Download Database Security, Authorization, and Encryption

Database Security, Authorization,
and Encryption
Schaeffer Stevens, Jamey Petty, Desmond Yates
Table of Contents
Database Security
• What is Database Security?
• Why is Database Security Important?
• When Database Security Goes Bad.
• Why is Database Information Valuable to Hackers?
• The Monetary Cost Of Compromised Data.
• Types Of Malicious Computer Attacks.
• Defending Your Database Information.
Table of Contents Cont.
Database Authorization
•
•
•
•
•
•
What is Database Authorization?
Various Kinds of System-level Authorization
Types of Database Activity Monitoring
What is Database-level Authorization?
Grant Privileges and Statements
Revoking Privileges
Encryption
•
•
•
•
•
•
•
What is Encryption?
Why Do We Need Encryption?
Types of Encryption
Advantages/Disadvantages of Encryption Types
Symmetric Key Algorithms
Encryption Services
Job Opportunities
What is Database Security?
Database security concerns the use of a broad range of information security controls to protect databases (potentially
including the data, the database applications or stored functions, the database systems, the database servers and the
associated network links) against compromises of their CIA.
C - Confidentiality - the property that information is not made available or disclosed to unauthorized individuals, entities, or
processes.
I - Integrity -data integrity means maintaining and assuring the accuracy and completeness of data over its entire life-cycle.
This means that data cannot be modified in an unauthorized or undetected manner.
A - Availability - This means that the computing systems used to store and process the information, the security controls
used to protect it, and the communication channels used to access it must be functioning correctly. High availability
systems aim to remain available at all times, preventing service disruptions due to power outages, hardware failures, and
system upgrades.
Database security is a specialized topic within the broader realms of computer security, information security and risk
management.
Why is Database Security Important?
The Importance of Establishing a Security Policy for Your Database
It is important to develop a security policy for every database. The security policy establishes methods for protecting your
database from accidental or malicious destruction of data or damage to the database infrastructure.
Each database can have an administrator, referred to as the security administrator, who is responsible for implementing
and maintaining the database security policy.
If the database system is small, the database administrator can have the responsibilities of the security administrator.
However, if the database system is large, a designated person or group of people should have sole responsibility as
security administrator.
When Database Security Goes Bad...
Whether large company or government entity, no one is safe.
When Database Security Goes Bad Cont.
2012, 2013, 2014 Yahoo
•
Intruders were able to gain unauthorized access to the user database of Yahoo.
•
Nearly 2 billion user account details were exposed, copied and exported.
2015 U.S.A. Voter database 191,000,000 voters information exposed.
•
White hat hacker found misconfigured database containing the exposed information of 191 million voters.
•
Included voter's' full names, home addresses, unique voter IDs, date of births and phone numbers.
2016 Friend Finder Network 412,000,000 users information exposed
•
Largest known hack of 2016. Breach included 20 years of historical customer data from: Adultfriendfinder.com, Cams.com,
Penthouse.com, Stripshow.com and iCams.com.
More examples...
Why is Database Information Valuable to Hackers?
Personal information is the currency of the underground economy.
Hackers who obtain this data sell it in bulk to a variety of buyers, including identity thieves, organized crime rings,
spammers and botnet operators, who use the data to make even more money at your expense.
Health record information typically sells for $10 which is 10 - 20 times the black market price of hacked credit card
information.
•
Typically, medical identity theft is not immediately identified by the victim which can give hackers years to milk the
stolen credentials.
•
The percentage of healthcare organizations that have reported a criminal cyber attack has risen to 40 percent in
2013 from 20 percent in 2009, according to an annual survey by the Ponemon Institute think tank on data protection
policy.
The Monetary Cost of Compromised Data
In 2014, it is estimated that hackers cost consumers and companies between $375 and $575 billion annually. This number
was expected to quickly grow as online information stealing expands with increased Internet use.
Cost of online crime is estimated at 0.8 percent of worldwide GDP.
•
North America and Europe losing more than countries in Latin America or Africa, according to a study published by
the Center for Strategic and International Studies and funded by cybersecurity firm McAfee.
•
This rivals the amount of worldwide GDP - 0.9 percent, that is spent on managing the narcotics trade.
