Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

5/31/2011
08:21 PM
Adrian Lane
Adrian Lane
Commentary
50%
50%

Sharing Relational Data In The Cloud

Databases are designed to share data, so it's easy to leverage built-in security for cloud services

Sharing relational data in the cloud is by far the easiest activity to secure. Why? Because relational databases are architected to share data. They form a central repository that is designed to serve data when requested by authorized parties. And they provide the infrastructure to support multiple applications, application clusters, and mirrored data sets. SaaS, PaaS, or IaaS -- it does not matter because the general model is consistent. (And remember, I am following the Cloud Security Alliance guidance for the data security life cycle and applying those principles to databases).

Because databases are designed to share data, most of the controls you want to use are built in: access control gate user access; authorization mapping with groups and roles, along with views, compartmentalize data. Labeling further limits data accessibility. Masking obfuscates information presented to users you don't fully trust. Encryption of network traffic keeps data private. All of these are features you are already familiar with and part of the database. These controls are extended by the applications that access the data, including application-layer encryption, multiple database repositories, or schemas, to divide content, and application logic to enhance fined grained control. It's really nothing different than what you need to do in your current environment.

There are only a couple of new threats we are worried about that are new to the cloud environment: how you share information through the application, and sharing information through the infrastructure.

In the first scenario, it's important to remember your data is being stored in a multi-tenant environment. There have been several documented cases where access controls and session management features have failed, exposing user accounts arbitrarily to new users (Facebook, for example). Also remember that your cloud provider has administrators who have access to the infrastructure for problem solving and general maintenance of the systems. It's possible to leverage those credentials to view your data. It's wise to use your own external access control systems -- or those embedded within the database -- to avoid any cascade of failure. Two-factor authentication -- using tokens or certificates -- helps address this issue as well.

If sharing data means more that just opening your databases to queries, such as providing archives or mirroring database servers, you'll need to verify the means of conveyance is secure. How they move and store data behind the scenes is most likely not the same as how you do it in-house, so find out the details. For example, if your vendor is providing data mirroring, how is that performed? You'll need to speak with them to verify the security controls because the data is moved and stored. Or, if you are exporting and reimporting archives at different locations, ensure that the archives are encrypted prior to being written to storage. In many ways this is similar to data usage, which was discussed in the last post.

Finally, the guidance recommends activity monitoring and data loss prevention technologies for general data security. I recommend database activity monitoring because it is specifically designed for monitoring database queries and auditing database transactions. It's effective at identifying malicious queries or hijacked credentials. What I don't recommend for databases is data loss prevention; while mentioned in the guidance, this technology is much better-suited for control of the endpoint and filtering network traffic looking for sensitive information. That's great for a generic filter, but with databases we already know we have sensitive information -- we want to verify how data is being shared, and that requires analysis of the individual statements.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading.

Quick reference: Part 1 Intro, Part 2 Cloud Database Models, Part 3 Data Security Lifecycle, Part 4 Create, Part 5 Store, Part 6 Usage. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4662
PUBLISHED: 2020-08-14
IBM Event Streams 10.0.0 could allow an authenticated user to perform tasks to a schema due to improper authentication validation. IBM X-Force ID: 186233.
CVE-2019-20383
PUBLISHED: 2020-08-13
ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges by local users via manipulations involving files and using symbolic links.
CVE-2020-24348
PUBLISHED: 2020-08-13
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.
CVE-2020-24349
PUBLISHED: 2020-08-13
njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface.
CVE-2020-7360
PUBLISHED: 2020-08-13
An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path. This issue was fixed in version 1.0.7, which was r...