 |
|
| SQL Server Tips: |
|
|
|
MICROSOFT SQL SERVER
Protecting your database: Who's looking at your sensitive data?
By Kevin Beaver, CISSP
05.08.2007
Rating: -2.80- (out of 5)
|
At any given time, it's easy to assume the right people are doing the right things on and with your database systems. However, any real-world experience in IT tells us that information confidentiality doesn't work like that. With database authentication and logging, we can track who has touched certain areas of the database. But, how do you know if someone has simply looked at your data? It may seem a little far-fetched, but if you claim to have security controls in place that protect the confidentiality of your database, then you should know who has been peeking at sensitive records.
There's a multitude of ways that unauthorized eyes can view sensitive data. SQL Server users can poke around and potentially stumble across sensitive data they shouldn't have access to. This is especially true when users share SQL Server accounts. There's no accountability and no fall-back plan
when something happens. Another way people can view sensitive data is via SQL injection exploits carried out through poorly written Web applications. If users and roles aren't properly configured, as-designed data access via the application can even create confidentiality issues. These breaches can happen anytime, anywhere and both untrusted outsiders and trusted insiders can carry them out. Production, QA, test, development - you name it - all environments provide opportunities for data disclosure that can create security problems.
Outside of manual log perusal of your databases, applications, and operating systems (only recommended for the truly bored and faint of heart), you can do other things that lead to true data protection. For starters, there's SQL Profiler, a tool that will show you all queries that have been run against a SQL Server 2005 system. With it, you can audit all data-related operations and tweak system performance. SQL Profiler is more of a reactive tool in this case but it's better than no tool at all! On the proactive side, there are commercial tools that can be used in this context to monitor and report on what database users do and see, such as Pynlogic's Enzo, Lumigent's Audit DB with continuous, automated auditing; and Tizor's Mantra a data activity monitoring and reporting tool for structured and unstructured data.
When you log everything in your applications and tie specific database accounts to specific transactions, you gain in-depth insight into who saw what. Setting up unique logins for each application is another option. That way, you could tie each request back to specific applications. I know, none of this is easy, but security almost always comes with a price.
Maybe it's time to rethink your current authentication schemes, your logging policies, your database administration/security tools and data access on the application side. Chances are if you dig down deep, you'll find data disclosure weaknesses that someone with malicious intent can exploit.
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSQLServer.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
|
|
|
| TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of . |
|
| | |
All Rights Reserved, , TechTarget |
|
|
|
|
|