A recent survey by the Ponemon Institute showed the average cost of cybercrime for U.S. retail stores more than doubled
from 2013 to an annual average of $8.6 million per company in 2014.
The annual average cost per company of successful cyber attacks increased to $20.8 million in financial services, $14.5
million in the technology sector, and $12.7 million in communications industries.
The Monetary Cost of Compromised Data Cont.
Types of Malicious Computer Attacks
Malware - Simply defined, malware is any computer code that has a malicious intent. Malware is often used to destroy something on a computer or
to steal private information. Odds are, nearly everyone with a computer has fallen victim to some form of malware in their time.
Viruses - As the name implies, viruses make a computer "sick". They infect a computer, just like a real virus that infects a person, and then they
hide inside the depths of the computer.
Spyware - a form of malware that monitors or spies on its victims. It usually remains in hiding, but even so, it can log the various activities
performed by a user.
•
Spyware is capable of recording keystrokes (what a user types on the keyboard), which means that the attacker can view
passwords that the victim enters into the computer.
•
Spyware is also used to steal confidential information.
Worms - Similar to viruses, worms replicate themselves many times to fulfill a nefarious purpose.
•
Worms differ from viruses in that they do not need to attach themselves to other files or programs.
•
Worms are capable of surviving all by themselves, and not only do they replicate on a single computer host, but they can also
replicate across an entire network of computers.
Types of Malicious Computer Attacks Cont.
Password Attacks - These attacks are focused on cracking a victim's password so that the attacker may obtain access to a secured
system.
Brute-Force Attack - executed when an attacker tries to use all possible combinations of letters, numbers, and symbols to enter a
correct password.
•
Any password can be cracked using the brute-force method, but it can take a very long time to finish.
Dictionary Attack - takes place when an attacker utilizes a dictionary in an attempt to crack a password. Essentially, words from the
dictionary are inputted into the password field to try to guess the password.
Types of Malicious Computer Attacks Cont.
Denial-of-Service(DOS/DDOS) attacks - is a special form of cyber attack that focuses on the interruption of a network
service which prevents authorized users from accessing information contained on the affected network.
•
Typically uses a botnet (large group of computers that an attacker has taken control of) in order to have the
processing power needed to overload a network server by flooding it with requests.
Types of DOS/DDOS attacks
•
Teardrop - sending irregularly shaped network data packets.
•
Buffer Overflow - flooding a server with an overwhelming amount data.
•
Smurf - tricking computers to reply to a fake request, causing a lot of network traffic.
•
Physical - disrupting a physical connection, such as a cable or power source.
Defending Your Database Information
Defending Your Database Information Cont.
IDPS - Intrusion detection & prevention system - Mostly used by companies, these are network security appliances that monitor network or system
activities for malicious activity
Network-based intrusion prevention system (NIPS): monitors the entire network for suspicious traffic by analyzing protocol activity.
•
•
•
Wireless intrusion prevention systems (WIPS): monitor a wireless network for suspicious traffic by analyzing wireless networking
protocols.
Network behavior analysis (NBA): examines network traffic to identify threats that generate unusual traffic flows, such as
distributed denial of service (DDoS) attacks, certain forms of malware and policy violations.
Host-based intrusion prevention system (HIPS): an installed software package which monitors a single host for suspicious activity
by analyzing events occurring within that host.
The majority of intrusion prevention systems utilize one of three detection methods: signature-based, statistical anomaly-based, and stateful
protocol analysis.
1. Signature-Based Detection: Signature based IDS monitors packets in the Network and compares with preconfigured and predetermined
attack patterns known as signatures.
2. Statistical anomaly-based detection: An IDS which is anomaly based will monitor network traffic and compare it against an established
baseline. The baseline will identify what is "normal" for that network – what sort of bandwidth is generally used and what protocols are used.
It may however, raise a False Positive alarm for legitimate use of bandwidth if the baselines are not intelligently configured.
3. Stateful Protocol Analysis Detection: This method identifies deviations of protocol states by comparing observed events with
“predetermined profiles of generally accepted definitions of benign activity.
Defending Your Database Information Cont.
Firewall - a network security system that monitors and controls the incoming and outgoing network traffic based on
predetermined security rules.
•
Allows for the creation of a detailed list of rules to block against specific threats.
