1 / 27

Database Security

Database Security. An Overview. Why is database security important?. Databases often store data which is sensitive in nature Incorrect data or loss of data could negatively affect business operations Databases can be used as bases to attack other systems Data is a valuable resource.

keira
Télécharger la présentation

Database Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Database Security An Overview

  2. Why is database security important? • Databases often store data which is sensitive in nature • Incorrect data or loss of data could negatively affect business operations • Databases can be used as bases to attack other systems • Data is a valuable resource

  3. Database Vulnerability Exploitation A decade ago, attacks were • Broad based • Launched by disaffected “Hackers” • Intended to disrupt, gain respect / notoriety in the community Now, attacks are • Targeted against specific resources • Launched by sophisticated professionals • Intended to bring monetary gain to the attacker

  4. Meet a Hacker • Kevin Mitnick went on a two and a half year "coast-to-coast hacking spree." • He hacked into computers, stole corporate secrets, scrambled phone networks and broke into the national defense warning system. • There is no evidence that any damage was done.

  5. Meet a Hacker • Mitnick was caught and convicted in 1995. • He served five years, about 8 months of it in solitary confinement. • He is now a computer security consultant, author and speaker.

  6. Hacking Ethics • Justifications for hacking • All information should be free, and if it were free, there would be no need for intellectual property and security. • Break-ins illustrate security problems and cause them to be fixed. • Hackers are doing no harm; they are just learning about how computer systems operate. • Hackers break into systems to watch for abuse and hold "Big Brother" at bay.

  7. Hacking Ethics • Problems with hacking • Invasion of privacy • Theft of information • Trespassing/unauthorized entry • Potential for damage • Mitigation cost

  8. Hacking Legality • It is illegal to break and enter a private or public network without permission • Technology makes it easier for companies to identify hackers • Penalties • Fines from $500-10,000 • Up to 5 years in prison

  9. 2010 Report • 51 companies across 15 Industry Sectors were surveyed • Range – 4,200-105,000 compromised records per incident • Average cost per record $214 • Average incident cost $7.2 million dollars • 60%of customers terminated or considered terminating their relationship with the company after an incident • IT Preventative measures cost 4% of average breach http://www.symantec.com/content/en/us/about/media/pdfs/symantec_ponemon_data_breach_costs_report.pdf

  10. Why is Security Difficult? • No system can be 100% secure • Difficult to prove good security • Bad security gets proven for us • Good security and no security can look the same • Many things to secure • People, equipment, OS, network, Application Servers, applications, and databases

  11. Balancing the Business

  12. Hardening Databases • Follow the principle of least privilege • Manage user accounts • Create views • Use firewalls/access control • Enforce password security • Protect physical security • Be wary of SQL injection

  13. Principle of Least Privilege • Giving a user only those privileges which are essential to do his/her work • Databases and tables • Columns and rows • Actions • INSERT, UPDATE, DELETE • CREATE/DROP/ALTER • GRANT option • Connections • Allow Joe to login from any campus IP address • GRANT […] ON somedb.sometable TO joe@’128.255.0.0/255.255.0.0’;

  14. GRANT SELECT ON Employee TO Red GRANT SELECT ON Employee TO Black WITH GRANT OPTION GRANT UPDATE(Salary) ON Employee TO White Grant and Revoke Black Red Brown (owner) White

  15. Example • Create a user that has read-only access to the presidents table. CREATE USER 'black'@'localhost' IDENTIFIED BY 'black123'; GRANT SELECT ON sampdb.president TO black; SELECT * FROM president; SELECT * FROM student; DELETE FROM president WHERE first_name = ‘Calvin’

  16. Revoking Privileges GRANT SELECT ON sampdb.president TO black;REVOKE SELECT on sampdb.presidentFROM black; GRANT SELECT, UPDATE ON sampdb.studentTO red;REVOKE UPDATE on sampdb.studentFROM red; You can only revoke privileges that have been granted!

  17. Password Security • Strong passwords are a must • Default passwords are widely known & publicized • MySQL Defaults • Account: root / Password: null • Account: admin / Password: admin • Password policy control • Limit # of failed login attempts • Limit # of times password can be reused • Expire passwords after a certain length of time • Encrypt passwords

  18. Password Encryption CREATETABLEusers( username VARCHAR( 30 ) NOTNULL ,access_levelTINYINT( 1 ) ,passwordVARCHAR( 40 ) ,PRIMARYKEY ( username ) ); INSERTINTOusers VALUES ('jshmo', 1, SHA1( 'shmo123' )), ('ssmith', 2, SHA1( 'bubb13s' )); SELECT access_levelFROM usersWHERE username = 'jshmo'AND PASSWORD =  SHA1( 'shmo123' );

  19. Protect Physical Security • Database servers should be physically secure • Limit access to only authorized personnel • Protect against fire, power failure, water, and heat • Dispose properly of broken disk drives • Protect backup media

  20. Backup and Recovery • Common causes of database failure • Hardware failure • Program bug • Human error • Malicious actions • Recovery • Fallback procedures • Restore from backup • Replay database activities since backup http://dev.mysql.com/doc/refman/5.0/en/backup-and-recovery.html

  21. SQL Injection • SQL injection refers to the act of someone inserting a MySQL statement to be run on your database without your knowledge. • Injection usually occurs when you ask a user for input, like their name, and instead of a name they give you an SQL statement that you will unknowingly run on your database.

  22. How it Works $name = $_POST[‘name’]; $query = "SELECT * FROM customers WHERE username = '$name'"; echo $query . "<br />"; Name: Timmy SELECT * FROM customers WHERE username = 'timmy' Name: ' OR 'x'='x SELECT * FROM customers WHERE username = '' OR ‘x’=‘x’

  23. How it Works $name = $_POST[‘name’]; $query = "SELECT * FROM customers WHERE username = '$name'"; echo $query . "<br />"; Name: '; DELETE FROM customers WHERE 1 or username = ' SELECT * FROM customers WHERE username = ' '; DELETE FROM customers WHERE 1 or username = ' '

  24. Preventing SQL injection • Filter data using mysql_real_escape_string() • Check that each piece of data is the right type • Use prepared statements SELECT * FROM customers WHERE username = ‘\' OR \‘x\’=\‘x’

  25. Prepared Statements <?php$stmt = $dbh-> prepare("INSERT INTO REGISTRY (name, value) VALUES (:name, :value)");$stmt->bindParam(':name', $name);$stmt->bindParam(':value', $value);// insert one row$name = 'one';$value = 1;$stmt->execute();// insert another row with different values$name = 'two';$value = 2;$stmt->execute();?>

  26. Establishing a Security Mindset • Be Curious • Be Proactive • Be Paranoid • Be Cautious • Be Educated • Be a Minimalist • Be Vigilant

  27. Resources • D.Litchfield, C.Anley, J. Heasman, B. Grindlay, The Database Hacker’s Handbook – Defending Database Servers, Indianapolis: Wiley Publishing Inc., 2005. • http://databasesecurity.com • http://blogs.msdn.com/raulga/archive/2007/01/04/dynamic-sql-sql-injection.aspx • http://msdn.microsoft.com/msdnmag/issues/05/06/SQLServerSecurity/default.aspx • http://www.cgisecurity.com

More Related