Upload File

cyber security team database security security team pwc database security • a threat from within...

  • Home
  • Documents
  • Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8
45
Database Security A threat from within Strictly Private and Confidential June 2015 Cyber Security Team

Upload: phunghuong

Post on 20-Apr-2018

230 views

Category:

Documents


4 download

Report

TRANSCRIPT

Page 1: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

Database Security

A threat from within

Strictly Privateand Confidential

June 2015

Cyber Security Team

Page 2: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015Database Security • A threat from within

Page 3: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

1 Introduction: Threats to DB Security 1

2 Architecture & Vocabulary 8

3 Access Control & Application Security 14

4 Data Anonymization 21

5 Authentication 24

6 Governance, Risk and Compliance 27

7 Database Vulnerability Assessment 29

8 Database Audit & Protection 32

9 Database Security in the Cloud 37

10 Questions and Answers 40

PageSection Overview

Table of Contents

Page 4: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Introduction: Threats to DB SecuritySection 1

Database Security • A threat from within1

Page 5: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Databases: an attractive target

Section 1 – Introduction: Threats to DB Security

Database Security • A threat from within2

January:

Snapchat(4.5M)

February:

Kickstarter(5.6M)

March:

KoreanTelecom(12M)

May:

eBay(145M)

Database records stolenin early-2014

• Credentials• Email addresses• Credit cards information• Social security numbers• Medical records• etc…

Source: Verizon - Data breach investigations report 2015

96% of records breached are fromdatabases…

Page 6: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Top 10 Database Threats

Section 1 – Introduction: Threats to DB Security

Database Security • A threat from within3

Limited securityexpertise & education

10Denial of Service 9

UnmanagedSensitive data

8DB vulnerabilities &misconfiguration

7

Weak authenticationsBruteforce, stolen credentials6Backup exposure

Often unprotected media5

Weak audit trailUnable to detect

4MalwareCompromised Hosts

3

SQL injections19% of web app attacks

2Excessive privilegesUnauthorized access & abuse

1

Page 7: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Top 10 Database Threats

Section 1 – Introduction: Threats to DB Security

Database Security • A threat from within4

Limited securityexpertise & education

10Denial of Service 9

UnmanagedSensitive data

8DB vulnerabilities &misconfiguration

7

Weak authenticationsBruteforce, stolen credentials6Backup exposure

Often unprotected media5

Weak audit trailUnable to detect

4MalwareCompromised Hosts

3

SQL injections19% of web app attacks

2Excessive privilegesUnauthorized access & abuse

1

But who’s toblame?

Page 8: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Who are the stakeholders (threats) of Database Security?

Section 1 – Introduction: Threats to DB Security

Database Security • A threat from within5

Developers

Network Admins

Testers

System Admins

Storage/Backup Admins

End UsersDBAs

CISO Auditors IT Security Business You ?

Page 9: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

•Strongauthentication(PKI, Kerberos,RADIUS)

•Native NetworkEncryption

•Database NativeAuditing

7•Oracle LabelSecurity

•Global roles•Virtual PrivateDatabase

8i Fine GrainedAuditing9i

Oracle Security History

Section 1 – Introduction: Threats to DB Security

Database Security • A threat from within6

•Secure Backup•Transparent DataEncryption

•Oracle Audit &Database Vault

10g•ActivityMonitoring &DatabaseFirewall

•Privilege Analysis•Sensitive dataDiscovery

11g•Separation ofDuty

•New AuditFramework

•AdvancedSecurity Optionsare embedded

12c

1992

2015

Page 10: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Native Security provided by Oracle and the others

Section 1 – Introduction: Threats to DB Security

Database Security • A threat from within7

Virtual PrivateDatabase

MaterializedViews

Synonyms

Data Masking

TransparentEncryption

RBAC (Roles)

Audit

DynamicViews only

No Synonyms

NoAnonymization

ManualEncryption

No Roles

Audit viaModule

MaterialisedViews

Synonyms

NoAnonymization

TransparentEncryption

RBAC (Roles)

