Application Security // Database Security
10/7/2013
07:16 PM
Adrian Lane
Adrian Lane
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Evasion Techniques And Sneaky DBAs

Why should DBAs introduce security measures that make their jobs harder for the nebulous benefit of better security?

Evasion techniques.

No, not the type you find with SQLi -- rather, the type that database administrators like to use on security people. Yes, DBAs know that most security people don't know jack about databases. It takes years to know the ins and outs of complex relational platforms. Security folks are simply unaware of what security controls are possible and what the downsides might be. The administrators can choose to tell any fable or omit whatever information they choose; the security team will be none the wiser. I get it.

From the DBA's perspective, why introduce security measures that make your job harder for the nebulous benefit of better security? So they omit capabilities from discussions. Or skew the difficulty of implementing security controls, or talk of "destabilizing" the database, or performance impact or something similar.

I had one such discussion with a security practitioner last week. There were three specific capabilities with the database that he wanted -- user identities in the audit trail, segregation of admin roles, and data encryption -- and the DBAs said they could not provide. Respectively, the reasons were "it can't be done," "the database does not support that," and "it's a performance problem." The problem is none of these statements are true: In fact, they are all rather easy to do.

Since the database was Oracle, let's get a bit more specific:

User ID And Connection Pooling:
When you use the connection pooling option for Oracle, you establish a bunch of connections to the database before you need them. The benefit is that you get a connection to the database, fast, without the timely authentication process. The downside is that these pools are set up under a generic service account user. And if you use audit trails to track activity, all activity is performed under the generic account, so you have no idea who did what. However, there is a client_id setting in the network connection string. If you add one or two lines of code to the application, you can -- without performance impact or reliability issue -- ties the real user ID to the event.

Segregation Of Admin Duties
Oracle did a great thing with version 11 in that it made it possible to divvy up admin roles on a database. For example, the account for making backups could be different from the account for adding users, which could be different from the account that applies patches, and so on. So you knew which DBA did what. The downside is it requires DBAs to log in with different credentials to do these tasks, but the upside is that a single compromised account does not have total ownership of the database. It takes a little work to set up, and it annoys DBAs for the first year or so, but entirely possible.

Disk Encryption
Oracle offers disk encryption as an add-on package to the database, which is seamless to database services and requires no code changes. Several third-party commercial vendors offer disk-level encryption that is also seamless to database operations. And I can say from personal experience that these options are very fast, with typically less than 5 percent performance overhead worst case. And as long as you use a good key management server, it's pretty secure. It's as simple as setting an environment variable to turn in on, so it's not complicated.

I can't blame DBAs for being sneaky as they just want to keep their lives less complicated, but a handful of simple security controls goes a long way toward keeping databases secure.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security analyst firm. Special to Dark Reading.

Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-0360
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

CVE-2012-1317
Published: 2014-04-23
The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.

CVE-2012-1366
Published: 2014-04-23
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.

CVE-2012-3062
Published: 2014-04-23
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.

CVE-2012-3918
Published: 2014-04-23
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.

Best of the Web