Database Security Issues

1. Database Security Issues Reading: CB, Ch 19

2. In this lecture you will learn • The value of maintaining a secure & reliable database • Some sources of risk (i.e. threats) to a database system • Some measures used to improve DBMS security • Special threats and counter-measures for web-based DBMSs Dept. of Computing Science, University of Aberdeen

3. Data - Information Is Valuable • Many enterprises depend on secure & reliable DBMSs: • Banks • Stock exchanges • Airlines • Hospitals • On-line shopping Dept. of Computing Science, University of Aberdeen

4. Data - Information Is Valuable • DBMS systems may be at risk from situations such as: • Theft & fraud • Loss of • confidentiality (business secrets)  loss of competitiveness • privacy (personal information)  legal implications • integrity  corrupted data • availability • Insecure DBMS worse than having no DBMS at all • Low staff confidence • Low customer confidence Dept. of Computing Science, University of Aberdeen

5. Strength of Security The security of a component is as good as the security of the weakest link in the whole system. Dept. of Computing Science, University of Aberdeen

6. Potential Sources of Risk (1) Examples of threats to data security are: • Software - bugs, unexpected features (includes OS) • Communications – wire tapping, packet sniffers (software/ hardware that can intercept and log traffic passing over a digital network), packet loss. • Hardware -breakdown, theft, fire, flood, power loss... Dept. of Computing Science, University of Aberdeen

7. Potential Sources of Risk (2) • Probably the greatest threats are from people: • Programmers & DBAs - insecure code, trapdoors, fake accounts, inadequate access control. • Users – insecure behaviour, phishing. • Which group do you think poses the greatest threat? • Impact of an event is important but not the event’s occurrence probability • Rare events may pose more risk Dept. of Computing Science, University of Aberdeen

8. Common Security Measures (1) • Authentication – passwords • Authorization - privileges, views • Verification - digital signatures/certificates • Encryption - public key / private key, secure sockets • Integrity – IEF (Integrity Enhancement Features), transactions Dept. of Computing Science, University of Aberdeen

9. Common Security Measures (2) • Physical Measures • Backups - offsite backups, journaling, log files • RAID (Redundant Array of Independent Discs) discs - data duplication, “hot swap” discs • Data centres, alarms, guards, UPS Dept. of Computing Science, University of Aberdeen

10. Authentication (1) • PIN numbers, passwords, bank cards… • But users display insecure behaviour • Password sharing • Password duplication • Writing down passwords • Easy passwords (“wendy1”,”moncur”) Dept. of Computing Science, University of Aberdeen

11. Authentication (2) • It’s not their fault! • How many passwords do you have? • Do you display insecure behaviour? • Problems • (see http://www.csd.abdn.ac.uk/~wmoncur/publications/CHI2007.doc for more detail): • Memory burden • Memory confusion Dept. of Computing Science, University of Aberdeen

12. Solutions to insecure behaviour? • Biometrics? Dept. of Computing Science, University of Aberdeen

13. Solutions to insecure behaviour? • Biometrics? • Usability must be a consideration Dept. of Computing Science, University of Aberdeen

14. Authentication: Phishing (1) • Electronic fraud using social engineering. • Phishers pretend to be a trustworthy party (such as a bank) • Attempt to steal sensitive information (eg -passwords, bank account numbers, credit card details). Dept. of Computing Science, University of Aberdeen

15. Authentication: Phishing (2) • It’s a BIG problem • The Independent (Sunday, 27 january 2008) • “… Uk online banking customers …. at severe risk of being tricked into giving away their account details to criminal gangs……the phishing emails are very well constructed and often look exactly like a legitimate bank message.” said Dan Field of ClearMyMail • A spokesperson for NatWest said: "we continue to take fraud extremely seriously. We have developed and put in place significant security processes and resources to protect against this type of threat. Phishing is an industry-wide issue.” Dept. of Computing Science, University of Aberdeen

