Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security //

Database Security

2/6/2012
09:33 AM
Adrian Lane
Adrian Lane
Commentary
50%
50%

A Response To NoSQL Security Concerns

Three key takeaways from a recent webcast about database security in the NoSQL database movement

In response to Ericka Chickowski's article "Does NoSQL Mean No Security?" I was asked to attend a webcast with executives from CouchBase and 10Gen -- makers of MongoDB. The goal was to discuss database security in the NoSQL database movement and address some of the accusations made in Ericka's post. I encourage you to listen; it's illuminating for developers and security professionals alike.

From a security perspective -- this is a database security blog, after-all -- you may think I'm casting stones at the security "nonbelievers." Not so. The goal is to share the perspective so you understand what NoSQL security facilities are available to you and why that's the case.

Here are what I consider to be the key takeaways from this recent webcast:

1. Security By Design: All of the NoSQL providers I have spoken with, including Couch and Mongo DB, do have some security within their development life cycle. Usually there are design choices to address specific threats and some tests provided in the quality-assurance phase of the application development life cycle. But statements by the webcast participants make it clear that these precautions are minimal. They compose a tiny fraction of the overall development resources. And that's the way it should be. Each flavor of NoSQL is designed to meet a specific challenge, be it handling very large datasets, redundancy, map-reduce analytics and metrics gathering, or focusing on specific types of content. Security is not the goal -- never was, it's not today, and won't be for some time. If you don't like it, then use something else. Or you can augment your application to provide the missing security layer. You also can alter what you store in the database, but don't bet on your big data repository being secure.

2. Security Model: It's clear, both through the interviews I've had and design documents I've read, that the NoSQL security model is for the databases to be buried deep within an IT organization and behind other systems. Everything I have heard clearly states that the security model intends for the database to reside in a secure environment, protected by a firewall and access controls fronting any application. This is the old-school view of network security where you keep outsiders out of your network and everything will be fine. The irony is that just about every application platform designed specifically for use with NoSQL databases is a Web-centric (Node.js, Java, Ruby on Rails, PHP) application. Having an open front end universally accessible from any Web browser makes development easier, but the open user-interface vision is at odds with a behind-closed-door security model.

3. Dumb Data Bucket: NoSQL is a giant data bucket. While relational database systems are designed to maintain tight controls of data, NoSQL provides loose controls over datasets. Relational systems use metadata to precisely control data type,and heavily synchronized process controls to maintain data integrity. NoSQL uses loosely synchronized processes to scatter data across many systems, with small regard for the status of any one server or quality of data being stored. That's not a negative judgment against NoSQL; rather, I am stressing the philosophical differences in approach needed to meet the core design goals. It's a giant self-organizing bucket you put data in. Once again, don't expect it to be secure. If you want security, then build it into your application. Or only store secured (encrypted, anonymized, tokenized) data. But don't expect the bucket to do much more than efficiently store your data.

Open-source NoSQL databases are a greenfield opportunity for security vendors; monitoring, assessment, access control packages, labeling, and masking are all needed technologies.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18885
PUBLISHED: 2019-11-14
fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a crafted btrfs image because fs_devices->devices is mishandled within find_device, aka CID-09ba3bc9dd15.
CVE-2019-18895
PUBLISHED: 2019-11-14
Scanguard through 2019-11-12 on Windows has Insecure Permissions for the installation directory, leading to privilege escalation via a Trojan horse executable file.
CVE-2019-18957
PUBLISHED: 2019-11-14
Microstrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS.
CVE-2019-16863
PUBLISHED: 2019-11-14
STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.
CVE-2019-18949
PUBLISHED: 2019-11-14
SnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting, which leads to unintended JavaScript execution via a chain of webpage redirections targeted to the user's browser configuration.