Perimeter
10/4/2012
01:31 PM
Adrian Lane
Adrian Lane
Commentary
50%
50%

What's The Threat?

SQL injection -- not malware -- is the main threat to databases

I got into an interesting series of conversations with different database and application security vendors about their frustration in marketing their solutions to customers. Everywhere they go, customers are talking about anti-malware, and in many cases, their anti-malware vendors say they stop database attacks.

For the record, saying and doing are two different things, and anti-malware solutions don't stop database attacks. They help keep attackers from getting a foothold in your organization, but they do not address attacks on databases.

For those of you in IT, you're probably not aware that analysts -- like myself -- speak with different security vendors every day. Usually three a day. And every single presentation, regardless of product or security market segment, begins with the same set of product justification slides: This is the threat you need to worry about! And right now, every one of those presentations is targeting malware.

So what's the real threat to your organization? Malware or SQL injection? Most vendors will tell you that the real problem facing today's organization is malware. Vendors argue that users get phished through email or social media, which opens their machines for malware infection. At this point, the malware finds what weaknesses it can, downloads more attacks, steals passwords, exfiltrates data, and generally tries to infect everything it can. There is no denying this is a major problem, but malware is not the direct threat to database security.

Most people responsible for database security view all of this malware stuff as simply a way to get a foothold in the organization with the ultimate goal to get sensitive data. That can mean files or databases. Direct and indirect assaults on databases are both at issue, but the last attack is usually SQL injection because it's simple and it works.

Again, it's up to the customer to wade through the half-truths and determine what controls -- and possibly a supporting security technology -- will work for them. The confusion in the market is caused directly by vendors trying to position their products as the solution to your problem. I even had one vendor say it must now educate customers on the difference between anti-malware and Web application firewalls (WAFs).

In fact, unified threat management, secure Web gateway, application whitelisting, browser virtualization, antivirus, email security, VDI, and intrusion-detection system (IDS) vendors all claim to "help address the malware problem." And, in truth, they all either help with a part of the problem or a single avenue of infection.

Similarly, database activity monitoring (DAM), WAFs, white box code scanners, dynamic app scanning, vulnerability assessment, patch management, and IDS all claim to help address the SQL injection problem. Again, they all help in some way, but only WAF and DAM are specifically designed to detect and stop these attacks. And while that remains the principle threat, it's only one facet of database security.

Threats are like fashion in that they change every couple of years. The first big fashion trend was the insider threat, followed closely by SQL injection. More recently it has been the advanced persistent threat (APT), but today the all-important threat is malware. And this is where the frustration sets in for database security vendors: The primary threat is still SQL injection. It's just no longer fashionable, and most of the media is tired of talking about it.

Personally, I think it's helpful to think about this in a different way: Attackers don't care. To them, it's whatever works. If that's password cracking or phishing or SQL injection, then that's fine. Those tricks are easy, and if they work, game over. If not, then try again with a different approach like malware. Or maybe something entirely different. Lazlo Toth and Fernec Spala remind us in their recent DerbyCon 2012 presentation that databases are vulnerable in lots of different ways. They demo'ed siphoning data off from clients, network communication redirection, privilege escalation, and even cracked the horribly out-of-date DES encryption built into Oracle.

The debate about which threat should you be paying attention to is largely one between vendors vying for mindshare. Yes, malware is a prevalent threat -- so serious, in fact, that a huge segment of the security industry has adjusted their marketing to cover this problem.

But you can't myopically focus on a single threat: Database security requires balance -- balance between preventative and detective controls, at restricting access while enabling users, at keeping data, the database and supporting infrastructure safe. If you are a database admin, then you should be more worried about SQL injection than malware. Because SQL injection protection is outside of your control, you also should ensure dev-ops teams are doing what they need to do in order to address the problem. You have enough on your plate with patching, configuration, encryption, identity, and privilege management to keep yourself busy.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

CVE-2014-8090
Published: 2014-11-21
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nes...

CVE-2014-8469
Published: 2014-11-21
Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?