16. Authorisation: Granting Permissions • Grant permissions to groups of users • Only allow appropriate access GRANT SELECT, INSERT ON mydatabase.personneltable TO 'someuser'@'somehost'; Dept. of Computing Science, University of Aberdeen

17. Authorisation: Can the right people access the right data? DBA Backup/ restore data Reorganise data Change database definitions Update statistics on data Chief executive Employee statistics PERSONNEL database Staff member Their own data Personnel team Query & update data at individual or regional level Dept. of Computing Science, University of Aberdeen

18. Verification: Digital Signatures • Digital signatures (RSA in reverse): • Establishes authenticity of a document "Hi, this message is in clear text but if anyone changes even a single byte, you will be able to tell that the message is not the original from the digital signature below, signed with my private key. Yours, D.“ BEGIN SIGNATURE P4`341uy2rl34iut1lf,jbf,KPP98$\%\#!\$"BV!"X# END SIGNATURE • Problem: How can we verify authenticity of sender ?? Dept. of Computing Science, University of Aberdeen

19. Verification: Digital Certificates • Digital Certificates use a trusted third party called a “Certificating Authority” (CA). • If A & B both trust CA, then A & B can trust each other • Often used to set up secure connections: HTTPS, SSL • Once certificates exchanged, can then use RSA etc. Certificating Authority CertB CertA Trust CertB CertA A B PubA PubB Dept. of Computing Science, University of Aberdeen

20. Encryption & Decryption • encryption • is the process of transforming data using an algorithm • make data unreadable to anyone except those possessing special knowledge, usually referred to as a key. • decryption • makes encrypted data readable again. Dept. of Computing Science, University of Aberdeen

21. Encryption - Symmetric Keys • Method in which both the sender and receiver share the same key. • This is OK if A and B are physically nearby • But on the internet, there's a serious problem!! • DES - Data Encryption Standard; 56-bit keys, fast but breakable Key Plain Text Cypher Text Encryption Algorithm Dept. of Computing Science, University of Aberdeen

22. B’s Public Key A’s Public Key Cypher Text B A B’s Private Key B’s Public Key Encryption - Private Key / Public Key • Assymetric encryption • Public key encodes a message... Private key decodes it... • Above, A (sender) first asks B (receiver) for public key... • Then, A can encrypt message with B's public key • Rivest, Shamir, Adelman (RSA): slow but unbreakable • RSA - Uses massive prime numbers (128-bit keys) • PGP – “Pretty Good Privacy” combines DES + RSA Dept. of Computing Science, University of Aberdeen

23. Firewalls • Firewalls block unauthorised external network access • Firewalls may limit access to the internet for ‘internal’ machines The Internet ?? Firewall Internal Network DBMS Server Internal Client Internal Client Dept. of Computing Science, University of Aberdeen

24. Example Firewall Architecture The Internet Bastions • “Bastion Hosts” run web services etc. (liable to attack) • Routers connect networks... • Internal router is main “firewall” Router WWW Mail Proxy Perimeter Network Router Internal Network Dept. of Computing Science, University of Aberdeen

25. Firewall Techniques • Use a proxy server to hide internal network addresses: • General guidelines: • Disable all user accounts on all Bastion machines • Preferably, run only one type of service on each Bastion machine • Software firewalls: • Can have “all-software” firewalls (packet filters) • Until MS-Blast virus, Microsoft shipped Windows-XP with firewall off by default!! SE.CR.ET.!! Proxy 22.33.44.55 Dept. of Computing Science, University of Aberdeen

26. Summary • The best security comes from using multiple techniques: • People - authorisation/authentication . .need-to-know. • Physical - protect the hardware, RAID discs, backups • Network - use firewalls, encryption • Software – “good programming practice” main CS responsibility • For any given system: • Consider the different sources of risk (threats)... • Balance the cost of implementing security measures vs cost of any loss!! Dept. of Computing Science, University of Aberdeen