Perimeter
5/31/2011
08:21 PM
Adrian Lane
Adrian Lane
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Sharing Relational Data In The Cloud

Databases are designed to share data, so it's easy to leverage built-in security for cloud services

Sharing relational data in the cloud is by far the easiest activity to secure. Why? Because relational databases are architected to share data. They form a central repository that is designed to serve data when requested by authorized parties. And they provide the infrastructure to support multiple applications, application clusters, and mirrored data sets. SaaS, PaaS, or IaaS -- it does not matter because the general model is consistent. (And remember, I am following the Cloud Security Alliance guidance for the data security life cycle and applying those principles to databases).

Because databases are designed to share data, most of the controls you want to use are built in: access control gate user access; authorization mapping with groups and roles, along with views, compartmentalize data. Labeling further limits data accessibility. Masking obfuscates information presented to users you don't fully trust. Encryption of network traffic keeps data private. All of these are features you are already familiar with and part of the database. These controls are extended by the applications that access the data, including application-layer encryption, multiple database repositories, or schemas, to divide content, and application logic to enhance fined grained control. It's really nothing different than what you need to do in your current environment.

There are only a couple of new threats we are worried about that are new to the cloud environment: how you share information through the application, and sharing information through the infrastructure.

In the first scenario, it's important to remember your data is being stored in a multi-tenant environment. There have been several documented cases where access controls and session management features have failed, exposing user accounts arbitrarily to new users (Facebook, for example). Also remember that your cloud provider has administrators who have access to the infrastructure for problem solving and general maintenance of the systems. It's possible to leverage those credentials to view your data. It's wise to use your own external access control systems -- or those embedded within the database -- to avoid any cascade of failure. Two-factor authentication -- using tokens or certificates -- helps address this issue as well.

If sharing data means more that just opening your databases to queries, such as providing archives or mirroring database servers, you'll need to verify the means of conveyance is secure. How they move and store data behind the scenes is most likely not the same as how you do it in-house, so find out the details. For example, if your vendor is providing data mirroring, how is that performed? You'll need to speak with them to verify the security controls because the data is moved and stored. Or, if you are exporting and reimporting archives at different locations, ensure that the archives are encrypted prior to being written to storage. In many ways this is similar to data usage, which was discussed in the last post.

Finally, the guidance recommends activity monitoring and data loss prevention technologies for general data security. I recommend database activity monitoring because it is specifically designed for monitoring database queries and auditing database transactions. It's effective at identifying malicious queries or hijacked credentials. What I don't recommend for databases is data loss prevention; while mentioned in the guidance, this technology is much better-suited for control of the endpoint and filtering network traffic looking for sensitive information. That's great for a generic filter, but with databases we already know we have sensitive information -- we want to verify how data is being shared, and that requires analysis of the individual statements.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading.

Quick reference: Part 1 Intro, Part 2 Cloud Database Models, Part 3 Data Security Lifecycle, Part 4 Create, Part 5 Store, Part 6 Usage. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.