Home > SQL Server Tips > Database Management and Administration > Protecting your database: Who's looking at your sensitive data?
SQL Server Tips:
EMAIL THIS
 TIPS & NEWSLETTERS TOPICS 

DATABASE MANAGEMENT AND ADMINISTRATION

Protecting your database: Who's looking at your sensitive data?


By Kevin Beaver, CISSP
05.08.2007
Rating: -2.80- (out of 5)


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


At any given time, it's easy to assume the right people are doing the right things on and with your database systems. However, any real-world experience in IT tells us that information confidentiality doesn't work like that. With database authentication and logging, we can track who has touched certain areas of the database. But, how do you know if someone has simply looked at your data? It may seem a little far-fetched, but if you claim to have security controls in place that protect the confidentiality of your database, then you should know who has been peeking at sensitive records.

There's a multitude of ways that unauthorized eyes can view sensitive data. SQL Server users can poke around and potentially stumble across sensitive data they shouldn't have access to. This is especially true when users share SQL Server accounts. There's no accountability and no fall-back plan when something happens. Another way people can view sensitive data is via SQL injection exploits carried out through poorly written Web applications. If users and roles aren't properly configured, as-designed data access via the application can even create confidentiality issues. These breaches can happen anytime, anywhere and both untrusted outsiders and trusted insiders can carry them out. Production, QA, test, development - you name it - all environments provide opportunities for data disclosure that can create security problems.

Outside of manual log perusal of your databases, applications, and operating systems (only recommended for the truly bored and faint of heart), you can do other things that lead to true data protection. For starters, there's SQL Profiler, a tool that will show you all queries that have been run against a SQL Server 2005 system. With it, you can audit all data-related operations and tweak system performance. SQL Profiler is more of a reactive tool in this case but it's better ...


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   



RELATED CONTENT
Database Management and Administration
Password cracking tools for SQL Server
Using traces in SQL Server Profiler
Meet compliance requirements with improved database security practices
Hardening the network and OS for SQL Server security
Securing the server and database in SQL Server
How SQL Server 2008 components impact SharePoint implementations
Troubleshooting Distributed Transaction Coordinator errors in SQL Server
Achieving high availability and disaster recovery with SharePoint databases
Clearing the Windows page file and its effect on server performance
Deploying a SQL Server virtual appliance for Microsoft Hyper-V

SQL Server Security
Password cracking tools for SQL Server
Meet compliance requirements with improved database security practices
Hardening the network and OS for SQL Server security
Securing the server and database in SQL Server
SQL Server security made simple and sensible
Blog: Protect your databases from the internal threat
Setting up SQL Server Service Broker for secure communication
The keys to database backup protection for SQL Server
Understanding transparent data encryption in SQL Server 2008
The fine line between not encrypting your databases and breach notification

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
data corruption  (SearchSQLServer.com)
data hiding  (SearchSQLServer.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary


than no tool at all! On the proactive side, there are commercial tools that can be used in this context to monitor and report on what database users do and see, such as Pynlogic's Enzo, Lumigent's Audit DB with continuous, automated auditing; and Tizor's Mantra a data activity monitoring and reporting tool for structured and unstructured data.

When you log everything in your applications and tie specific database accounts to specific transactions, you gain in-depth insight into who saw what. Setting up unique logins for each application is another option. That way, you could tie each request back to specific applications. I know, none of this is easy, but security almost always comes with a price.

Maybe it's time to rethink your current authentication schemes, your logging policies, your database administration/security tools and data access on the application side. Chances are if you dig down deep, you'll find data disclosure weaknesses that someone with malicious intent can exploit.


ABOUT THE AUTHOR:   

Kevin Beaver is an independent information security consultant, speaker, and expert witness with Atlanta-based Principle Logic, LLC. He has more than 19 years of experience in IT and specializes in performing information security assessments revolving around compliance and IT governance. Kevin has authored/co-authored six books on information security including Hacking For Dummies and Hacking Wireless Networks For Dummies (Wiley) as well as The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He's also the creator of the Security On Wheels audiobooks providing security learning for IT professionals on the go. Kevin can be reached at kbeaver ~at~ principlelogic.com.
Copyright 2007 TechTarget


Rate this Tip
To rate tips, you must be a member of SearchSQLServer.com.
Register now to start rating these tips. Log in if you are already a member.




DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.



SQL Server Development - .NET, C#, T-SQL, Visual Basic
HomeNewsTopicsITKnowledge ExchangeTipsAsk the ExpertsMultimediaWhite PapersIT Downloads
About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2005 - 2009, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts