Today Enterprise Customers are being faced with a range of threats right from insider access to SQL Injection attacks. To counter the threats effectively a Defense in Depth Solutions are required.
This document is intended to assist customers to deal with most critical threats using Oracle Security Solutions.
Top Database Security Threats
- Excessive Privileges
- Weak Authentication
- Information leakage from data at rest and in motion
- Loss of backup data/Disks
- Information leakage from Non-Critical System
- SQL Injection Attack
- Database Vulnerabilities
- Weak Audit Trail
By addressing these top threats, organizations will achieve the compliance and risk mitigation requirements.
Threat 1: Excessive Privileges
Most users and applications are granted database access privileges that exceed the requirements of the job. These privileges are abused and can be used for malicious purpose like modifying sensitive information. DBA being super user has privileges that exceed his requirement of day to day management and monitoring. Further other users get granted excessive privileges as DBA do not give time to define fine grained privileges that are sufficient for the task.
Oracle Database Vault: Provides Separation of Duty and fine-grained control & Oracle Advanced Security (Redaction)
Oracle Database Vault is the only solution which can restrict DBA access to sensitive data. It can Control database access with multifactor policies that are based on built-in factors such as time of day, IP address, application name, and authentication method. Consolidate databases and privileged users securely to safeguard enterprise data. Discover and report on captured runtime privileges and roles used in the database.
Oracle Advanced Security for Redacting data for Non Critical users with options of full masking,partial masking and full replacement of actual data , this is useful in cases of read only support users who require partial access to data to perform essential duties.
Threat 2: Weak Authentication
Weak Authentication mechanisms in the form of weak passwords, default passwords allow potential attackers to use this credential to steal data. They may employ different mechanisms like 1.) Force 2.) Social Engineering 3.) Copying stored credentials in excel files, notes etc.
How to prevent authentication attacks
The strongest practical authentication technologies and policies should be implemented. Two-factor authentication (tokens, certificates, biometrics, etc.) are preferable whenever possible. For cost effective and ease of use issues often make two-factor mechanism impractical. In such cases, strong username/password policy (minimum length, character diversity, obscurity, etc) should be enforced.
External Directory Integration
For scalability and ease of use, strong authentication mechanisms should be integrated with enterprise directory infrastructure. Among other things, a directory infrastructure can enable a user to use a single set of log-in credentials for multiple databases and applications. This makes two-factor authentication systems more cost effective and/or makes it much easier for users to memorize regularly change passwords.
Oracle Solution:
Oracle Database enables strong authentication with Oracle authentication adapters that support various third-party authentication services, including SSL with digital certificates. Oracle Advanced Security option provides for Two Factor Authentication using Kerberos, RADIUS, and Secure Sockets Layer (SSL).
Enterprise User Security is an important component of Oracle Database Enterprise Edition. It enables you to address administrative and security challenges for a large number of enterprise database users. Enterprise users are those users that are defined in a directory. Their identity remains constant throughout the enterprise. Enterprise User Security relies on Oracle Identity Management infrastructure, which in turn uses an LDAP-compliant directory service to centrally store and manage users.
Threat 3: Information leakage from data at rest and in motion
Data at Rest: Another security threat is when authentication and access mechanism are by-passed to access data directly. An OS user having access to database files can view data in these files or steal this database files and use tools to convert the data to text format.
Data in Motion: SQL Traffic flowing over the network can be sniffed for information , further potential attackers can use Man in the Middle Techniques to manipulate the data packets moving over the network and modifying the data.
Oracle Solution : Oracle Advanced Security
Oracle Advanced Security provides strong encryption mechanisms using Industry-standard encryption algorithms including AES (128, 192, and 256 bit keys). This relies on use of keys to encrypt data inside the database files and any access will require use of authentication and keys. Backend access and manipulation of data is prevented.
For Data in Motion Oracle Database Enterprise Edition provides data network encryption and integrity to ensure that data is secure as it travels across the network.
The purpose of a secure cryptosystem is to convert plaintext data into unintelligible ciphertext based on a key, in such a way that it is very hard (computationally infeasible) to convert ciphertext back into its corresponding plaintext without knowledge of the correct key.
Threat 4: Loss of backup data/Disks
In General backups are stored in disks, then in tapes. In case of loss of tapes or disks the entire data is exposed to third party. Disks replaced during storage refresh, faults etc also are points of data leakages.
Oracle Solution: Oracle Advanced Security
Oracle Advanced Security provides disk based or backup based encryption which will encrypt the data and without access to keys the data will be unusable for any practical purposes.
Threat 5: Information leakage from Non-Critical System
Most Production systems have a high degree of protection with access controls, processes and procedures in place. However, in most cases this data is copied to test systems as is without it be masked. In such cases the data of production is easily available to testers,developers , third party contractors to access and is prone to misuse. The test systems have virtually negligible to nil security mechanisms in place.
Oracle Solution : Oracle Data Masking and Subsetting
Oracle Data Masking and Subsettingallows production data to be masked when it is restored for test . This masked data can then be made available to testers & developers. PII data can be masked using different masking templates and formats.
Threat 6: SQL Injection Attack
Exploits that take advantage of SQL Injection (SQLi) vulnerabilities in software are among the most dangerous and prevalent attacks on the Internet today.
In a SQLi attack, hackers typically take advantage of security flaws in web application software to pass malicious commands to a database back-end. A SQLi vulnerability can potentially enable an attacker to take control of an entire database, exposing confidential information and leaving businesses and users at risk.
Oracle Solution: Oracle Audit Vault and Database Firewall accurately detects and blocks unauthorized database activity including SQL injection attacks by monitoring traffic to Oracle and non-Oracle databases. It utilizes a unique SQL grammar analysis engine and easy-to-define whitelists and blacklists to ensure high accuracy and performance. Provides enterprise security intelligence and efficient compliance reporting by combining monitoring and audit data
Threat 7 : Database Vulnerabilities
Despite best efforts to prevent database vulnerabilities, they get reported to database vendors who take note of these vulnerabilities and develop security patches to fix them. However, most customers the database is not regularly patched with the latest security patches. This leaves database vulnerable to attacks from known issues. Sometimes techniques used to exploit these vulnerabilities can be very old 5-10 years but are still used because the database version is old and not patched.
Oracle Solution: Oracle recommends applying PSU patched which are releases in every quarter to fix database vulnerabilities. Oracle also provide Database lifecycle management part of Oracle Enterprise Manager 13c which provides simplified patching process with predicable patching and pre-flight checks. It also enables you to manage the entire Oracle Database lifecycle—from asset discovery to configuration and change management.
Threat 8 : Weak Audit Trail
Auditing of all sensitive and/or unusual database transactions should be part of the foundation underlying any database deployment. A lack of database audit policy represents a serious organizational risk on many levels.
Regulatory Risk – Organizations with weak database audit mechanisms will increasingly find that they are not complying with government regulatory requirements.
Detective – Like CCTV recording provides a record of what activity took place , similiarly database audit helps deter attackers as their actions are being recorded and can provide links to their activities.
Recovery – Database auditing can aid in repair the records.
Oracle Solution: Oracle Audit Vault and Database Firewall
Oracle Audit Vault Solution consolidates audit data and logs generated by databases, operating systems, directories, file systems, and custom sources into a secure centralized repository. Provides enterprise security intelligence and efficient compliance reporting by combining monitoring and audit data.
For more Information Visit:
http://www.oracle.com/technetwork/database/security/index.html
The views expressed on this blog are my own and do not necessarily reflect the views of Oracle.
manojshringarpure 