Database Reference
In-Depth Information
Social Engineering Attacks
Separate from insider-originated attacks are social-engineering attacks initiated by external attackers, targeting
internal IT staff. Social engineering has been the tool of choice for attackers such as Kevin Mitnick, as published in the
The Art of Deception by Wiley. The resulting defense has been organizational security awareness training, such as that
provided by sans.org and http://www.securingthehuman.org/ .
Human Error Vs. Malfeasance
IOUG/ISACA survey findings rate internal “human user error” as being the greatest perceived risk to database
security. The following IOUG's risk-perception survey links for 2012 and 2013 rate the highest source of database risk
as coming from insider threat due to administrative error.
IOUG data security survey 2012:
http://www.oracle.com/us/products/database/ioug-data-security-survey-1872819.pdf
IOUG data security survey 2013:
http://www.isaca.org/Education/Online-Learning/Pages/Webinar-Database-Security-Leaders-v-Laggards-
2013-IOUG-Security-Survey.aspx
Adding more complex security controls that hide information through encryption and prevent administration
access will naturally increase user human error. Therefore, security has to evolve to meet that change by re-
emphasizing transparency and simplicity over secrecy. That means more built-in integrity verification and less added
encryption. Privileged access control systems have the benefit of protecting the DBA from themselves by blocking
incorrect commands. PAC systems are increasingly integrating with monitoring and change-management systems to
reduce non-malicious human error as well as malfeasance.
Data-breach Realities
However, it is interesting to compare the previous surveys of DBA perception against the actual causes of data-breach
as documented by the Verizon Data-breach report. Here we can read that only 2% of data breaches actually occur due
to human error:
http://www.verizonenterprise.com/DBIR/2013/
So there is a big gap between the perceptions of DBAs/managers and what is actually happening in the security
realm. Why this gap? We will look at that more closely in Part IV on Architectural Risk, but the basic gap is that
database security risk is a bit like nuclear power station risk in that there are fewer near-misses to keep staff on their
toes. DB breaches are less frequent, but if there is a DB breach it is likely to be terminal.
Data Vs Process
The majority of current threat models affecting databases focus on data access through hacking as being the primary
threat. Dataloss DB Open Security Foundation ( http://datalossdb.org/ ) records published data breaches,
showing that the effect of the original SB1386 California Databreach Law has been to make momentary data-breach
a well-known threat. However, a large class of very significant risks are not directly related to data-breach as such.
For instance, in a trading system the ability to read a copy of the data contained has a lower threat risk compared
to privileged access over time . A user who is able to affect the trading process over time can affect a much greater
negative effect than a user who has a slice of the data at any point in time. In financial institutions “process security”
can be more important than “data security.” In fact, it may be the case that maintaining open-read access to data may
be critical to maintaining security. It may be a security prerequisite to guarantee that verifiers are able to review a
 
Search WWH ::




Custom Search