Application Security // Database Security
2/6/2012
09:33 AM
Adrian Lane
Adrian Lane
Commentary
50%
50%

A Response To NoSQL Security Concerns

Three key takeaways from a recent webcast about database security in the NoSQL database movement

In response to Ericka Chickowski's article "Does NoSQL Mean No Security?" I was asked to attend a webcast with executives from CouchBase and 10Gen -- makers of MongoDB. The goal was to discuss database security in the NoSQL database movement and address some of the accusations made in Ericka's post. I encourage you to listen; it's illuminating for developers and security professionals alike.

From a security perspective -- this is a database security blog, after-all -- you may think I'm casting stones at the security "nonbelievers." Not so. The goal is to share the perspective so you understand what NoSQL security facilities are available to you and why that's the case.

Here are what I consider to be the key takeaways from this recent webcast:

1. Security By Design: All of the NoSQL providers I have spoken with, including Couch and Mongo DB, do have some security within their development life cycle. Usually there are design choices to address specific threats and some tests provided in the quality-assurance phase of the application development life cycle. But statements by the webcast participants make it clear that these precautions are minimal. They compose a tiny fraction of the overall development resources. And that's the way it should be. Each flavor of NoSQL is designed to meet a specific challenge, be it handling very large datasets, redundancy, map-reduce analytics and metrics gathering, or focusing on specific types of content. Security is not the goal -- never was, it's not today, and won't be for some time. If you don't like it, then use something else. Or you can augment your application to provide the missing security layer. You also can alter what you store in the database, but don't bet on your big data repository being secure.

2. Security Model: It's clear, both through the interviews I've had and design documents I've read, that the NoSQL security model is for the databases to be buried deep within an IT organization and behind other systems. Everything I have heard clearly states that the security model intends for the database to reside in a secure environment, protected by a firewall and access controls fronting any application. This is the old-school view of network security where you keep outsiders out of your network and everything will be fine. The irony is that just about every application platform designed specifically for use with NoSQL databases is a Web-centric (Node.js, Java, Ruby on Rails, PHP) application. Having an open front end universally accessible from any Web browser makes development easier, but the open user-interface vision is at odds with a behind-closed-door security model.

3. Dumb Data Bucket: NoSQL is a giant data bucket. While relational database systems are designed to maintain tight controls of data, NoSQL provides loose controls over datasets. Relational systems use metadata to precisely control data type,and heavily synchronized process controls to maintain data integrity. NoSQL uses loosely synchronized processes to scatter data across many systems, with small regard for the status of any one server or quality of data being stored. That's not a negative judgment against NoSQL; rather, I am stressing the philosophical differences in approach needed to meet the core design goals. It's a giant self-organizing bucket you put data in. Once again, don't expect it to be secure. If you want security, then build it into your application. Or only store secured (encrypted, anonymized, tokenized) data. But don't expect the bucket to do much more than efficiently store your data.

Open-source NoSQL databases are a greenfield opportunity for security vendors; monitoring, assessment, access control packages, labeling, and masking are all needed technologies.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4231
Published: 2015-07-03
The Python interpreter in Cisco NX-OS 6.2(8a) on Nexus 7000 devices allows local users to bypass intended access restrictions and delete an arbitrary VDC's files by leveraging administrative privileges in one VDC, aka Bug ID CSCur08416.

CVE-2015-4232
Published: 2015-07-03
Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.

CVE-2015-4234
Published: 2015-07-03
Cisco NX-OS 6.0(2) and 6.2(2) on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127.

CVE-2015-4237
Published: 2015-07-03
The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv0...

CVE-2015-4239
Published: 2015-07-03
Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report