5 steps to reduce risk and improve database security

1 Copyright © 2011, Oracle and/or its affiliates. All rights
reserved.

5 Steps to reduce Risk and improve Database Security

Edgars Ruņģis, Technology Consultant
reserved.

Why Increase Database Security?

3 Copyright © 2011, Oracle and/or its affiliates. All rights Source: "Effective Data Leak Prevention Programs: Start by Protecting Data at
reserved. the Source — Your Databases", IDC, August 2011

How Secure Are Your Databases ?
2011 IOUG Data Security Survey Results

reserved.
http://www.oracle.com/us/products/database/2011-ioug-data-security-survey-516534.pdf

IT Security Not Addresing Database Security –
Only 20% Have A Plan

reserved.

5 Steps to Reduce Risk and Improve Database
Security
1. Mitigate Database Bypass
2. Prevent Account Misuse
3. Consolidated Auditing and Compliance Reporting
4. Monitor Database Traffic and block Threats
5. Protect non-production Environments

reserved.

How can we access data bypassing Database?

• Restore DB from unprotected
backup copy
• Access data stored in database
files by IT staff/OS users and
read the information

reserved.

What about Oracle Database Data Files ?

reserved.
8

Mitigate Database Bypass
Oracle Advanced Security for authentication and encryption

Disk

Backups

Exports
Application
Off-Site
Facilities
• Prevents access to data stored in database files, on tape, etc.
by IT staff/OS users
• Efficient application data encryption without changes
• Strong authentication of database users for greater identity
assurance
• Built-in key management for Seperation of Duties

reserved.

Mitigate Database Bypass
Transparent Data Encryption Key Architecture
Hardware
Security Module
Tablespace Table
Key Key

Standard
Wallet
Master Key
Auto-Open
Wallet

Local
Auto-Open Oracle
Wallet Wallet TDE Tablespace TDE Column
Encryption Encryption

reserved.

Prevent Account Misuse
What privileged users (DBA) can do ?
– Access, delete, or change ANY application data
• Change salary ? Why not!
– Turn off auditing (!!!)
• Change salary without audit trail ? Why not!
– Modify audit trails to hide tracks
– Intentional or accidental harmful changes
• DB link from test to production system...? It happens!
– Add unauthorized user accounts or modify existing accounts
• Create new account for your best “friend” and grant DBA privileges ...
– ...

reserved.

Oracle Database Vault to enforce privileged user access

Procurement

Applications
HR
select * from
Finance finance.customers

DBA
• Restrict highly privileged users from application data and DBA seperation of duties
• Enforce who, where, when and how data is accessed using rules and factors
• Enforce least privilege for privileged database users
• Prevent application by-pass
• Securely consolidate application data or enable multi-tenant data management

reserved.

Example: Privileged User Access

Fin Oracle DB

DBA

reserved.
13

Example: Complete the Definition of the Realm

reserved.
14

Example: Privileged User Access, Again

Fin Oracle DB

DBA

reserved.
15

Some Use Cases of Oracle Database Vault
Requirement Database Vault Solution
Restrict DBA access to sensitive data Realm around application data allowing only the authorized
application owner to access data

Enforce application access through middle tier processes Rule restricting database access based on middle tier server IP
(Prevent application bypass) addresses

Protect mission-critical business data from intentional or Rule restricting dropping or wiping out associated database
accidental harmful changes structures

Restrict users access data outside standard working Rule restricting users’ login to working hours
hours

Enforce patching and backup to specific maintenance Rule restricting database maintenance DBA’s login to
periods and monitor the patching process. maintenance day/time
Rule requiring two DBAs to authenticate during maintenance
periods from internal IP addresses

reserved.

Consolidated Auditing and Compliance
Reporting

reserved.

Questions to consider

• How do you consolidate your audit data ?
• How do you detect and alert on suspicious activities ?
• Do You run reports over audit data ?
• Is Your audit data protected ? What about power users
(DBAs)?
• How do you cleanup/archive audit data ?

reserved.

Consolidated Auditing and Compliance Reporting
Oracle Audit Vault - Trust But Verify

• Consolidate database audit trail into secure centralized repository
• Out-of-the box compliance reports for SOX, PCI, and other regulations
– E.g., privileged user audit, entitlements, failed logins, regulated data changes
• Detect and alert on suspicious activities, including privileged users
– Creating users on sensitive systems, role grants, “DBA” grants, failed logins
.
reserved.

