Biggest benefits of NoSQL databases--scalability and flexibility-- also give security experts the biggest headaches.
The burgeoning use of NoSQL databases within the enterprise has given users better scalability and flexibility with how they store data and how applications tap into those stores, but security experts warn that there are some serious security considerations to take into account when diving headfirst into a deployment of such an immature technology.
"We think the lack of security around NoSQL is going to take a toll on organizations," said Amichai Shulman, co-founder and CTO of Imperva. "We'll see a lot more organizations starting or going into deployment of NoSQL in the next year, and we believe what they are going to find out after they put the data there is that there are some security issues they should have considered."
An alternative to the traditional relational database, NoSQL systems do not use the SQL language for queries and are schema-less systems that allow users to change data attributes on the fly. These databases are known to scale well and offer performance advantages in transactional situations where a large amount of application users need to interact with the database in real-time, said James Phillips, co-founder and senior VP of products for Couchbase, a NoSQL platform firm.
"NoSQL is about transactionality. It's about real-time and it's about doing something with the data right now, in particular facilitating interactive software systems," Phillips said. "One of the big benefits is that you can change your mind (about attributes) at any time. They tend to be schemaless."
But this biggest benefit of NoSQL is also one of the biggest causes of concerns for security experts.
InformationWeek is conducting our third annual State of Enterprise Storage survey on data management technologies and strategies. Upon completion, you will be eligible to enter a drawing to receive an Apple iPad 2. Take our Enterprise Storage Survey now. Survey ends Jan. 13.
Published: 2014-12-17 Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...
Published: 2014-12-17 Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.
Published: 2014-12-17 The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.