Perimeter
9/19/2011
01:16 PM
Adrian Lane
Adrian Lane
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Segregating DBA And Admin Duties

Keeping platform admins out of your database

A reader's question via email asked for an elaboration on separation of duties (SoD) between DBAs and IT administrators. SoD gets lumped in with compliance requirements, but, in reality, it's a critical security concern, so I thought it would be beneficial to dig into this topic.

The idea is that you don't want the administrator of the platform to access the database internals, alter database functions, or arbitrarily view the contents of the database.

IT's job is to ensure the underlying machines -- real or virtual -- support the database engine. That role does not permit them access to the database. It's the database administrators job to make sure the database application performs correctly, that database users have appropriate permissions to do their jobs, and that critical database controls are secured. The two roles should overlap as little as possible.

The fewer the number of people accessing database controls, the less likely it is for a rogue employee to steal data. Closing off the avenues to which a DBA can access the underlying OS -- or removing facilities IT administrators' use to access the database -- makes it less likely an attacker can compromise it.

This is not just theory, either. Just look at the history of database attacks: Though SQL injection gets the headlines now, it was not always that way. The bidirectional exploitation of external procedures was the most damaging tool in an attacker's arsenal. That's because if you could get into the database, the external procedure allowed use of OS or shell commands, leveraging a database attack into a platform compromise.

Similarly, if an attacker could gain access to the host, then it was easy to compromise the database. When database security became a problem a decade ago, patches and vulnerability assessment policy updates invariably contained fixes to limit database-to-platform security issues. Today, every Fortune 1000 IT organization enforces separation of duties between the IT and database administrators for security and compliance reasons.

There are four basic configuration steps to aid in separation of duties between the platform administrator and the database administrator.

1. Turn off external stored procedures. Every database platform offers a pathway for the database to use OS commands, as well as database interfaces from the OS layer. Commonly called "external stored procedures," these are nothing more than OS utilities accessed by the database much in the same way a user would call an internal procedure (i.e., SQL statements). You'll need to revoke permissions to these utilities from all users, including administrators. In rare cases, you can remove these functions entirely because they are included as an add-on package. In most cases, however, revoking user rights is enough.

2. Don't provide local IT admins with DBA credentials, and don't use the same user name and password. IT admins have no reason to be able to log into the database. If your IT department is one person, then it might not make sense to have that person use a second login to manage each platform -- but, trust me, you want this extra layer of protection. If an attacker can hijack one account, then he automatically has permission to the other when you share credentials.

3. Don't install the database under the local IT admin account. This means the database is the local admin, and the DBA has admin rights to the local platform. Similarly, if the database is installed as the local IT admin, then the admin can run database commands. You want the database to run as a separate user who is not the domain or local platform administrator. And you want the database files and archives to be readable by only the account the database is installed under.

4. Don't use mixed mode credential management: Use domain. Your IT department likely uses Active Directory or LDAP to manage user accounts. But every database has built-in user management as well. You want the database to manage generic roles and groups per database function, and the domain to manage actual users. Don't use mixed-mode authentication because it allows an attacker to choose one that suits his purpose, and often allows him to access administrative privileges.

Maintaining separation between platform and database administrators offers an extra degree of security. Once a skilled attacker gains access to the database, the first thing he will do is attain extra privileges, and the second is to open holes to the OS in order to write and execute code.

These steps provided are the basic steps, but it's likely you will want to take extra measures, such as segregation of the DBA role and monitor permissions changes to detect attacks.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6213
Published: 2014-04-19
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.

CVE-2013-6214
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.

CVE-2014-0778
Published: 2014-04-19
The TCPUploader module in Progea Movicon 11.4 before 11.4.1150 allows remote attackers to obtain potentially sensitive version information via network traffic to TCP port 10651.

CVE-2014-1974
Published: 2014-04-19
Directory traversal vulnerability in LYSESOFT AndExplorer before 20140403 and AndExplorerPro before 20140405 allows attackers to overwrite or create arbitrary files via unspecified vectors.

CVE-2014-1983
Published: 2014-04-19
Unspecified vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to cause a denial of service (CPU consumption) via unknown vectors.

Best of the Web