09 database security

8/16/2019 09 Database Security

1/7

Database [email protected]

SYSTEM VULNERABILITYAND ABUSE

When large amounts of data are stored in

electronic form they are vulnerable to many

more kinds of threats

Why systems are vulnerable

In multi-tier client server computing environment

vulnerabilities exist at each layer and in

communications between the layer

Unauthorized access

Why systems are vulnerable

Intruders who launch denial of service attacks or

malicious software

System malfunction because hardware breaks

down or damaged by improper use or criminal act

Database Security

Database Security: Protection of the data

against accidental or intentional loss,

destruction, or misuse

Increased difficulty due to Internet access and

client/server technologies

Possible locations of datasecurity threats


2/7

Threats to Data Security

Accidental losses attributable to:

• Human error

• Software failure

• Hardware failure

Theft and fraud

Loss of privacy or confidentiality

Loss of data integrity

Loss of availability (through, e.g. sabotage)

Security Policies andProcedures

Personnel controls

• Hiring practices, employee monitoring, security training

Physical access controls

• Equipment locking, check-out procedures, screen placement

Maintenance controls

• Maintenance agreements, access to source code, quality andavailability standards

Data privacy controls

• Adherence to privacy legislation, access rules

Database Recovery

Mechanism for restoring a database quickly and

accurately after loss or damage

Recovery facilities:

• Backup Facilities

• Journalizing Facilities

• Checkpoint Facility

• Recovery Manager

Backup Facilities

• Automatic dump facility that produces backup copyof the entire database

• Periodic backup (e.g. nightly, weekly)

• Cold backup – database is shut down duringbackup

• Hot backup – selected portion is shut down andbacked up at a given time

• Backups stored in secure, off-site location

Journalizing Facilities

Audit trail of transactions and database updates

Transaction log – record of essential data for

each transaction processed against the

database

Database change log – images of updated data

• Before-image – copy before modification

• After-image – copy after modification

Security and challenges ofvulnerabilities


3/7

Internal threats : Employee

Largest financial threats to business institutions

come from insiders

Users lack of knowledge is the single greatest

cause of network security breaches

Management Framework forSecurity and Control

COBIT FRAMEWORK

• Also know as the Control Objectives forInformation and Related Technology framework.

• Developed by the Information Systems Audit andControl Foundation (ISACF).

• A framework of generally applicable informationsystems security and control practices for ITcontrol.

COBIT FRAMEWORK

The framework addresses the issue of control from threevantage points or dimensions:

• Business Objectives: To satisfy business objectives,information must conform to certain criteria referred toas “business requirements for information.”

• IT resources: people, application systems,technology, facilities, dan data

• IT processes: planning and organization, acquisitionand implementation, delivery and support, andmonitoring

Types of InformationSystems Control

General Control govern the design, security, and

use of computer programs and the security of

data files in general throughout the

organization’s information infrastructure.

General control

General control includes software controls,

physical hardware controls, computer

operations controls, control over implementationprocess and administrative controls.

Picture example of Physicalhardware control


4/7

Picture example of Physicalhardware control


5/7

Ensuring business continuity

Computer failures, interruptions and downtime

translate into disgruntled customers

Downtime. Period of time in which a system is

not operational.


Fault-tolerant computer systems: hardware,

software and power supply components that

provides continuous, uninterrupted service.

Part of these computers can be removed and

repaired without disruption to computer system


High-availability computing: System that help

firms recover quickly from crash

Requires a tools and technologies to ensure

maximum performance of computer system and

networks. Including redundant server, load

balancing, clustering, high capacity storage,

and good recovery.


Load balancing: distributes large numbers of

access request across multiple servers.

Mirroring. Backup server that duplicates all the

processes and transactions of primary server.

Data Center

TELKOM SIGMA Data Center in Serpong and Sentul

Facebook data center


6/7

Disaster recovery plan andbusiness continuity planning

Disaster recovery plan: Plans for restoration and

computing and communications services after

disrupted by disaster

Business continuity planning, focus on how

company can restore business operations after

a disaster strike.Disaster recovery plan and business

continuity planning

Disaster recovery plan and business

continuity planning

Disaster recovery plan and business

continuity planning

Technology and tools forsecurity and control

Firewalls gatekeeper that examines each user

credential before access granted

Intrusion Detection System, full time monitoring

tools placed at most vulnerable points.

Sarbanes Oxley anddatabases

• The Sarbanes Oxley were designed to ensure

the integrity of public companies financial

statement

• the key component is ensuring sufficient control

and security over the financial system and IT

infrastructure in use.


7/7

Key focus of SOX audit

• IT Change Management

• Logical Access to data

• IT operations

IT Change Management

• Refer to process by which changes to

operational systems and databases are

authorised

• Top deficiency found by SOX auditor:

• Inadequate segregation of duties between

people who have access to database in three

environments: Development, Test and

Production

Logical Access to data

• Logical Access to data is essentially about

security procedures in place to preventunauthorised access to data.

• Two types of security policy and procedure:

• Personnel Control

• Physical Access Control.

IT Operations

• IT Operations refers to the policies and

procedures in place related to day to day

management of the infrastructure, applications,and databases in organisation

• key areas:

• database backup and recovery

• data availability

09 database security

Documents