Vulnerabilities / Threats
1/12/2012
12:25 PM
50%
50%

Does NoSQL Mean No Security?

Biggest benefits of NoSQL databases--scalability and flexibility-- also give security experts the biggest headaches.

The burgeoning use of NoSQL databases within the enterprise has given users better scalability and flexibility with how they store data and how applications tap into those stores, but security experts warn that there are some serious security considerations to take into account when diving headfirst into a deployment of such an immature technology.

"We think the lack of security around NoSQL is going to take a toll on organizations," said Amichai Shulman, co-founder and CTO of Imperva. "We'll see a lot more organizations starting or going into deployment of NoSQL in the next year, and we believe what they are going to find out after they put the data there is that there are some security issues they should have considered."

An alternative to the traditional relational database, NoSQL systems do not use the SQL language for queries and are schema-less systems that allow users to change data attributes on the fly. These databases are known to scale well and offer performance advantages in transactional situations where a large amount of application users need to interact with the database in real-time, said James Phillips, co-founder and senior VP of products for Couchbase, a NoSQL platform firm.

"NoSQL is about transactionality. It's about real-time and it's about doing something with the data right now, in particular facilitating interactive software systems," Phillips said. "One of the big benefits is that you can change your mind (about attributes) at any time. They tend to be schemaless."

But this biggest benefit of NoSQL is also one of the biggest causes of concerns for security experts.

Read the rest of this article on Dark Reading.

InformationWeek is conducting our third annual State of Enterprise Storage survey on data management technologies and strategies. Upon completion, you will be eligible to enter a drawing to receive an Apple iPad 2. Take our Enterprise Storage Survey now. Survey ends Jan. 13.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7896
Published: 2015-03-03
Multiple cross-site scripting (XSS) vulnerabilities in HP XP P9000 Command View Advanced Edition Software Online Help, as used in HP Device Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Tiered Storage Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Replication Manager 6.x and 7.x before ...

CVE-2014-9283
Published: 2015-03-03
The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

CVE-2014-9683
Published: 2015-03-03
Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

CVE-2015-0656
Published: 2015-03-03
Cross-site scripting (XSS) vulnerability in the login page in Cisco Network Analysis Module (NAM) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCum81269.

CVE-2015-0890
Published: 2015-03-03
The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.