Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

9/19/2011
01:16 PM
Adrian Lane
Adrian Lane
Commentary
50%
50%

Segregating DBA And Admin Duties

Keeping platform admins out of your database

A reader's question via email asked for an elaboration on separation of duties (SoD) between DBAs and IT administrators. SoD gets lumped in with compliance requirements, but, in reality, it's a critical security concern, so I thought it would be beneficial to dig into this topic.

The idea is that you don't want the administrator of the platform to access the database internals, alter database functions, or arbitrarily view the contents of the database.

IT's job is to ensure the underlying machines -- real or virtual -- support the database engine. That role does not permit them access to the database. It's the database administrators job to make sure the database application performs correctly, that database users have appropriate permissions to do their jobs, and that critical database controls are secured. The two roles should overlap as little as possible.

The fewer the number of people accessing database controls, the less likely it is for a rogue employee to steal data. Closing off the avenues to which a DBA can access the underlying OS -- or removing facilities IT administrators' use to access the database -- makes it less likely an attacker can compromise it.

This is not just theory, either. Just look at the history of database attacks: Though SQL injection gets the headlines now, it was not always that way. The bidirectional exploitation of external procedures was the most damaging tool in an attacker's arsenal. That's because if you could get into the database, the external procedure allowed use of OS or shell commands, leveraging a database attack into a platform compromise.

Similarly, if an attacker could gain access to the host, then it was easy to compromise the database. When database security became a problem a decade ago, patches and vulnerability assessment policy updates invariably contained fixes to limit database-to-platform security issues. Today, every Fortune 1000 IT organization enforces separation of duties between the IT and database administrators for security and compliance reasons.

There are four basic configuration steps to aid in separation of duties between the platform administrator and the database administrator.

1. Turn off external stored procedures. Every database platform offers a pathway for the database to use OS commands, as well as database interfaces from the OS layer. Commonly called "external stored procedures," these are nothing more than OS utilities accessed by the database much in the same way a user would call an internal procedure (i.e., SQL statements). You'll need to revoke permissions to these utilities from all users, including administrators. In rare cases, you can remove these functions entirely because they are included as an add-on package. In most cases, however, revoking user rights is enough.

2. Don't provide local IT admins with DBA credentials, and don't use the same user name and password. IT admins have no reason to be able to log into the database. If your IT department is one person, then it might not make sense to have that person use a second login to manage each platform -- but, trust me, you want this extra layer of protection. If an attacker can hijack one account, then he automatically has permission to the other when you share credentials.

3. Don't install the database under the local IT admin account. This means the database is the local admin, and the DBA has admin rights to the local platform. Similarly, if the database is installed as the local IT admin, then the admin can run database commands. You want the database to run as a separate user who is not the domain or local platform administrator. And you want the database files and archives to be readable by only the account the database is installed under.

4. Don't use mixed mode credential management: Use domain. Your IT department likely uses Active Directory or LDAP to manage user accounts. But every database has built-in user management as well. You want the database to manage generic roles and groups per database function, and the domain to manage actual users. Don't use mixed-mode authentication because it allows an attacker to choose one that suits his purpose, and often allows him to access administrative privileges.

Maintaining separation between platform and database administrators offers an extra degree of security. Once a skilled attacker gains access to the database, the first thing he will do is attain extra privileges, and the second is to open holes to the OS in order to write and execute code.

These steps provided are the basic steps, but it's likely you will want to take extra measures, such as segregation of the DBA role and monitor permissions changes to detect attacks.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5615
PUBLISHED: 2020-08-04
Cross-site request forgery (CSRF) vulnerability in [Calendar01] free edition ver1.0.0 and [Calendar02] free edition ver1.0.0 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVE-2020-5616
PUBLISHED: 2020-08-04
[Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free edition ver1.0.0, [Calendar02] free edition ver1.0.0, [PKOBO-News01] free edition ver1.0.3 and earlier, [PKOBO-vote01] free edition ver1.0.1 and earlier, [Telop01] fre...
CVE-2020-5617
PUBLISHED: 2020-08-04
Privilege escalation vulnerability in SKYSEA Client View Ver.12.200.12n to 15.210.05f allows an attacker to obtain unauthorized privileges and modify/obtain sensitive information or perform unintended operations via unspecified vectors.
CVE-2020-11583
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-11584
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.