database security - storage.googleapis.com · limited database controls' 70% system users can...
TRANSCRIPT
Database Security
Ursula Koski | Senior Principal Architect | Oracle Corporation
Ursula Koski
Senior Principal Architect• Senior Principal Architect
• Oracle User Group Liaison and OUGF Board Member
(Finland); Finnish Security Association ry Board
Member
• Joined Oracle in 2007
– Working mainly with short term database
engagements around the world. High availability
and disaster recovery area. and disaster recovery area.
– Have worked as an Oracle DBA for partners from
1994.
• Interests
– Professional: Oracle Database Evangelist,
Maximum Availability Architecture and Database
Disaster Recovery & Problem solving.
– Personal: Oracle Databases, all technical gadgets
(Geek!), traveling and reading.
What is an “Advanced Persistent Threat”?Cybercrime directed at political, infrastructure, and business targets
What are APTs Ultimately After?
Two Thirds of Sensitive and Regulated
Information now Resides in Databases
' and Doubling Every Two YearsClassified Govt. Info.
Trade Secrets
Source: IDC, "Effective Data Leak Prevention Programs: Start by Protecting Data at the Source — Your Databases", August 2011
Competitive Bids
Corporate Plans
Source Code
Bug Database
Credit Cards
Customer Data
Financial Data
HR Data
Citizen Data
Database Sprawl Makes Attacking Easier!
Sensitive Data
Partners DW/AnalyticsReports Stand By Test DevTemp use
CRM
HR
APPS Admin
DBA
OS Admin
APPS Admin
DBA
Security in a Traditional Environment
HR
ERP
DBA
OS Admin
APPS Admin
DBA
OS Admin
CRM
HR
Security in a Cloud / Consolidated Environment
HR
ERP
DW
“Forrester estimates
that although 70%
of enterprises have
Are Databases Adequately Protected?
EndpointSecurity
Network Security
Authentication Security
of enterprises have
an information security plan, only
20% of enterprises have a
database security plan.”
Source: Forrester Research Inc., Creating An Enterprise Database Security Plan, July 2010
Vulnerability ManagementEmail Security
Database Security
Limited Database Controls'
70% System users can read/tamper data stored in database files or storage70% System users can read/tamper data stored in database files or storage
76% Cannot prevent DBAs from reading/modifying data76% Cannot prevent DBAs from reading/modifying data
68% Cannot detect if database users are abusing privileges68% Cannot detect if database users are abusing privileges
Source: 2010 Independent Oracle User Group Data Security Report
68% Cannot detect if database users are abusing privileges68% Cannot detect if database users are abusing privileges
63% Vulnerable to SQL injection attacks or not sure63% Vulnerable to SQL injection attacks or not sure
48% Copy sensitive production data to non-production environments 48% Copy sensitive production data to non-production environments
31% Likely to get breached over the coming year31% Likely to get breached over the coming year
Data Security – IOUG 2010 Report
72% Do not uniformly encrypt sensitive data in all databases
76%Can not prevent privileged database users from reading/modifying
data
68% Can not detect if database users are abusing privileges68% Can not detect if database users are abusing privileges
66% Not sure if applications subject to SQL injection
48% Copy sensitive production data to non-production environments
Source: 2010 IOUG Data Security Report
What are the High Value Target Systems?
From a study conducted by the Verizon RISK team in conjunction with the US Secret Service
Most Records Lost from Database Servers
Type Category % Breaches % Records
Database Server Servers & Applications 25% 92%Desktop Computer End-User Devices 21% 1%
How were these records breached?
89% using SQL injection
86% using stolen credentials
By exploiting legitimate access to databases!
Source: 2010 Verizon Data Breach Investigations Report
1
Opportunistic Breaches and APT
48% involved privilege misuse
40% resulted from hacking
38% utilized malware
28% employed social tactics
Source: 2010 Verizon Data Breach Investigations Report
1
How did We end up Here?
