'Super Users' Could Threaten Database Security, Study Says
Survey by Independent Oracle Users Group says most database administrators haven't implemented proper defenses
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Usually, the database administrator (DBA) is your organization's staunchest defender of your sensitive data. But what if that DBA -- or another privileged user -- becomes disgruntled and decides to do some damage?
That possibility is one of the things that keeps Oracle administrators up at night, according to a newly published study conducted by the Independent Oracle Users Group (IOUG). In a survey of more than 300 IT and database administrators, the group found that the greatest risks to corporate data comes from internal access, either by unauthorized users or by "super users" with special access privileges.
Most organizations don't have mechanisms in place to prevent DBAs and super users from reading or tampering with sensitive information in financial, human resources, or other business applications, the survey says. Most of the respondents said they are unable to even detect such breaches.
One out of five respondents expects a data breach or incident during the coming year. Only one out of four said that all of their databases are locked down against attacks. One out of four sites covered in the survey said they do not encrypt the data within their databases, and nearly one in five is not even sure whether such encryption takes place, according to the IOUG.
"The problems are both organizational and technical," says Ron Bennatan, CTO of database security company Guardium Inc. . "DBAs have traditionally focused on performance and availability as their key priorities, while IT security has primarily focused on perimeter and end-point security. Now the two groups need to work together, usually in conjunction with risk and compliance people, to close these gaping holes.
"On a technical level, there are a number of well known limitations with native database logging and auditing utilities, such as their complexity and impact on database performance," Bennatan says. "That means that most DBAs are very reluctant to turn them on, because it just creates more headaches for them and doesn’t really address the core problems."
— Tim Wilson, Site Editor, Dark Reading
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024