Perimeter
9/19/2011
01:16 PM
Adrian Lane
Adrian Lane
Commentary
50%
50%

Segregating DBA And Admin Duties

Keeping platform admins out of your database

A reader's question via email asked for an elaboration on separation of duties (SoD) between DBAs and IT administrators. SoD gets lumped in with compliance requirements, but, in reality, it's a critical security concern, so I thought it would be beneficial to dig into this topic.

The idea is that you don't want the administrator of the platform to access the database internals, alter database functions, or arbitrarily view the contents of the database.

IT's job is to ensure the underlying machines -- real or virtual -- support the database engine. That role does not permit them access to the database. It's the database administrators job to make sure the database application performs correctly, that database users have appropriate permissions to do their jobs, and that critical database controls are secured. The two roles should overlap as little as possible.

The fewer the number of people accessing database controls, the less likely it is for a rogue employee to steal data. Closing off the avenues to which a DBA can access the underlying OS -- or removing facilities IT administrators' use to access the database -- makes it less likely an attacker can compromise it.

This is not just theory, either. Just look at the history of database attacks: Though SQL injection gets the headlines now, it was not always that way. The bidirectional exploitation of external procedures was the most damaging tool in an attacker's arsenal. That's because if you could get into the database, the external procedure allowed use of OS or shell commands, leveraging a database attack into a platform compromise.

Similarly, if an attacker could gain access to the host, then it was easy to compromise the database. When database security became a problem a decade ago, patches and vulnerability assessment policy updates invariably contained fixes to limit database-to-platform security issues. Today, every Fortune 1000 IT organization enforces separation of duties between the IT and database administrators for security and compliance reasons.

There are four basic configuration steps to aid in separation of duties between the platform administrator and the database administrator.

1. Turn off external stored procedures. Every database platform offers a pathway for the database to use OS commands, as well as database interfaces from the OS layer. Commonly called "external stored procedures," these are nothing more than OS utilities accessed by the database much in the same way a user would call an internal procedure (i.e., SQL statements). You'll need to revoke permissions to these utilities from all users, including administrators. In rare cases, you can remove these functions entirely because they are included as an add-on package. In most cases, however, revoking user rights is enough.

2. Don't provide local IT admins with DBA credentials, and don't use the same user name and password. IT admins have no reason to be able to log into the database. If your IT department is one person, then it might not make sense to have that person use a second login to manage each platform -- but, trust me, you want this extra layer of protection. If an attacker can hijack one account, then he automatically has permission to the other when you share credentials.

3. Don't install the database under the local IT admin account. This means the database is the local admin, and the DBA has admin rights to the local platform. Similarly, if the database is installed as the local IT admin, then the admin can run database commands. You want the database to run as a separate user who is not the domain or local platform administrator. And you want the database files and archives to be readable by only the account the database is installed under.

4. Don't use mixed mode credential management: Use domain. Your IT department likely uses Active Directory or LDAP to manage user accounts. But every database has built-in user management as well. You want the database to manage generic roles and groups per database function, and the domain to manage actual users. Don't use mixed-mode authentication because it allows an attacker to choose one that suits his purpose, and often allows him to access administrative privileges.

Maintaining separation between platform and database administrators offers an extra degree of security. Once a skilled attacker gains access to the database, the first thing he will do is attain extra privileges, and the second is to open holes to the OS in order to write and execute code.

These steps provided are the basic steps, but it's likely you will want to take extra measures, such as segregation of the DBA role and monitor permissions changes to detect attacks.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2010-5312
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

CVE-2012-6662
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

CVE-2014-1424
Published: 2014-11-24
apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a "miscompilation flaw."

CVE-2014-7817
Published: 2014-11-24
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".

CVE-2014-7821
Published: 2014-11-24
OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?