Audit

MaterialisedViews

No Synonyms

NoAnonymization

TransparentEncryption

RBAC (Roles)

Audit

MaterialisedViews

Synonyms

NoAnonymization

ManualEncryption

RBAC (Roles)

Audit viaModule

Oracle MySQL PostgreSQL SQL Server Sybase

Label BasedAccess Control

MaterializedQuery Tables

Synonyms

Anonymization(optional)

TransparentEncryption

RBAC (Roles)

Audit

IBM DB2

Page 11: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Architecture & VocabularySection 2

Database Security • A threat from within8

Page 12: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Oracle Architecture

Section 2 – Architecture & Vocabulary

Database Security • A threat from within9

Memory (SGA)

Background Processes

Instance (SID)

DatabaseDatafiles, Online Redo logs,Controlfiles, Backup files,

Parameter Files

Page 13: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Logical vs Physical

Section 2 – Architecture & Vocabulary

Database Security • A threat from within10

Database Bloc

Database

Tablespace

Segment

Extent

Datafile

O.S. Bloc

Schema

Page 14: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Logical Structures

Section 2 – Architecture & Vocabulary

Database Security • A threat from within11

Tables Constraints Indexes Views

Synonyms Profiles SequencesProcedures& Functions

Triggers Packages

Page 15: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Dictionary & Catalog

Section 2 – Architecture & Vocabulary

Database Security • A threat from within12

Tables

TBS USERS TBS SYSTEM

Dictionary

Tables

Information about the database itself (Metadata)

SYS

Catalog

Views

Views on the dictionary

SYSTEM

Indexes

Constraints

Views

Page 16: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Structured Query Language - SQL

Section 2 – Architecture & Vocabulary

Database Security • A threat from within13

SQL is a special-purpose programming language designed for managing dataheld in a database (RDBMS).

Data Definition LanguageDefine the structure of tables and otherobjects

CREATE , ALTER, DROP or TRUNCATE

Data Manipulation LanguageUse and manipulate the data

SELECT, INSERT, UPDATE or DELETE

Data Control LanguageDefine permissions for users/schemas

GRANT or REVOKE

Page 17: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Access Control & Application SecuritySection 3

Database Security • A threat from within14

Page 18: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Strategy to Secure Data

Section 3 – Access Control & Application Security

Database Security • A threat from within15

ClassifyData/Users

AnticipateAnticipateThreats

MapControls

STRATEGYTO SECURE

DATA

Page 19: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Role Based Access Control (RBAC)

Section 3 – Access Control & Application Security

Database Security • A threat from within16

DB2 DB3DB1

Public

Internal

Confidential

Top Secret

Business Users

Developers

Secu. Admins

Managers

Databases

DataClassification

Roles &Responsibilities

rolesprivileges

Page 20: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Data Classification against the Triad

Section 3 – Access Control & Application Security

Database Security • A threat from within17

Classification against their contentsSecret/Confidential/Internal/Public

Impact when modifying dataHigh/Medium/Low

What Availability is required?90%? 99.5%?

INTEGRITY

AVAILABILITY

CONFIDENTIALITY

Page 21: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Misconfiguration Risk with Privileges

Section 3 – Access Control & Application Security

Database Security • A threat from within18

Thomas

Ana

App. Owner

Mike

WithAdmin/Grant

Option

ANY

~~~~~~~~~~~~

App. Table

!

!

~~~~~~~~~~~~

App. Table

~~~~~~~~~~~~

App. Table

~~~~~~~~~~~~

App. Table

Page 22: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Misconfiguration Risk with roles

Section 3 – Access Control & Application Security

Database Security • A threat from within19

Select

InsertUpdateSelect Delete

SelectSelect

Insert

Business User

DB

Application Role = DBA Access !!

