Perimeter
9/19/2011
01:16 PM
Adrian Lane
Adrian Lane
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Segregating DBA And Admin Duties

Keeping platform admins out of your database

A reader's question via email asked for an elaboration on separation of duties (SoD) between DBAs and IT administrators. SoD gets lumped in with compliance requirements, but, in reality, it's a critical security concern, so I thought it would be beneficial to dig into this topic.

The idea is that you don't want the administrator of the platform to access the database internals, alter database functions, or arbitrarily view the contents of the database.

IT's job is to ensure the underlying machines -- real or virtual -- support the database engine. That role does not permit them access to the database. It's the database administrators job to make sure the database application performs correctly, that database users have appropriate permissions to do their jobs, and that critical database controls are secured. The two roles should overlap as little as possible.

The fewer the number of people accessing database controls, the less likely it is for a rogue employee to steal data. Closing off the avenues to which a DBA can access the underlying OS -- or removing facilities IT administrators' use to access the database -- makes it less likely an attacker can compromise it.

This is not just theory, either. Just look at the history of database attacks: Though SQL injection gets the headlines now, it was not always that way. The bidirectional exploitation of external procedures was the most damaging tool in an attacker's arsenal. That's because if you could get into the database, the external procedure allowed use of OS or shell commands, leveraging a database attack into a platform compromise.

Similarly, if an attacker could gain access to the host, then it was easy to compromise the database. When database security became a problem a decade ago, patches and vulnerability assessment policy updates invariably contained fixes to limit database-to-platform security issues. Today, every Fortune 1000 IT organization enforces separation of duties between the IT and database administrators for security and compliance reasons.

There are four basic configuration steps to aid in separation of duties between the platform administrator and the database administrator.

1. Turn off external stored procedures. Every database platform offers a pathway for the database to use OS commands, as well as database interfaces from the OS layer. Commonly called "external stored procedures," these are nothing more than OS utilities accessed by the database much in the same way a user would call an internal procedure (i.e., SQL statements). You'll need to revoke permissions to these utilities from all users, including administrators. In rare cases, you can remove these functions entirely because they are included as an add-on package. In most cases, however, revoking user rights is enough.

2. Don't provide local IT admins with DBA credentials, and don't use the same user name and password. IT admins have no reason to be able to log into the database. If your IT department is one person, then it might not make sense to have that person use a second login to manage each platform -- but, trust me, you want this extra layer of protection. If an attacker can hijack one account, then he automatically has permission to the other when you share credentials.

3. Don't install the database under the local IT admin account. This means the database is the local admin, and the DBA has admin rights to the local platform. Similarly, if the database is installed as the local IT admin, then the admin can run database commands. You want the database to run as a separate user who is not the domain or local platform administrator. And you want the database files and archives to be readable by only the account the database is installed under.

4. Don't use mixed mode credential management: Use domain. Your IT department likely uses Active Directory or LDAP to manage user accounts. But every database has built-in user management as well. You want the database to manage generic roles and groups per database function, and the domain to manage actual users. Don't use mixed-mode authentication because it allows an attacker to choose one that suits his purpose, and often allows him to access administrative privileges.

Maintaining separation between platform and database administrators offers an extra degree of security. Once a skilled attacker gains access to the database, the first thing he will do is attain extra privileges, and the second is to open holes to the OS in order to write and execute code.

These steps provided are the basic steps, but it's likely you will want to take extra measures, such as segregation of the DBA role and monitor permissions changes to detect attacks.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-0460
Published: 2014-04-16
The init script in kbd, possibly 1.14.1 and earlier, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/defkeymap.map.

CVE-2011-0993
Published: 2014-04-16
SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.

CVE-2011-3180
Published: 2014-04-16
kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

CVE-2011-4089
Published: 2014-04-16
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.

CVE-2011-4192
Published: 2014-04-16
kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double quotes in kiwi_oemtitle of .profile."

Best of the Web