_process_memory
  17. sys.dm_os_sys_memory
  18. sys.dm_exec_query_stats
  19. sys.dm_exec_sql_text
  20. sys.dm_exec_query_plan
  21. sys.configurations
  22. sys.dm_io_virtual_file_stats
  23. sys.dm_os_wait_stats
  24. wait_types
  25. sys.sysusers
    1. SELECT db_name(), db_id(), hasdbaccess FROM sys.sysusers where name = ''guest'';
  26. sys.xp_msver
 
 
Toad DBA Suite (Spotlight on Oracle) (Toad for Oracle)
 

The following is a list of the SYS views accessed by this package:

  1. All versions:
    1. v_$version
    2. v_$active_instances
    3. gv_$instance
    4. gv_$database
    5. gv_$system_event
    6. dba_data_files
    7. dba_temp_files
    8. dba_roles
    9. dba_jobs (If calling package from another schema)
    10. gv_$db_cache_advice
    11. gv_$pga_target_advice
    12. gv_$system_parameter
    13. gv_$pgastat
    14. gv_$sysstat
    15. gv_$archive_dest
    16. gv_$log
    17. gv_$logfile
  2. 10g and earlier:
    1. gv_$filestat
    2. gv_$tempstat
    3. dba_tablespaces
  3. 10g only:
    1. gv_$sga_dynamic_components
  4. 10g and higher:
    1. gv_$sys_time_model
    2. gv_$osstat
  5. 11g and higher:
    1. gv_$memory_dynamic_components
    2. gv_$iostat_file
 
Toad for SQL Server
 

The following is a list of the SYS views accessed by this package:

  1. sys.allocation_units
  2. sys.databases
  3. sys.data_spaces
  4. sys.dm_db_index_physical_stats
  5. sys.dm_db_index_usage_stats
  6. sys.dm_exec_query_plan
  7. sys.dm_exec_query_stats
  8. sys.dm_exec_sql_text
  9. sys.dm_os_performance_counters
  10. sys.dm_os_sys_info
  11. sys.dm_os_wait_stats
  12. sys.dm_db_partition_stats
  13. sys.indexes
  14. sys.master_files
  15. sys.objects
  16. sys.partitions
 
Spotlight Extensions Version 7 for SQL Server Management Studio
 

The following is a list of the SYS views accessed by this package:

  1. sys.allocation_units
  2. sys.databases
  3. sys.data_spaces
  4. sys.dm_db_index_physical_stats
  5. sys.dm_db_index_usage_stats
  6. sys.dm_exec_query_plan
  7. sys.dm_exec_query_stats
  8. sys.dm_exec_sql_text
  9. sys.dm_os_performance_counters
  10. sys.dm_os_sys_info
  11. sys.dm_os_wait_stats
  12. sys.dm_db_partition_stats
  13. sys.indexes
  14. sys.master_files
  15. sys.objects
  16. sys.partitions
 
Spotlight Essentials Plug-in Versions 1-5 for SQL Server Management Studio
 

The following is a list of the SYS views accessed by this package:

  1. sys.allocation_units
  2. sys.databases
  3. sys.data_spaces
  4. sys.dm_db_index_physical_stats
  5. sys.dm_db_index_usage_stats
  6. sys.dm_exec_query_plan
  7. sys.dm_exec_query_stats
  8. sys.dm_exec_sql_text
  9. sys.dm_os_performance_counters
  10. sys.dm_os_sys_info
  11. sys.dm_os_wait_stats
  12. sys.dm_db_partition_stats
  13. sys.indexes
  14. sys.master_files
  15. sys.objects
  16. sys.partitions