Vulnerabilities / Threats
12:25 PM

Does NoSQL Mean No Security?

Biggest benefits of NoSQL databases--scalability and flexibility-- also give security experts the biggest headaches.

The burgeoning use of NoSQL databases within the enterprise has given users better scalability and flexibility with how they store data and how applications tap into those stores, but security experts warn that there are some serious security considerations to take into account when diving headfirst into a deployment of such an immature technology.

"We think the lack of security around NoSQL is going to take a toll on organizations," said Amichai Shulman, co-founder and CTO of Imperva. "We'll see a lot more organizations starting or going into deployment of NoSQL in the next year, and we believe what they are going to find out after they put the data there is that there are some security issues they should have considered."

An alternative to the traditional relational database, NoSQL systems do not use the SQL language for queries and are schema-less systems that allow users to change data attributes on the fly. These databases are known to scale well and offer performance advantages in transactional situations where a large amount of application users need to interact with the database in real-time, said James Phillips, co-founder and senior VP of products for Couchbase, a NoSQL platform firm.

"NoSQL is about transactionality. It's about real-time and it's about doing something with the data right now, in particular facilitating interactive software systems," Phillips said. "One of the big benefits is that you can change your mind (about attributes) at any time. They tend to be schemaless."

But this biggest benefit of NoSQL is also one of the biggest causes of concerns for security experts.

Read the rest of this article on Dark Reading.

InformationWeek is conducting our third annual State of Enterprise Storage survey on data management technologies and strategies. Upon completion, you will be eligible to enter a drawing to receive an Apple iPad 2. Take our Enterprise Storage Survey now. Survey ends Jan. 13.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio