Protecting your database: Who's looking at your sensitive data?
At any given time, it's easy to assume the right people are doing the right things on and with
your database systems. However, any real-world experience in IT tells us that information
confidentiality doesn't work like that. With database authentication and logging, we can track who
has touched certain areas of the database. But, how do you know if someone has simply looked
at your data? It may seem a little far-fetched, but if you claim to have security controls in place
that protect the confidentiality of your database, then you should know who has been peeking at
sensitive records.
There's a multitude of ways that unauthorized eyes can view sensitive data. SQL Server users can
poke around and potentially stumble across sensitive data they shouldn't have access
Premium Access
Register now for unlimited access to our premium content across our network of over 70 information Technology web sites.
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States.
Privacy
Dig Deeper
-
People who read this also read...
This was first published in May 2007
to. This is
especially true when users share SQL Server accounts. There's no accountability and no fall-back
plan
 |
| Get more expert advice on SQL Server security: |
|
|
|
|
|
|
when something happens. Another way people can view
sensitive data is via SQL injection exploits carried out through poorly written Web applications.
If users and roles aren't properly configured, as-designed data access via the application can even
create confidentiality issues. These breaches can happen anytime, anywhere and both untrusted
outsiders and trusted insiders can carry them out. Production, QA, test, development - you name it
- all environments provide opportunities for data disclosure that can create security problems.
Outside of manual log perusal of your databases, applications, and operating systems (only
recommended for the truly bored and faint of heart), you can do other things that lead to true data
protection. For starters, there's SQL Profiler, a tool that will
show you all queries that have been run against a SQL Server 2005 system. With it, you can audit
all data-related operations and tweak system performance. SQL Profiler is more of a reactive tool
in this case but it's better than no tool at all! On the proactive side, there are commercial tools
that can be used in this context to monitor and report on what database users do and see, such as
Pynlogic's Enzo, Lumigent's Audit
DB with continuous, automated auditing; and Tizor's
Mantra a data activity monitoring and reporting tool for structured and unstructured data.
When you log everything in your applications and tie specific database accounts to specific
transactions, you gain in-depth insight into who saw what. Setting up unique logins for each
application is another option. That way, you could tie each request back to specific applications.
I know, none of this is easy, but security almost always comes with a price.
Maybe it's time to rethink your current authentication schemes, your logging policies, your
database administration/security tools and data access on the application side. Chances are if you
dig down deep, you'll find data disclosure weaknesses that someone with malicious intent can
exploit.
ABOUT THE AUTHOR
Kevin Beaver is an independent information security consultant, speaker, and
expert witness with Atlanta-based Principle Logic, LLC. He has more than 19 years of experience
in IT and specializes in performing information security assessments revolving around compliance
and IT governance. Kevin has authored/co-authored six books on information security including Hacking
For Dummies and Hacking
Wireless Networks For Dummies (Wiley) as well as The Practical Guide to HIPAA Privacy and Security
Compliance (Auerbach). He's also the creator of the Security On Wheels audiobooks providing security learning for IT professionals on
the go. Kevin can be reached at kbeaver ~at~ principlelogic.com.
Copyright 2007 TechTarget
Disclaimer:
Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
Join the conversationComment
Share
Comments
Results
Contribute to the conversation