Perimeter
5/31/2011
08:21 PM
Adrian Lane
Adrian Lane
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Sharing Relational Data In The Cloud

Databases are designed to share data, so it's easy to leverage built-in security for cloud services

Sharing relational data in the cloud is by far the easiest activity to secure. Why? Because relational databases are architected to share data. They form a central repository that is designed to serve data when requested by authorized parties. And they provide the infrastructure to support multiple applications, application clusters, and mirrored data sets. SaaS, PaaS, or IaaS -- it does not matter because the general model is consistent. (And remember, I am following the Cloud Security Alliance guidance for the data security life cycle and applying those principles to databases).

Because databases are designed to share data, most of the controls you want to use are built in: access control gate user access; authorization mapping with groups and roles, along with views, compartmentalize data. Labeling further limits data accessibility. Masking obfuscates information presented to users you don't fully trust. Encryption of network traffic keeps data private. All of these are features you are already familiar with and part of the database. These controls are extended by the applications that access the data, including application-layer encryption, multiple database repositories, or schemas, to divide content, and application logic to enhance fined grained control. It's really nothing different than what you need to do in your current environment.

There are only a couple of new threats we are worried about that are new to the cloud environment: how you share information through the application, and sharing information through the infrastructure.

In the first scenario, it's important to remember your data is being stored in a multi-tenant environment. There have been several documented cases where access controls and session management features have failed, exposing user accounts arbitrarily to new users (Facebook, for example). Also remember that your cloud provider has administrators who have access to the infrastructure for problem solving and general maintenance of the systems. It's possible to leverage those credentials to view your data. It's wise to use your own external access control systems -- or those embedded within the database -- to avoid any cascade of failure. Two-factor authentication -- using tokens or certificates -- helps address this issue as well.

If sharing data means more that just opening your databases to queries, such as providing archives or mirroring database servers, you'll need to verify the means of conveyance is secure. How they move and store data behind the scenes is most likely not the same as how you do it in-house, so find out the details. For example, if your vendor is providing data mirroring, how is that performed? You'll need to speak with them to verify the security controls because the data is moved and stored. Or, if you are exporting and reimporting archives at different locations, ensure that the archives are encrypted prior to being written to storage. In many ways this is similar to data usage, which was discussed in the last post.

Finally, the guidance recommends activity monitoring and data loss prevention technologies for general data security. I recommend database activity monitoring because it is specifically designed for monitoring database queries and auditing database transactions. It's effective at identifying malicious queries or hijacked credentials. What I don't recommend for databases is data loss prevention; while mentioned in the guidance, this technology is much better-suited for control of the endpoint and filtering network traffic looking for sensitive information. That's great for a generic filter, but with databases we already know we have sensitive information -- we want to verify how data is being shared, and that requires analysis of the individual statements.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading.

Quick reference: Part 1 Intro, Part 2 Cloud Database Models, Part 3 Data Security Lifecycle, Part 4 Create, Part 5 Store, Part 6 Usage. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6212
Published: 2014-04-19
Unspecified vulnerability in HP Database and Middleware Automation 10.0, 10.01, 10.10, and 10.20 before 10.20.100 allows remote authenticated users to obtain sensitive information via unknown vectors.

CVE-2013-6213
Published: 2014-04-19
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.

CVE-2013-6214
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.

CVE-2013-6215
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 10.01 and 10.10 allows remote authenticated users to execute arbitrary code via unknown vectors, aka ZDI-CAN-1977.

CVE-2013-6218
Published: 2014-04-19
Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors.

Best of the Web