1. Theft and fraud
2. Confidentiality - information should not be disclosed to unauthorised users
3. Privacy
4. Integrity - only authorised persons should be allowed to modify data
5. Availability - authorised users should not be denied access
6. Accountability - determining what a user did by means of clipping levels enforcing non repudiation
What counter measures exist for these type of threats?
Counter measures for these threats can be one of two types ie. computer based and non computer based:
Computer based measures:
1. implementing suitable authorisation in relation to an OS on which the DB system runs
2. implementing authorisation strategies that grant priv to certain users and groups to access certain database objects via the chosen DBMS. Employ lock down access control methods using "denied unless explicitly permitted". no one without a legimate business reasons to access any data should be able to do so
3. set up restricted views into the database
4. take regular backups of the database
5. maintaining a log of all changes made to the database. Every access to data, successful or unsuccessful should be logged containing at a minimum what, who, when and where details
6. use suitable strategies for encrypting sensitive data (see 1#)
Non-computer based measures:
1. establishing a security policy plan
2. separation of duties through different personnel
3. put computer hardware in secure environments employing physical access controls
4. secure copies of data and software in off site, fireproof storage
In addition to the above there is little point in securing a DBMS and a database by itself, rather one should instead secure the operating system against attacks by unwanted persons as well as securing the tables within the database.
Who is responsible for database security?
Database security is normally a task for the DBA normally conducted in collaboration with the organisation security expert mainly becuase of the key value that the data holds within an organisation.
How can we control the data? Data control comes in 2 parts:
1. preventing unauthorised access to data
2. preventing unauthorised access to the facilities of a particular dbms
How is control applied over data and privileges?
1. Usage Analysis: build a profile of the user or user groups that we expect to access the database
2. For each user group build a profile of data and facilities privileges are appropriate to their expected level of access
How about database hardening solutions?
To improve system performance as well as the security of databases companies have implemented the tiered model of systems:
1.
one-tier model - the database and the application exist on a single system
2.
two-tier model - the client pc or system runs an application that communicates with the database that is running on a different server
3.
three-tier model - effectively isolates the end user from the database by introducing a middle-tier server. this server accepts requests from clients, evaluates them and then sends them onto the database server for processing. the database server sends the data back to the middle tier server which then sends the data to the client system.
Although the three models provide increasing capability and complexity, each system must be individually managed and kept current for any of the above models to provide effective security.
Most secure database systems have access control mechanisms based on the Bell{LaPadula model. This model is specied in terms of subjects and objects. An object is a data item, whereas a subject is a process that requests access to an object. For example, when a process accesses a data file for input/output operations, the process is the subject and the data-file is the object. Each object in the system has a classification level (e.g. Top Secret, Secret, Classified, etc.) based on the security requirement. Similarly, each subject has a corresponding clearance level based on the degree to which it is trusted by the system. (See #2)
References and further information:
Database Security by Dan Rahmel
http://www.governmentsecurity.org/articles/DatabaseSecurityPart1.php
Partial Security and Timeliness in Real-Time Database Systems by Sang H. Son
http://ipdps.cc.gatech.edu/1998/wpdrts/son.pdf
Cryptography in the Database: The Last Line of Defense
http://www.amazon.co.uk/Cryptography-Database-Last-Line-Defense/dp/0321320735
1# http://www.oracle.com/technology/oramag/oracle/05-jan/o15security.html
2# http://dsl.serc.iisc.ernet.in/publications/conference/secncs96.ps.gz
Secure Real Time Database Systems by Binto George & Jayant Haritsa
