Segmenting, hardening, encrypting, insuring, and planning--these are good New Year's resolutions for database administrators.
As organizations gear up for a new year, now is the perfect time to look at processes and technologies and reassess how well they really are mitigating risks. On the database level, there are a number of foundational activities that many organizations are still failing to carry out effectively.
The following action list is compiled from some of the advice doled out by database security experts in 2011. Use it wisely to come up with a sane plan in 2012 and beyond:
1. Make Sure Your Database Isn't Easily Searchable On The Web
Several breaches this year embarrassed organizations because their IT departments configured databases touching Web-facing interfaces in such a way that they could be easily searched on the Web.
"The databases that exist today have ultimately been designed to allow the easiest access from a multitude of devices and places. In many people's minds, they think you need to access a server with an application running on that, and that there is a measure of safety for the data sitting underneath the application because the application is secure," said Dr. Mike Lloyd, CTO of RedSeal Systems. "But your database is sitting out there, and, in many cases, when it came out of the box, it came configured to be connected to the Internet."
2. Segment Your Data Better
When organizations segment their high-value data in databases separate from less sensitive information, they're able to prioritize risk management and institute more targeted protection layers.
"Medium to large organizations are not segmenting enough," said Chris Novak, managing principal at Verizon Business. "In these organizations, they've got databases spread over offices, campuses, and complexes around the globe. And the problem is that if they're not segmenting, then a risk in one place becomes a risk everywhere."
Database access controls keep information out of the wrong hands. Limit who sees what to stop leaks--accidental and otherwise. Also in the new, all-digital Dark Reading supplement: Why user provisioning isn't as simple as it sounds. Download the supplement now. (Free registration required.)
Published: 2015-10-15 The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...
Published: 2015-10-15 Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.
Published: 2015-10-15 Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.