•
Can be used to restrict network access to types of websites that may have malicious code (adult sites, facebook,
etc.)
Antivirus software - a program or set of programs that are designed to prevent, search for, detect, and remove software
viruses, and other malicious software like worms, trojans, adware, and more.
•
According to Microsoft’s 2013 annual Security Intelligence Report, one out of four PCs in the US is not running up-todate antivirus software, making them nearly six times more likely to get infected than those that are.
Security audit - helps identify what parts of your business are vulnerable.
•
Penetration testing - acquiring the help of a White Hat (Ethical) hacker to attack your network in order to expose
weaknesses a malicious hacker could use to gain entry to your network.
Defending Your Database Information Cont.
Backup regularly - The general rule of thumb: servers should have a complete backup weekly, and incremental backups
every night; personal computers should also be backed up completely every week, but you can do incremental backups
every few days.
Educate your employees - One of the most difficult things to do is protect end users against themselves.
•
Ultimately, prevention is the best approach to handling your data security.
•
Make sure your employees understand how important your company's data is, and all the measures they can take to
protect it.
Establishing a strong password policy - instruct users to create complicated passwords and never write passwords down!
•
Two-factor authentication (also known as 2FA)- is a method of confirming a user's claimed identity by utilizing a combination
of two different components. Two-factor authentication is a type of multi-factor authentication.
What is Database Authorization?
Overview of database authorization
A privilege is a type of permission for an authorization name, or a permission to perform an action or a task. The privilege
allows a user to create or access database resources. Authorized users can pass on privileges on their own objects to
other individual users, to groups, or to the PUBLIC by using the GRANT statement.
• PUBLIC is a special group that consists of all users, including future users. Users that are members of a group will
indirectly take advantage of the privileges granted to the group, where groups are supported.
Various Kinds of System-level Authorization
SYSADM (system administrator) authority
SYSCTRL (system control) authority
SYSMAINT (system maintenance) authority
SYSMON (system monitor) authority
SYSADM Authorization
SYSADM (system administrator) authority
The SYSADM (system administrator) authority provides control over all the resources created and maintained by the
database manager. The system administrator possesses all the authorities of SYSCTRL, SYSMAINT, and SYSMON
authority. The user who has SYSADM authority is responsible both for controlling the database manager, and for ensuring
the safety and integrity of the data.
SYSCTRL Authorization
SYSCTRL authority
The SYSCTRL authority provides control over operations that affect system resources.
• For example, a user with SYSCTRL authority can create, update, start, stop, or drop a database.
• This user can also start or stop an instance, but cannot access table data.
SYSMAINT Authorization
SYSMAINT authority
The SYSMAINT authority provides the authority required to perform maintenance operations on all databases that are
associated with an instance.
• A user with SYSMAINT authority can update the database configuration, backup a database or table space, restore an
existing database, and monitor a database.
SYSMON Authorization
SYSMON (system monitor) authority
The SYSMON (system monitor) authority provides the authority required to use the database system monitor.
Database activity monitoring (DAM) or database system monitoring is a database security technology for monitoring and
analyzing database activity that operates independently of the database management system (DBMS).
• DAM is typically performed continuously and in real-time. DAM is also an important technology for protecting sensitive
databases from external attacks by cybercriminals. The technology also improves database security by detecting
unusual database read and update activity from the application layer.
Types of Database Activity Monitoring
Privileged User Monitoring
Application Activity Monitoring
Privileged User Monitoring
Privileged User Monitoring:- Monitoring privileged users (or super users), such as database administrators (DBAs),
systems administrators (or sysadmins), developers, help desk, and outsourced personnel – who typically have unfettered
access to corporate databases – is essential for protecting against both external and internal threats. Privileged user
monitoring includes auditing all activities and transactions, identifying anomalous activities (such as viewing sensitive data,
or creating new accounts with superuser privileges), and reconciling observed activities (such as adding or deleting tables)
with authorized change requests.
Privileged user monitoring helps ensure:
•
Data privacy - only authorized applications and users are viewing sensitive data.
•
Data governance - so that critical database structures and values are not being changed outside of corporate change
control procedures.
