Application Security // Database Security
10/7/2013
07:16 PM
Adrian Lane
Adrian Lane
Commentary
50%
50%

Evasion Techniques And Sneaky DBAs

Why should DBAs introduce security measures that make their jobs harder for the nebulous benefit of better security?

Evasion techniques.

No, not the type you find with SQLi -- rather, the type that database administrators like to use on security people. Yes, DBAs know that most security people don't know jack about databases. It takes years to know the ins and outs of complex relational platforms. Security folks are simply unaware of what security controls are possible and what the downsides might be. The administrators can choose to tell any fable or omit whatever information they choose; the security team will be none the wiser. I get it.

From the DBA's perspective, why introduce security measures that make your job harder for the nebulous benefit of better security? So they omit capabilities from discussions. Or skew the difficulty of implementing security controls, or talk of "destabilizing" the database, or performance impact or something similar.

I had one such discussion with a security practitioner last week. There were three specific capabilities with the database that he wanted -- user identities in the audit trail, segregation of admin roles, and data encryption -- and the DBAs said they could not provide. Respectively, the reasons were "it can't be done," "the database does not support that," and "it's a performance problem." The problem is none of these statements are true: In fact, they are all rather easy to do.

Since the database was Oracle, let's get a bit more specific:

User ID And Connection Pooling:
When you use the connection pooling option for Oracle, you establish a bunch of connections to the database before you need them. The benefit is that you get a connection to the database, fast, without the timely authentication process. The downside is that these pools are set up under a generic service account user. And if you use audit trails to track activity, all activity is performed under the generic account, so you have no idea who did what. However, there is a client_id setting in the network connection string. If you add one or two lines of code to the application, you can -- without performance impact or reliability issue -- ties the real user ID to the event.

Segregation Of Admin Duties
Oracle did a great thing with version 11 in that it made it possible to divvy up admin roles on a database. For example, the account for making backups could be different from the account for adding users, which could be different from the account that applies patches, and so on. So you knew which DBA did what. The downside is it requires DBAs to log in with different credentials to do these tasks, but the upside is that a single compromised account does not have total ownership of the database. It takes a little work to set up, and it annoys DBAs for the first year or so, but entirely possible.

Disk Encryption
Oracle offers disk encryption as an add-on package to the database, which is seamless to database services and requires no code changes. Several third-party commercial vendors offer disk-level encryption that is also seamless to database operations. And I can say from personal experience that these options are very fast, with typically less than 5 percent performance overhead worst case. And as long as you use a good key management server, it's pretty secure. It's as simple as setting an environment variable to turn in on, so it's not complicated.

I can't blame DBAs for being sneaky as they just want to keep their lives less complicated, but a handful of simple security controls goes a long way toward keeping databases secure.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security analyst firm. Special to Dark Reading.

Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-7839
Published: 2014-11-25
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

CVE-2014-8001
Published: 2014-11-25
Buffer overflow in decode.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

CVE-2014-8002
Published: 2014-11-25
Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?