Application Security - Implementing Database Security and Auditing - page 176

sion of database security is incomplete without addressing the unique issues
that exist in application access. More specifically, this chapter taught you
about some of the characteristics of applications, some of which can help
you in creating a secure database environment (such as the repeating and
deterministic nature of SQL calls generated by applications) and some of
which complicate your life (like application-level vulnerabilities over which
you have absolutely no control).
The most important thing to take away from this chapter is that even if
the problem is not part of the database layer, it is your responsibility to try
to secure the database from both untrusted as well as trusted sources, such
as the applications. I hope that you also now realize that numerous tools
exist to help you deal with this task and that in addition to the best prac-
tices that you should certainly employ, you should be using monitoring
solutions as well as systems that can help you better control access to your
databases, even from trusted sources.
One topic that was briefly mentioned in improving overall security is
alignment between the application security model and the database security
model. Such alignment helps you employ database access control to an
application user level, and this is the topic of the next chapter.