03:00 PM
Connect Directly

You've Been Breached: Now What?

Logs are a key component of an incident response plan if your database gets attacked.

InformationWeek Green - Dec. 20, 2010 InformationWeek Green
Download the entire Dec. 20, 2010, issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree
for each of the first 5,000 downloads.

No one likes to think about database breaches, but the fact is, they happen. Rather than cross your fingers and hope for the best, create an incident response plan ahead of time. Without a plan, you may destroy critical evidence that could be used to prosecute the offender. You might also overlook just how the incident occurred, leaving you exposed to future breaches.

Log analysis is an essential component of an incident response plan. You'll want to review logs from the compromised machine or machines and from other sources, including network devices and access control systems.

A number of log types--transaction, server access, application server, and OS--can all provide valuable information to retrace what occurred. If your database administrator has enabled transaction logs--and it's a big if--start there because they're a rich source of information.

Your first goal is to understand what data has been extracted, which will help you gauge the current risk to the company. Then examine what else the attacker may have tried to do. As you review logs, look for queries that would match the data known to be exported. If you don't have any evidence to match against, gather up the database administrator, application developer, and anyone else who knows normal application and database activity. Get a conference room, display the logs on a projector, and have them help you look for anomalies such as unusual queries that applications or administrators wouldn't normally make.

Search logs for evidence of SELECT statements and examine the results for those that appear to be out of the norm. This is where having a DBA or application developer on hand will help. They know the applications that access this database server and can pick out suspect queries, such as those that return more records than normal, are formatted differently, or are preceded by erroneous requests. For example, improper SQL statement formats are common when an attacker doesn't know the database structure and is attempting to blindly guess database, table, and row names. In addition to SELECT statements, look for INSERTS, DELETES, DROPS, or command execution queries.

The attacker may also have attempted to insert a database account, edit logs, or execute system commands from within the database, among other tactics.

1 of 2
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio