Perimeter
5/31/2011
08:21 PM
Adrian Lane
Adrian Lane
Commentary
50%
50%

Sharing Relational Data In The Cloud

Databases are designed to share data, so it's easy to leverage built-in security for cloud services

Sharing relational data in the cloud is by far the easiest activity to secure. Why? Because relational databases are architected to share data. They form a central repository that is designed to serve data when requested by authorized parties. And they provide the infrastructure to support multiple applications, application clusters, and mirrored data sets. SaaS, PaaS, or IaaS -- it does not matter because the general model is consistent. (And remember, I am following the Cloud Security Alliance guidance for the data security life cycle and applying those principles to databases).

Because databases are designed to share data, most of the controls you want to use are built in: access control gate user access; authorization mapping with groups and roles, along with views, compartmentalize data. Labeling further limits data accessibility. Masking obfuscates information presented to users you don't fully trust. Encryption of network traffic keeps data private. All of these are features you are already familiar with and part of the database. These controls are extended by the applications that access the data, including application-layer encryption, multiple database repositories, or schemas, to divide content, and application logic to enhance fined grained control. It's really nothing different than what you need to do in your current environment.

There are only a couple of new threats we are worried about that are new to the cloud environment: how you share information through the application, and sharing information through the infrastructure.

In the first scenario, it's important to remember your data is being stored in a multi-tenant environment. There have been several documented cases where access controls and session management features have failed, exposing user accounts arbitrarily to new users (Facebook, for example). Also remember that your cloud provider has administrators who have access to the infrastructure for problem solving and general maintenance of the systems. It's possible to leverage those credentials to view your data. It's wise to use your own external access control systems -- or those embedded within the database -- to avoid any cascade of failure. Two-factor authentication -- using tokens or certificates -- helps address this issue as well.

If sharing data means more that just opening your databases to queries, such as providing archives or mirroring database servers, you'll need to verify the means of conveyance is secure. How they move and store data behind the scenes is most likely not the same as how you do it in-house, so find out the details. For example, if your vendor is providing data mirroring, how is that performed? You'll need to speak with them to verify the security controls because the data is moved and stored. Or, if you are exporting and reimporting archives at different locations, ensure that the archives are encrypted prior to being written to storage. In many ways this is similar to data usage, which was discussed in the last post.

Finally, the guidance recommends activity monitoring and data loss prevention technologies for general data security. I recommend database activity monitoring because it is specifically designed for monitoring database queries and auditing database transactions. It's effective at identifying malicious queries or hijacked credentials. What I don't recommend for databases is data loss prevention; while mentioned in the guidance, this technology is much better-suited for control of the endpoint and filtering network traffic looking for sensitive information. That's great for a generic filter, but with databases we already know we have sensitive information -- we want to verify how data is being shared, and that requires analysis of the individual statements.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading.

Quick reference: Part 1 Intro, Part 2 Cloud Database Models, Part 3 Data Security Lifecycle, Part 4 Create, Part 5 Store, Part 6 Usage. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4692
Published: 2015-07-27
The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.

CVE-2015-1840
Published: 2015-07-26
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space cha...

CVE-2015-1872
Published: 2015-07-26
The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via craft...

CVE-2015-2847
Published: 2015-07-26
Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream.

CVE-2015-2848
Published: 2015-07-26
Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!