Database Security: What Gets Overlooked?

0 © 2012 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Database Security: What Gets Overlooked?

The program will begin shortly. Please listen to the webinar through your computer with the speakers turned on.

Cal Slemp, Managing Director, Protiviti James Hulscher, Senior Manager, Protiviti

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

1

Some Reminders . . .

ASKING QUESTIONS Click on the “ASK A QUESTION” link at the top of your screen. Please provide your email address for a swift reply.

Q&A There will be a Q&A session at the end of the presentation

COPY OF SLIDES After the webinar, all attendees will be able to access the recording and the presentation slides

POLLING QUESTIONS/VOTES Participation is voluntary. Results will be included in the slides.

NEED HELP? If you need help during the webinar, click “RATE THIS” “Not hearing audio? Click here for help”

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

2

Today’s Presenters

Cal Slemp – Global Protiviti leader for IT Security & Privacy

– 30+ years of experience in information technology risk & strategy consulting

– Deep expertise in the pharmaceutical, manufacturing, consumer packaged goods and retail industries

James Hulscher – 15 years of experience in IT

– Manufacturing, education, health care, insurance, and financial services

– Completing Ph.D. in Information Assurance with specialization in security

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

3

Why Is Database Security Critical?

Highly valuable asset – DATA

Vulnerable

Support business critical operations

Data breach requirements

Data leveraged for further attacks

As strong as your weakest link

Database attacks steadily increase

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

4

Security Breaches Continue to Worsen

2011 Yet another record-breaking year for security breaches

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

5

Database Security – Types of Attacks

Attacks on organizational data infrastructure are becoming increasingly complex

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

6

Database Security – Tools and Resources

Increased malware availability

Rapidly advancing capability

Organizational resources and pace are outstripped

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

7

Database Security – Who’s Responsible for the Data?

The Challenge:

A proactive, evolving, and privacy-focused strategy and methodology

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

8

Database Security – Who’s Responsible for the Data?

Who in the organization is responsible for data security and privacy?

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

9

Database Security – Who’s Responsible for the Data?

Everyone!

– Security Team(s)

– DBAs/Architects

– Developers/Application Support

– Network and Systems Administrators

– End Users

– Vendors (Extranets)

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

10

Database Security – Significant Loss

$7.2 Million

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

11

The Evolution of Data Security – Data As the Target

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

12

The Evolution of Data Security – Organized Attacks

Typically, an organized group of malicious users, not just an individual, and typically globally.

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

13

The Evolution of Data Security – Regulatory Requirements

Compliance and regulatory requirements for organizations have significantly increased

IT Auditors must understand the avenues to the data and the impacts of weak or missing controls

More than just network penetration tests, vulnerability scans, database penetration tests

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

14

The Evolution of Data Security – Consumer Awareness

Consumer awareness of data theft =

Financial Loss

Reputation Damage

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

15

The Evolution of Data Security – A Paradigm Shift

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

16

The Evolution of Data Security – A Paradigm Shift

Comprehensive view of securing data, and the systems within the enterprise

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

17

Why the Data?

Data leakage can provide the information for a much more sophisticated attack on an organization

Ultimately, the data will lead to some type of gain

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

18

Understanding Database Logging

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

19

Understanding Database Logging

Native Logging (Vendor Provided) – How did the user get to the DB?

– How/when/who created the user?

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

20

Database Monitoring

Identifies: – Unauthorized changes to data structure

– Illicit activity (e.g. mass data extract)

Provides audit trails for compliance requirements

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

21

Database Monitoring

Prevention and early detection for quick reaction

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

22

What Types of Changes Take Place Within a Database?

DML is Data Manipulation Language – Insert

– Select

– Update

– Delete

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

23

What Types of Changes Take Place Within a Database?

DML attack via SQL Injection

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

24

What Types of Changes Take Place Within a Database?

DCL is Data Control Language – Grant – Grant rights to an object or entire database

– Revoke – Remove access rights to an object or database

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

25

What Types of Changes Take Place Within a Database?

Why is DCL critical to DB functions? – A malicious user can grant/revoke rights to users, schemas, and applications that connect to a DB.

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

26

Methodology : Outside-In

Tools

Technologies

Security Appliances

Controls

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

27

Methodology : Outside-In

Audit and systematic reviews of: – Database activity

– DML/DCL changes from external sources

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

28

Methodology : Outside-In

Types of access control

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

29

Methodology : Outside-In

Encryption

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

30

Methodology : Inside-Out

Internal attacks are likely, due to – Abuse of privileged and super user accounts

– End users allowing code/malware to enter: email, social media, thumb drives

– Abuse of data by organizational partners or service providers

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

31

Methodology: Inside-Out

Develop and encrypt data that can only be used by applications.

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

32

Methodology: Inside-Out

Background check

Financial monitoring

Criminal monitoring

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

33

Methodology: Inside-Out

Incident Preparation and Response

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

34

Methodology: Inside-Out

3rd Party audits – Deep database penetration tests

– Reviews of database logs

– Manual testing of applications

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

35

Let’s Review Some Examples

SQL Injections – How they work at a high level

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

36

SQL Example 1

SQL Injection. Web-based application communicating with a backend database.

“OLE DB Provider…ODBC SQL Driver [SQL Server} Error xxxxxxx error converting “ABC” into a column of data type int”

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

37

SQL Example 2

Using http or a webpage once a footprint has been detected.

http://ABCBank/index.asp?username=admin;password=1’ OR 1=1;--

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

38

What Is a Stored Procedure?

Stored Procedures – the solution for preventing SQL Injections?

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

39

SQL Example 3

Allowing direct SQL sessions to your database – telnet session

– T-SQL

– PL/SQL

Example: SELECT userNAME from users where userNAME=‘ ‘; shutdown with nowait; --’ and userpass=‘ ‘

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

40

Unification

An example – DBO (Privileged Account) with no rights to write data to the server

– Server admin creates DBO account for DBA

– Consistency in password procedures?

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

41

Further Unification Evaluation – Real World Examples

Another example – Install of 3rd-party app requires admin rights

– Password change may impact maintenance and support

– Additional risks

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

42

Database Auditing

Database systems are both the most overlooked and the most crucial areas in need of securing

Database security requirements in: – HIPPA - Dodd-Frank - US Patriot Act (AML)

– HITECH - ISO 27000 - Various Industry

– SOX - PCI – DSS

– GLBA - EU Data Protection Directive

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

43

Auditing Database Errors

Architecture reviews – applications and middleware

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

44

Principles for Developing a Database Audit Strategy

Protect the audit trail

Audit mainstream activities

Audit critical actions

Archive audit records

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

45

Controls are Critical

Document – Storage management architecture

Audit – At random times

– Especially after migrations, upgrades, and during implementation

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

46

Database Improvements Will Enable Compliance

Example – Configuration Parameters

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

47

Tools and Resources

Commercial Tools: – Acunetix – website vulnerability scanning tool

– Nessus – vulnerability assessment scanning tool

Freely Available: – BackTrack5 – Numerous vulnerability assessment tools

– Havij – Find SQL Injection vulnerabilities

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

48

2012 and the Continued Evolution

Data protection requirements will increase

More mobile devices

Social media = more ways to share data Know your data

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

49

Contact Information

For more information about our approach to database security, including database logging and database monitoring, please contact

Jim Hulscher

Powerful Insights. Proven Delivery. ®

601 Carlson Parkway Suite 1120 Minnetonka, MN 55305 USA Direct: 952.249.2219 james.hulscher@protiviti.com

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

50 50

VOTES

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

51 51

VOTES

© 2011 Protiviti Inc. CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

52 52

VOTES