IT Landscape
• World moving from 2-tier to 3-tier
• Limited security considerations
Threat Landscape
• Hackers driven by fame
• Insiders were well-trusted
Security
• All applications online, and highly available
• Outsourcing, Service Providers, Cloud
• DIY tools; Automated SQL injection attacks
• Targets: Credit cards, PII, IP
Security Landscape
• Network firewall
• Anti virus software
Regulatory Landscape
• HIPAA (1996, 2003)
• EU Data Protection Directives
• Desktop security; Perimeter security
• Vulnerability management
• GLBA (1999), SOX (2002), PCI (2004, 2010)
• Various breach disclosure and privacy laws
2000 2011
1
Sources of Vulnerability
• Security configuration parameters• Security configuration parameters
Applications• SQL Injection attack from outside
• Application bypassApplications
• SQL Injection attack from outside
• Application bypass
Test & Dev Partners
• Access to production data in non-secure environment
• Access to production systems for trouble shooting
Test & Dev Partners
• Access to production data in non-secure environment
• Access to production systems for trouble shooting
Configuration• Security configuration parameters
• Security patchesConfiguration
• Security configuration parameters
• Security patches
Administrative Accounts
• System administrators, DBAs, Application Administrators
• Stolen credentials, Inadequate training, Malicious insiders
Administrative Accounts
• System administrators, DBAs, Application Administrators
• Stolen credentials, Inadequate training, Malicious insiders
Operations• Direct OS access
• Lost / stolen backupsOperations
• Direct OS access
• Lost / stolen backups
Concentrate on the Greatest Risk
From a study conducted by the Verizon RISK team in conjunction with the US Secret Service
Types of Hacking / Percent of Breached Records
• Stolen Login Credentials were involved in 38% of Data
Breaches and 86% of Breached Records
The Two Biggest Culprits'
• SQL Injection was involved in 25% of all Data Breaches
and contributed to the loss of 89% of Breached Records
Database Security – Big Picture
Encrypted Database
Compliance Scan Vulnerability
ScanData
DiscoveryActivity Audit
Patch Automation
Auditing
AuthorizationApplications
Network SQL
Monitoring
and Blocking
Data Masking
Multi-factor
authorization
Unauthorized
DBA Activity
Authorization
Authentication
Discover, Scan, Configure, Patch Oracle Enterprise Manager
ConfigurationManagement
& Audit
VulnerabilityManagement
Audit
Analysis &Analytics
Act
PolicyManagement
AnalyzeClassify AdviceDiscover
AssetManagement
• Discover databases, applications, data models, sensitive data
• Continuously scan against security configuration standards
• Real time monitor file and configuration changes
• Analyze patches, resolve patch conflicts, schedule patches
Audit Consolidation & Reporting Oracle Audit Vault
CRM/ERP Data
Custom App
HR Data
Audit Data
Policies
Built-inReports
Alerts
CustomReports
Auditor
!
• Consolidate audit data into secure audit warehouse
• Detect and alert on suspicious activities
• Out-of-the box compliance reporting
Policies Auditor
Audit Warehouse
ApplicationsBlock
Log
Allow
Alert
Substitute
First Line of Defense on the Network Oracle Database Firewall
• Monitors database activity, and prevents attacks and SQL injections
• White-list, black-list, and exception-list based security policies based upon highly accurate SQL grammar based analysis
• In-line blocking and monitoring, or out-of-band monitoring modes
PoliciesBuilt-in
ReportsAlerts Custom
Reports
Procurement
HR
Finance
Database Operational Controls Oracle Database Vault
Application select * from finance.customersFinance
• Limit powers of privileged users, and enforce SoD
• Protect application data and prevent application by-pass
• Enforce who, where, when, and how using rules and factors
• Securely consolidate application data
• No application changes required
finance.customers
DBA
Transparent Data Encryption Oracle Advanced Security
Disk
Backups
Exports
Off-SiteApplication
Off-Site
Facilities
• Protects from unauthorized OS level or network access
• Efficient encryption of all application data
• Built-in key lifecycle management
• No application changes required
Irreversible De-Identification Oracle Data Masking
LAST_NAME SSN SALARY
ANSKEKSL 111—23-1111 40,000
BKJHHEIEDK 222-34-1345 60,000
LAST_NAME SSN SALARY
AGUILAR 203-33-3234 40,000
BENSON 323-22-2943 60,000
Production Non-Production
• Reduce fear of loss and scope of audit with irreversible de-Identification
on non-production databases
• Referential integrity preserved so applications continue to work
• Extensible template library and policies for automation
BKJHHEIEDK 222-34-1345 60,000BENSON 323-22-2943 60,000
Oracle Database Security Strategy
mySQL
Low Security:
Sensitive Data Removed
Data Masking for Non-Production
Maximum Security:
Controls within Database
Encryption, Auditing, Privileged User Controls, Classification,
Change Tracking, App Security
External Controls:
Protect Oracle and Non-Oracle DB
Activity Monitoring, Auditing, Blocking Attacks, Reporting
Oracle Database SecurityKey Differentiators
High Performance, AccurateHigh Performance, Accurate
Defense-in-Depth Security PlatformDefense-in-Depth Security Platform
Securing through the Life CycleSecuring through the Life Cycle
Transparently Support Existing ApplicationsTransparently Support Existing Applications
Heterogeneous SupportHeterogeneous Support
Issues to Ponder?
1 Is our IP secured?1 Is our IP secured?
33
2 Can we defend against APTs and other attacks?2 Can we defend against APTs and other attacks?
3 Would we know if we were breached?3 Would we know if we were breached?
4 Do privileged users know what they should not?4 Do privileged users know what they should not?
5 Are we in compliance with all regulations?5 Are we in compliance with all regulations?
What’s Your Next Move?
1 Know where is the sensitive data1 Know where is the sensitive data
2 Scan, assess, patch, audit your databases2 Scan, assess, patch, audit your databases
3 Database Firewall as first line of defense3 Database Firewall as first line of defense3 Database Firewall as first line of defense3 Database Firewall as first line of defense
4 Control the privileged users4 Control the privileged users
5 Encrypt and mask sensitive data5 Encrypt and mask sensitive data
Q&AQ&A