Page 23: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Misconfiguration Risk with Profile

Section 3 – Access Control & Application Security

Database Security • A threat from within20

Lambda

• Password Lifetime• Password Complexity• Failed Login Attempts• CPU per Session• Connect Time• …

Beware to ‘default’ or ‘Unlimited’ value…

Page 24: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Data AnonymizationSection 4

Database Security • A threat from within21

Page 25: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Data Anonymization

Section 4 – Data Anonymization

Database Security • A threat from within22

Businessuser

SeniorDBA

Developer JuniorDBA

Externalprovider

NAME SSN SALARY NOTES

Dupont 203-55-1478 40,000 -

Schmitt 325-65-1469 60,000Will be

promoted

ProductionNAME SSN SALARY NOTES

Dupont 203-55-1478 40,000 -

Schmitt 325-65-1469 60,000Will be

promoted

Testing

redacted

redacted

170-96-1765

123-45-6789

GBerilQ

JaOXnRtx

!

Data maskingDelete or replace with aconstant value.

Data scramblingReplace with a randomvalue of same format.

Data encryptionRepeatable: an input alwaysgives the same result.

CopyAnonymize

Page 26: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Data Masking in Production

Section 4 – Data Anonymization

Database Security • A threat from within23

Views to hide rows and/or columnSynonyms to replace view’s name by the original table one (or used tohide the use of Database Link)Virtual Private Databases to segregate data from different customers

Page 27: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

AuthenticationSection 5

Database Security • A threat from within24

Page 28: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Authentication

Section 5 – Authentication

Database Security • A threat from within25

OS LEVEL

DB LEVEL

# oracle

sys (dba)

# root

Database

DB USER

OS USER

LDAP USER

STRONG AUTHENTICATION

Strong AuthenticationAccountabilityLeast PrivilegesNon Repudiation

Monitoring & BlockingUsersHigh Priv. Accounts

Data Leakage

Page 29: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Oracle Encryption

Section 5 – Authentication

Database Security • A threat from within26

Database

TDE

KEY VAULT

Wallet

OR

HSM

SecureBackup

DataPump

(…)

DBA

Page 30: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Governance, Risk and ComplianceSection 6

Database Security • A threat from within27

Page 31: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Section 6 – Governance, Risk and Compliance

Database Security • A threat from within28

Data

Appli.

Host

Internal Network

Perimeter & Cloud

Physical

Plan, Policies & Procedures,Baselines, Awareness

SecurityGovernance, Risk

& Compliance

OperationalSecurity,

Monitoring &Controls (Audit)

Identity & AccessManagement

Page 32: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Database Vulnerability AssessmentSection 7

Database Security • A threat from within29

Page 33: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Database Vulnerability Assessment

Section 7 – Database Vulnerability Assessment

Database Security • A threat from within30

Weak passwords

Misconfiguredprivileges

Missing patches

Configurationchanges

Accountssharing

Unusual houractivities

Suspicious adminlogins

Page 34: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

ODAT: penetration testing for Oracle Database

Section 7 – Database Vulnerability Assessment

Database Security • A threat from within31

Source: https://github.com/quentinhardy/odat

SID scanning

1

2

Accounts & passwordsguessing

File upload, download& deletion

6

SID: ORCL

http://badguy.com/

~~~~~~

3 Columnsscanning

4 HTTP requests

5TCP port scanning

7

Systems commands &Remote shell access

Page 35: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Database Audit & ProtectionSection 8

Database Security • A threat from within32

Page 36: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Audit Trail & Fine Grained Auditing

Section 8 – Database Audit & Protection

Database Security • A threat from within33

Auditevents

~~~~~~~~~~~~

Audittable

Audit table

OS file

System log

Interoperability issuesPerformance issues

Audit Trail can be accessed and altered!

Audit TrailFast & SimpleNon-selective

Fine Grained AuditVery flexible

Complex

Page 37: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

• Audit Vault centralizes audit logs from the databases, the OS, Active Directory…

• It allows easy reporting and custom alerts

• Cooperate with Database Firewall, which filters request made to the database

1- Oracle Audit Vault & Database Firewall

Section 8 – Database Audit & Protection

Database Security • A threat from within34

Source: Oracle Audit Vault documentation

Is it not impacting the performance?

