Application Security // Database Security
2/6/2012
09:33 AM
Adrian Lane
Adrian Lane
Commentary
Connect Directly
RSS
E-Mail
50%
50%

A Response To NoSQL Security Concerns

Three key takeaways from a recent webcast about database security in the NoSQL database movement

In response to Ericka Chickowski's article "Does NoSQL Mean No Security?" I was asked to attend a webcast with executives from CouchBase and 10Gen -- makers of MongoDB. The goal was to discuss database security in the NoSQL database movement and address some of the accusations made in Ericka's post. I encourage you to listen; it's illuminating for developers and security professionals alike.

From a security perspective -- this is a database security blog, after-all -- you may think I'm casting stones at the security "nonbelievers." Not so. The goal is to share the perspective so you understand what NoSQL security facilities are available to you and why that's the case.

Here are what I consider to be the key takeaways from this recent webcast:

1. Security By Design: All of the NoSQL providers I have spoken with, including Couch and Mongo DB, do have some security within their development life cycle. Usually there are design choices to address specific threats and some tests provided in the quality-assurance phase of the application development life cycle. But statements by the webcast participants make it clear that these precautions are minimal. They compose a tiny fraction of the overall development resources. And that's the way it should be. Each flavor of NoSQL is designed to meet a specific challenge, be it handling very large datasets, redundancy, map-reduce analytics and metrics gathering, or focusing on specific types of content. Security is not the goal -- never was, it's not today, and won't be for some time. If you don't like it, then use something else. Or you can augment your application to provide the missing security layer. You also can alter what you store in the database, but don't bet on your big data repository being secure.

2. Security Model: It's clear, both through the interviews I've had and design documents I've read, that the NoSQL security model is for the databases to be buried deep within an IT organization and behind other systems. Everything I have heard clearly states that the security model intends for the database to reside in a secure environment, protected by a firewall and access controls fronting any application. This is the old-school view of network security where you keep outsiders out of your network and everything will be fine. The irony is that just about every application platform designed specifically for use with NoSQL databases is a Web-centric (Node.js, Java, Ruby on Rails, PHP) application. Having an open front end universally accessible from any Web browser makes development easier, but the open user-interface vision is at odds with a behind-closed-door security model.

3. Dumb Data Bucket: NoSQL is a giant data bucket. While relational database systems are designed to maintain tight controls of data, NoSQL provides loose controls over datasets. Relational systems use metadata to precisely control data type,and heavily synchronized process controls to maintain data integrity. NoSQL uses loosely synchronized processes to scatter data across many systems, with small regard for the status of any one server or quality of data being stored. That's not a negative judgment against NoSQL; rather, I am stressing the philosophical differences in approach needed to meet the core design goals. It's a giant self-organizing bucket you put data in. Once again, don't expect it to be secure. If you want security, then build it into your application. Or only store secured (encrypted, anonymized, tokenized) data. But don't expect the bucket to do much more than efficiently store your data.

Open-source NoSQL databases are a greenfield opportunity for security vendors; monitoring, assessment, access control packages, labeling, and masking are all needed technologies.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.