At any given time, it's easy to assume the right people are doing the right things on and with your database systems. However, any real-world experience in IT tells us that information confidentiality doesn't work like that. With database authentication and logging, we can track who has touched certain areas of the database. But, how do you know if someone has simply looked at your data? It may seem a little far-fetched, but if you claim to have security controls in place that protect the confidentiality of your database, then you should know who has been peeking at sensitive records.
There's a multitude of ways that unauthorized eyes can view sensitive data. SQL Server users can poke around and potentially stumble across sensitive data they shouldn't have access to. This is especially true when users share SQL Server accounts. There's no accountability and no fall-back plan
when something happens. Another way people can view sensitive data is via SQL injection exploits carried out through poorly written Web applications. If users and roles aren't properly configured, as-designed data access via the application can even create confidentiality issues. These breaches can happen anytime, anywhere and both untrusted outsiders and trusted insiders can carry them out. Production, QA, test, development - you name it - all environments provide opportunities for data disclosure that can create security problems.
Outside of manual log perusal of your databases, applications, and operating systems (only recommended for the truly bored and faint of heart), you can do other things that lead to true data protection. For starters, there's SQL Profiler, a tool that will show you all queries that have been run against a SQL Server 2005 system. With it, you can audit all data-related operations and tweak system performance. SQL Profiler is more of a reactive tool in this case but it's better than no tool at all! On the proactive side, there are commercial tools that can be used in this context to monitor and report on what database users do and see, such as Pynlogic's Enzo, Lumigent's Audit DB with continuous, automated auditing; and Tizor's Mantra a data activity monitoring and reporting tool for structured and unstructured data.
When you log everything in your applications and tie specific database accounts to specific transactions, you gain in-depth insight into who saw what. Setting up unique logins for each application is another option. That way, you could tie each request back to specific applications. I know, none of this is easy, but security almost always comes with a price.
Maybe it's time to rethink your current authentication schemes, your logging policies, your database administration/security tools and data access on the application side. Chances are if you dig down deep, you'll find data disclosure weaknesses that someone with malicious intent can exploit.
ABOUT THE AUTHOR
Kevin Beaver is an independent information security consultant, speaker, and expert witness with Atlanta-based Principle Logic, LLC. He has more than 19 years of experience in IT and specializes in performing information security assessments revolving around compliance and IT governance. Kevin has authored/co-authored six books on information security including Hacking For Dummies and Hacking Wireless Networks For Dummies (Wiley) as well as The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He's also the creator of the Security On Wheels audiobooks providing security learning for IT professionals on the go. Kevin can be reached at kbeaver ~at~ principlelogic.com.
Copyright 2007 TechTarget
This was first published in May 2007