Page 38: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

2- IBM Infosphere Guardium

Section 8 – Database Audit & Protection

Database Security • A threat from within35

?Span monitoring

Change of (ip, port)Local traffic

Change of (ip, port)

Switch

Aggregator

Collector

S-TAP

F-TAPIs it safe?

Policies

Real-time alerts Post-mortem reportsReports

!

Page 39: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Other players in the market

Section 8 – Database Audit & Protection

Database Security • A threat from within36

Page 40: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Database Security in the CloudSection 9

Database Security • A threat from within37

Page 41: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Container database

Databases in the Cloud

Section 9 – Database Security in the Cloud

Database Security • A threat from within38

Database protection

Auditing &monitoring

Policies

! !! Yellow AppDBA

Cloud ProviderDBA

AlertsAppsAppsApps

Database Vault

• Consolidation dbs into a single container• Multi-tenancy• Elasticity• Pluggable databases• Segregation of data

Page 42: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

Thank you!

Page 43: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Questions and AnswersSection 10

Database Security • A threat from within40

Page 44: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Oracle Multitenant:

Consolidate several databases into a singlecontainer:

• Share resources & ease maintenance

• Preserve segregation of data

• Databases are pluggable

A Cloud infrastructure for Databases whichprovides:

• Elasticity & cost reduction

• Flexibility

• Segregation

Multitenancy in the Database

Section 10 – Questions and Answers

Database Security • A threat from within41

Source: Oracle Multitenant documentation

Page 45: Cyber Security Team Database Security Security Team PwC Database Security • A threat from within June 2015 1 Introduction: Threats to DB Security 1 2 Architecture & Vocabulary 8

PwCJune 2015

Database protection

Section 10 – Questions and Answers

Database Security • A threat from within42

Database Vault:

Realm-based authorization

• Preserve segregation of duties

• Privileged accounts cannot access sensitivedata or data from other databases

• Restriction according to Business Hours

• Security Layer on the top of the DBAs

Source: Oracle Database Vault documentation


Database Security

Database Security Assessment Tool Tutorial · 2 | Database Security: Identifying Security Risks with the Database Security Assessment Tool TUTORIAL OVERVIEW Welcome to this Database

1 Database Application Security Models Database Application Security Models Dr. Gabriel

Database Security DBMS Features Statistical Database Security

Database Security

Database Support Team Beginning Accounting 2005. Database Support Team Menu 12 Company Maintenance

Database Security · PDF fileDatabase Security Guideline Version 2.0 February 1, 2009 Database Security Consortium Security Guideline WG

02 database security

Oracle Database Security - · PDF fileOracle Database Security Paul Needham, Senior Director, Product Management, Database Security. Target of Data Breaches ... Oracle Database Vault

Database Application Security Models Database Application Security Models 1

Oracle Database Security

Set 6, Statistical Database Security Sylvia Osborn CS96161Set 6, Statistical Database Security

Database Security Lecture

Database Support Team

2.0 - Database Security

17 Database Security

OpenTrust PKI v4 - ANSSI€¦ · Database security provided by OpenTrust PKI: This Security Target makes no claims about inherent database security. All database security (i.e., confidentiality

Oracle Database Security in the Cloud - Integrigy Oracle Database Security... · Oracle Database Security in the Cloud February 25, 2016 Michael Miller Chief Security Officer Integrigy

Oracle Database Security - storage.googleapis.com · Oracle Database Security . Defense-in-Depth for Security and Compliance Database Vault Label Security . Access Control . Configuration

Database Security - Farkas 1 Database Security and Privacy

Database and Database Security

Database Security with the SecureSphere Database Security Gateway

Database & Data Security

PA State Police (PSP) Database Design PA State Police (PSP) Database Design Data Modeling Standards Database Team Version 1.4 Date: 03/19/2014 SECURITY WARNING The information contained