Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security //

Database Security

10/7/2013
07:16 PM
Adrian Lane
Adrian Lane
Commentary
50%
50%

Evasion Techniques And Sneaky DBAs

Why should DBAs introduce security measures that make their jobs harder for the nebulous benefit of better security?

Evasion techniques.

No, not the type you find with SQLi -- rather, the type that database administrators like to use on security people. Yes, DBAs know that most security people don't know jack about databases. It takes years to know the ins and outs of complex relational platforms. Security folks are simply unaware of what security controls are possible and what the downsides might be. The administrators can choose to tell any fable or omit whatever information they choose; the security team will be none the wiser. I get it.

From the DBA's perspective, why introduce security measures that make your job harder for the nebulous benefit of better security? So they omit capabilities from discussions. Or skew the difficulty of implementing security controls, or talk of "destabilizing" the database, or performance impact or something similar.

I had one such discussion with a security practitioner last week. There were three specific capabilities with the database that he wanted -- user identities in the audit trail, segregation of admin roles, and data encryption -- and the DBAs said they could not provide. Respectively, the reasons were "it can't be done," "the database does not support that," and "it's a performance problem." The problem is none of these statements are true: In fact, they are all rather easy to do.

Since the database was Oracle, let's get a bit more specific:

User ID And Connection Pooling:
When you use the connection pooling option for Oracle, you establish a bunch of connections to the database before you need them. The benefit is that you get a connection to the database, fast, without the timely authentication process. The downside is that these pools are set up under a generic service account user. And if you use audit trails to track activity, all activity is performed under the generic account, so you have no idea who did what. However, there is a client_id setting in the network connection string. If you add one or two lines of code to the application, you can -- without performance impact or reliability issue -- ties the real user ID to the event.

Segregation Of Admin Duties
Oracle did a great thing with version 11 in that it made it possible to divvy up admin roles on a database. For example, the account for making backups could be different from the account for adding users, which could be different from the account that applies patches, and so on. So you knew which DBA did what. The downside is it requires DBAs to log in with different credentials to do these tasks, but the upside is that a single compromised account does not have total ownership of the database. It takes a little work to set up, and it annoys DBAs for the first year or so, but entirely possible.

Disk Encryption
Oracle offers disk encryption as an add-on package to the database, which is seamless to database services and requires no code changes. Several third-party commercial vendors offer disk-level encryption that is also seamless to database operations. And I can say from personal experience that these options are very fast, with typically less than 5 percent performance overhead worst case. And as long as you use a good key management server, it's pretty secure. It's as simple as setting an environment variable to turn in on, so it's not complicated.

I can't blame DBAs for being sneaky as they just want to keep their lives less complicated, but a handful of simple security controls goes a long way toward keeping databases secure.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security analyst firm. Special to Dark Reading.

Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4108
PUBLISHED: 2019-11-14
Multiple unspecified vulnerabilities in Cryptocat Project Cryptocat 2.0.18 have unknown impact and attack vectors.
CVE-2018-12207
PUBLISHED: 2019-11-14
Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.
CVE-2019-0117
PUBLISHED: 2019-11-14
Insufficient access control in protected memory subsystem for Intel(R) SGX for 6th, 7th, 8th, 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Xeon(R) Processor E3-1500 v5, v6 Families; Intel(R) Xeon(R) E-2100 & E-2200 Processor Families with Intel(R) Processor Graphics may allow a ...
CVE-2019-0123
PUBLISHED: 2019-11-14
Insufficient memory protection in Intel(R) 6th Generation Core Processors and greater, supporting SGX, may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2019-0124
PUBLISHED: 2019-11-14
Insufficient memory protection in Intel(R) 6th Generation Core Processors and greater, supporting TXT, may allow a privileged user to potentially enable escalation of privilege via local access.