Information security of databases (Database security) - a system of measures and means aimed at protecting information stored in databases of various types. Control over the security of databases is necessary, the information contained in them will always be of interest to third parties, and the larger the database, the more serious level of protection it requires.
Database concept
A database is understood not just processed information stored in a file or group of files, but properly organized and prepared for the user. To work with databases, software protection and management tools are used - database management systems (DBMS), involving the use of programming languages that provide uniform principles for describing, storing and processing information. Oracle Database, MS SQL Server, MySQL (MariaDB) and ACCESS are most often used as a software shell for databases. Metadata is used to describe the content.
In practice, the following types of databases are used:
- factual - brief descriptive information about the objects of a certain system is introduced here in a precisely defined format;
- documentary - it includes documents or files of various types: text, graphic, sound, multimedia;
- distributed - a database, different parts of which are stored on different servers connected to a network;
- centralized - for data located on one server;
- relational - a database with tabular data organization;
- unstructured (NoSQL) - a database where the problems of scalability and accessibility are solved due to atomicity and consistency of data, without creating a specific (relational) structure for them.
Database security tasks
Structured and systematized information located in managed databases (DBMS) located on dedicated servers is easier to process and analyze, and is used in building business processes. It is of greater interest to cybercriminals than unstructured information in disparate files and short-term memory. Therefore, the main tasks for ensuring security are:
- protection of information from unauthorized access (NSD) by insiders or external stakeholders;
- prevention of data destruction. The mechanisms of modern DBMS (Database Management System) are able to calculate partially erased and damaged information and correct the error, therefore we are talking about ensuring security against the risks of complete destruction of the database content;
- protection against software and hardware errors, difficulties with access to the server, which make it difficult or make it impossible for users to process the information contained in the databases.
Tasks are solved in various ways, the choice of security tools is based on an understanding of the threats aimed at the contents of the database.
Threats
Building an effective database security system will require an assessment of threats based on the value of information and the practice of criminal encroachment on data that has developed in the sphere of its circulation. So, some tools are used for the research institute database, and others - for the Internet providers' databases. Among the main ones:
- unauthorized use of information in the database by system administrators, users, hackers;
- virus attacks with various consequences;
- SQL injections, arbitrarily modifying code or reformatting databases;
- technical problems, decreased productivity, denial of access, excluding the possibility of using information;
- physical damage to equipment or communication channels;
- errors, flaws, unauthorized features in programs that manage databases, and other software, operating systems are the most vulnerable.
These are the most common threats that have to be dealt with in order to ensure the information security of databases.
Access and privileges
The first task to ensure the security of the database is the differentiation of access rights and the definition of privileges that allow system administrators to exercise control and users to gain access to data.
There are two types of privileges:
- system privileges;
- object privileges.
Systemic ones allow the administrator to perform managerial actions in relation to the database and the information objects contained in it. This is as, for example, indicated for the SQL Server DBMS, creation:
- the database itself;
- procedures for delimiting or processing information;
- representation;
- backup database;
- tables;
- trigger.
Object privileges determine the scope of user rights when working with information objects, taking into account security restrictions. In a DBMS, the most common uses, selection, insertion of a new object, update and links.
After determining the scope of privileges, the question arises of delimiting access rights, which makes it possible to cut off from information arrays users who do not have a certain amount of rights, for example, employees of other divisions of the company. If the enterprise management system is certified according to one of the international standards, for example, ISO 9001, and the database contains information used to generate public reporting, the delimitation of privileges becomes a mandatory task, while a third party, who is not a DB developer, audits the existence of delimitations. There must be confirmation that the person has been given the least privileges when working with databases and not offered excessive rights to manage the program or change information. The problem of overpriced privileges is noted by experts as one of the main vulnerabilities typical of a DBMS.
For the purpose of information security, in databases common for the entire company, the question of differentiating user rights to access various information objects contained in the database arises. This security issue is addressed using a variety of software tools to assign tokens to users and objects. Operations become possible only when markers match. Modern software solves the problem of differentiating access not only to database elements - files, documents, records, but also to structural parameters such as an element, field, record, data set.
Vulnerability assessment techniques
A number of requirements for the certification of the company's activities involves assessing the vulnerability of the database using various methods and parameters in order to establish how secure the information is. A manual or automatic scan is used to find errors in the program code that allow unauthorized access to data, bypass security controls, hack or compromise security. In parallel with scanning for vulnerabilities, continuous monitoring is required to detect information security incidents or changes in DBMS files. Scanning and monitoring are mandatory risk assessment mechanisms for companies seeking ISO certification or listing their securities on foreign stock markets.
Monitoring
The absence of failures in the operation of databases and the constant availability of information will allow the monitoring of activity to identify. It is carried out in real time using one of the following methods:
- by analyzing protocol (SQL) traffic from the management server over the network;
- by monitoring the activity of the local database on each server for distributed databases using software agents hosted on the management server.
In addition to activity auditing, activity auditing is an activity log that records all user activity on database items in the activity log. Security requirements, according to the standards, imply that administrators cannot disable or change the rules of behavior of such accounting registers, change the entries in them. Also, such monitoring systems often have the right to independently identify or disable users whose activity seems suspicious to them.
Audit
External or internal audit of database health will identify systemic problems or sudden incidents. Most DBAs use external software tools to audit database security vulnerabilities and issues. However, many database hosting platforms are able to offer their own auditing tools. This monitoring at the host or provider level will become a control tool to prove that no changes have been made to the database.
Control process and procedures
Customized control procedures will help to solve the problem of bringing to justice persons who violated the integrity or confidentiality of information The database security program should ensure that the scope of user privileges and access rights is regularly reviewed to identify changes. Also, to increase the degree of database security, the following are often used:
- a two-factor user authentication system, sometimes using technical means - tokens;
- sound alarm system when detecting information security incidents;
- emergency recovery system when the base or part of it is destroyed. Failure to implement a backup system is becoming one of the most common mistakes.
Other software solutions for database protection can be implemented when implementing a DLP system that excludes intentional data leaks.
General principles of database security management
Building an information security system and combining various methods, the optimal effect can be achieved by sequentially taking the steps:
- selection of a secure server or database platform offering their own audit and monitoring systems;
- limiting physical access to computers on which the database elements are located, and limiting user access rights using software solutions;
- the use of two-layer solutions for organizing access, in which the user gets access to a CRM or other business system containing only links to database elements. This minimizes the risk of misuse, alteration or copying of information;
- ensure the availability of a database backup and recovery system after failures;
- exclusion of the possibility of launching any programs or processes on a server with a database.
This set of restrictions will reduce the risk of unauthorized access to the database and will allow solving the problem of information security and confirmation of its reliability to auditors, if necessary.
16.12.2020