Application Activity Monitoring
Application Activity Monitoring:
The primary purpose of application activity monitoring is to provide a greater level of end-user accountability and detect
fraud (and other abuses of legitimate access) that occurs via enterprise applications or web-based, rather than via direct
access to the database.
• This is done with an optimization mechanism known as “connection pooling”, which leaves database connections open
whenever they are needed to be reuse for another purpose.
• Using pooled connections, the application aggregates or collects all user traffic within a few database connections that
are identified only by a generic service account name and then associate specific database transactions with particular
application end-users, in order to identify unauthorized or suspicious activities.
What is Database-Level Authorization?
DBADM (database administrator)
SECADM (security administrator)
SQLADM (SQL administrator)
WLMADM (workload management administrator)
EXPLAIN (explain authority)
ACCESSCTRL (access control authority)
DBADM Authority-Level
DBADM (database administrator)
The DBADM authority level provides administrative authority over a single database. This database administrator
possesses the privileges required to create objects and issue database commands.
• The DBADM authority can be granted only by a user with SECADM authority. The DBADM authority cannot be granted to
PUBLIC.
SECADM Authority-Level
SECADM (security administrator)
The SECADM authority level provides administrative authority for security over a single database. The security
administrator authority possesses the ability to manage database security objects (database roles, audit policies, trusted
contexts, security label components, and security labels) and grant and revoke all database privileges and authorities.
• A user with SECADM authority can transfer the ownership of objects that they do not own. The SECADM authority cannot
be granted to PUBLIC.
SQLADM Authority-Level
SQLADM (SQL administrator)
The SQLADM authority level provides administrative authority to monitor and tune SQL statements within a single
database.
• It can be granted by a user with ACCESSCTRL or SECADM authority.
WLMADM Authority-Level
WLMADM (workload management administrator)
The WLMADM authority provides administrative authority to manage workload management objects, such as service
classes, work action sets, work class sets, and workloads.
• It can be granted by a user with ACCESSCTRL or SECADM authority.
EXPLAIN Authority-Level
EXPLAIN (explain authority)
The EXPLAIN authority level provides administrative authority to explain query plans without gaining access to data.
• It can only be granted by a user with ACCESSCTRL or SECADM authority.
ACCESSCTRL Authority-Level
ACCESSCTRL (access control authority)
ACCESSCTRL authority can only be granted by a user with SECADM authority. The ACCESSCTRL authority cannot be
granted to PUBLIC. The ACCESSCTRL authority level provides administrative authority to issue Grant and Revoke.
• Grant Statements - give privileges to a specific user or role, or to all users, to perform actions on database objects. You
can also use the GRANT statement to grant a role to a user, to PUBLIC, or to another role, i.e. (Delete data from a specific
table).
Syntax: GRANT privilege-type ON [TABLE] { table-Name | view-Name } TO grantees
• Revoke Statements - Use the REVOKE statement to remove privileges from a specific user or role, or from all users, to
perform actions on database objects. You can also use the REVOKE statement to revoke a role from a user, from
PUBLIC, or from another role, i.e (Insert data into a specific table).
•
Syntax: REVOKE privilege-type ON [ TABLE ] { table-Name | view-Name } FROM grantees
What is Encryption?
A process that uses an algorithm to change data stored in a database into
ciphertext that must be translated through decryption.
Why Do We Need Encryption?
Encryption is the process of transforming information to make it unintelligible to all unauthorized
parties except the intended recipient and forms the basis of data integrity and privacy which is
necessary for e-commerce. What this means is that the whole purpose of encryption is to make
sure that the intended recipient is the only one who receives in intelligible form the information
which has been encrypted.
Protects information such as user information, passwords, credit card information, social security
numbers and other sensitive information.
Ciphertext
Ciphertext is the result of encryption performed on plaintext using an algorithm,
called a cipher.
Key
A parameter that determines the functional output of a cryptographic algorithm.
For encryption algorithms, a key specifies the transformation of plaintext into
ciphertext, and vice versa for decryption algorithms.
Example of Simple Cipher
Types of Encryption
Symmetric-key - the encryption and decryption keys are the same.
Communicating parties must have the same key before they can achieve
secure communication.
