Application Security // Database Security
10/7/2013
07:16 PM
Adrian Lane
Adrian Lane
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Evasion Techniques And Sneaky DBAs

Why should DBAs introduce security measures that make their jobs harder for the nebulous benefit of better security?

Evasion techniques.

No, not the type you find with SQLi -- rather, the type that database administrators like to use on security people. Yes, DBAs know that most security people don't know jack about databases. It takes years to know the ins and outs of complex relational platforms. Security folks are simply unaware of what security controls are possible and what the downsides might be. The administrators can choose to tell any fable or omit whatever information they choose; the security team will be none the wiser. I get it.

From the DBA's perspective, why introduce security measures that make your job harder for the nebulous benefit of better security? So they omit capabilities from discussions. Or skew the difficulty of implementing security controls, or talk of "destabilizing" the database, or performance impact or something similar.

I had one such discussion with a security practitioner last week. There were three specific capabilities with the database that he wanted -- user identities in the audit trail, segregation of admin roles, and data encryption -- and the DBAs said they could not provide. Respectively, the reasons were "it can't be done," "the database does not support that," and "it's a performance problem." The problem is none of these statements are true: In fact, they are all rather easy to do.

Since the database was Oracle, let's get a bit more specific:

User ID And Connection Pooling:
When you use the connection pooling option for Oracle, you establish a bunch of connections to the database before you need them. The benefit is that you get a connection to the database, fast, without the timely authentication process. The downside is that these pools are set up under a generic service account user. And if you use audit trails to track activity, all activity is performed under the generic account, so you have no idea who did what. However, there is a client_id setting in the network connection string. If you add one or two lines of code to the application, you can -- without performance impact or reliability issue -- ties the real user ID to the event.

Segregation Of Admin Duties
Oracle did a great thing with version 11 in that it made it possible to divvy up admin roles on a database. For example, the account for making backups could be different from the account for adding users, which could be different from the account that applies patches, and so on. So you knew which DBA did what. The downside is it requires DBAs to log in with different credentials to do these tasks, but the upside is that a single compromised account does not have total ownership of the database. It takes a little work to set up, and it annoys DBAs for the first year or so, but entirely possible.

Disk Encryption
Oracle offers disk encryption as an add-on package to the database, which is seamless to database services and requires no code changes. Several third-party commercial vendors offer disk-level encryption that is also seamless to database operations. And I can say from personal experience that these options are very fast, with typically less than 5 percent performance overhead worst case. And as long as you use a good key management server, it's pretty secure. It's as simple as setting an environment variable to turn in on, so it's not complicated.

I can't blame DBAs for being sneaky as they just want to keep their lives less complicated, but a handful of simple security controls goes a long way toward keeping databases secure.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security analyst firm. Special to Dark Reading.

Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

CVE-2014-7292
Published: 2014-10-23
Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to ct.ashx.

CVE-2014-8071
Published: 2014-10-23
Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) familyName, (3) address1, or (4) address2 parameter to registrationapp/registerPatient.page; the (5) comment parameter to all...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.