Monitor Database Traffic and block Threats
Oracle Database Firewall - First Line Of Defense

• Blocks unauthorized access like SQL injections from reaching databases
• SQL grammar analysis ensures accuracy, enforcment and scalability
• White-list and black-list based security policies
• In-line blocking and monitoring, or out-of-band monitoring modes

reserved.

How to Catch Anomalous SQL with Accuracy,
Performance, and Scale?
SELECT * from stock where catalog-no = 'PHE8131' and location = 1

SELECT * from stock where catalog-no = ''--' and location = 1

SELECT * from stock where catalog-no = '' having 1=1 -- ' and location = 1

SELECT * from stock where catalog-no = '' order by 4--' and location = 1

SELECT * from stock where catalog-no = '' union select cardNo,customerId,0
from Orders where name = 'John Smith'--' and location = 1

SELECT * from stock where catalog-no = '' union select min(cardNo),1,0 from
Orders where cardNo > '0'--' and location = 1

reserved.

Oracle Database Firewall Positive Security Model
SELECT * from stock White List
where catalog-no='PHE8131' Allow

Block
Applications SELECT * from stock
where catalog-no=‘
' union select cardNo,0,0
from Orders --’

• “Allowed” behavior can be defined for any user or application
• Automated whitelist generation for any application
• Many factors to define policy (e.g. network, application, etc)
• Out-of-policy Database network interactions instantly blocked

reserved.

Oracle Database Firewall Negative Security Model
SELECT * FROM Black List
DBA activity via v$session
Applications Block

DBA activity via SELECT * FROM
Approved Workstation v$session Allow
+ Log

• Stop specific unwanted SQL interactions, user or schema access
• Ensures database interactions originate from appropriate sources
• Blacklist can take into account built-in factors such as time of day, day of
week, network, application, etc
• Provide flexibility to authorized DBAs while still monitoring activity
reserved.

Protect non-production environments
Questions to consider ...
• 37% “live” porduction data; 48% outdated production data is being
used for testing, development, support, training, etc. *
• Regulations restrict use of sensitive data and mandate access
control (who, where, how, and why)
• Why to break in into production system if the production data is
available in development / test system ?
• Are developers/testers authorized users of your production data ?

24 Copyright © 2011, Oracle and/or its affiliates. All rights * Source: IOUG 2010 data security survey
reserved.

Oracle Data Masking secures Test System Deployment
Production Test
LAST_NAME SSN SALARY LAST_NAME SSN SALARY

AGUILAR 203-33-3234 60,000 SMITH 111-23-1111 60,000

BENSON 323-22-2943 40,000 MILLER 222-34-1345 40,000

• Deploy secure test system by masking sensitive data
• Extensible, centralized, template library and policies for automation
• Sophisticated masking: Condition-based, compound, deterministic
• Integrated masking and cloning
• NEW in EM 12c: Application Data Modeling
• NEW in EM 12c: Sensitive Data Discovery

reserved.

Data Discovery and Modeling

• Sensitive data
discovery
– Pattern-based
– Import from pre-
built templates

reserved.

Why to use Data Masking ? Why not to write
some scripts ?

• Think about the maintance of the scripts by introducing
some changes to the table structures...
• What happens if your DBA leaves the organization ?
• Quality of the scripts; Masking is resource intensive
process; Oracle knows Oracle (optimizations) the best ;)

reserved.

What’s next ?

reserved.

Secure Production Database Environment
Oracle Database Lifecycle Management
Discover Scan and Monitor Patch

• Discover and classify databases into security policy groups
• Scan databases against 400+ best practices and industry standards, custom enterprise-
specific configuration policies, and enforce security compliance
• Detect and prevent unauthorized database configuration changes, trouble ticket tracking
• Automated patching and secure provisioning

reserved.

Security Homepage in Oracle Enterprise
Manager 12c

reserved.

Oracle Database Security Strategy
Compliance
Data Vulnerability
Scan
Discovery Scan
Patch
Activity Audit
Automation

Auditing Encrypted Database

Applications Authorization Data Masking
Authentication
Network SQL Monitoring
and Blocking

Unauthorized Multi-factor
DBA Activity authorization

reserved.

reserved.

5 steps to reduce risk and improve database security

Recomendados

Recomendados

Más contenido relacionado

Destacado

Destacado (11)

Más de ORACLE USER GROUP ESTONIA

Más de ORACLE USER GROUP ESTONIA (20)

Último

Último (20)

5 steps to reduce risk and improve database security