Public-key - the encryption key is published for anyone to use and encrypt
messages. However, only the receiving party has access to the decryption key
that enables messages to be read
Advantages/Disadvantages of Symmetric-key Encryption
Advantages
Given that only one key is involved in the encryption process it can generally be said that speed is an
advantage of symmetric encryption.
Disadvantages
Symmetric cryptosystems have a problem of key transportation. The secret key is to be
transmitted to the receiving system before the actual message is to be transmitted. Every means
of electronic communication is insecure as it is impossible to guarantee that no one will be
able to tap communication channels. So the only secure way of exchanging keys would be
exchanging them personally.
Advantages/Disadvantages of Public-key Encryption
Advantages
In asymmetric or public key, cryptography there is no need for exchanging keys, thus eliminating
the key distribution problem
Disadvantages
A disadvantage of using public-key cryptography for encryption is speed: there are popular
secret-key encryption methods which are significantly faster than any currently available
public-key encryption method.
Symmetric Key Algorithms
Symmetric-key encryption can use either stream ciphers or block ciphers.
Stream ciphers - A stream cipher is an encryption algorithm that encrypts 1 bit or byte of
plaintext at a time. It uses an infinite stream of pseudorandom bits as the key
Block ciphers - A block cipher is an encryption algorithm that encrypts a fixed size of n-bits of
data - known as a block - at one time. The usual sizes of each block are 64 bits, 128 bits, and
256 bits. So for example, a 64-bit block cipher will take in 64 bits of plaintext and encrypt it
into 64 bits of ciphertext. The majority of the symmetric ciphers used today are actually block
ciphers.
Encryption Services
IBM Multi-Cloud Data Encryption
Utilizes cryptographic splitting technology to help assure sensitive data
confidentiality, privacy, and protection against brute force attacks.
Uses built-in key management, all phases of key lifecycle management stay in
your control, streamlining the key management process -- from key creation,
rotation, and revocation, to help support industry compliance requirements.
Cryptographic Data Splitting
Cryptographic data splitting - Involves encrypting data, splitting the encrypted
data into smaller data units, distributing those smaller units to different
storage locations, and then further encrypting the data at its new location.
With this process, the data is shielded from security breaches, because even
if an intruder is able to retrieve and decrypt one data unit, the information
would be useless unless it can be combined with decrypted data units from
the other locations.
Oracle Transparent Data Encryption
Utilizes transparent data encryption which encrypts the whole table space
Stops would-be attackers from bypassing the database and reading sensitive
information from storage by enforcing data-at-rest encryption in the database
layer.
CipherCloud
CipherCloud is deployed as software that can be run on physical servers, virtual
servers, or on private cloud instances, such as Amazon Web Services.
Salesforce, Box, Office 365, Gmail, AWS and other. The solution preserves the
format and operations of encrypted data that is stored in the cloud,
supporting search, sort, and reporting functions critical to end-users.
Job Opportunities
Lead Software Security Engineer - tasked with doing everything from maintaining and deploying employee
training programs to developing security-related aspects of application programs. Lead software security
engineers should have at least a BS in computer science or a similar field with relevant security
certifications.
Average Salary - $233,333
Chief Security Officer - prepare organizations to counter existing and emerging threats. These C-suite
professionals are responsible for establishing and communicating best practices for maintaining data
security, as well as monitoring the effectiveness of security operations. This role often requires
certifications in addition to at least a BS degree in computer science or a similar field.
Average Salary: $225,000
Job Opportunities Cont.
Security consultant - work with clients to develop strategies for effective cybersecurity across their entire
organization. In addition to knowing best practices and recommended procedures, they must also
possess solid communication, negotiation and project management skills. Organizations look for
consultants with many years of experience, as well as a working knowledge of industry rules, regulations
and broad and deep knowledge of enterprise security vendors and products.
Average Salary: $198,909
Cybersecurity engineer - experienced in penetration testing and other cybersecurity tools, and use them to
keep an organization secure against both internal and external threats. Many jobs require certifications in
addition to at least a BS in a technical field, along with some actual on-the-job experience.
Average Salary: $170,000
Job Opportunities Cont.
Security Analyst (Entry-level) - Information security analysts plan and carry out
security measures to protect an organization’s computer networks and systems.
Their responsibilities are continually expanding as the number of cyberattacks
increases.
Average Salary - $90,120
Questions?