Encryption - Implementing Database Security and Auditing - page 300

an example, MySQL communications are typically 35% slower when using
SSL connections. In any case, before looking into the various options for
encrypting your database communications, let's understand a bit more
about what happens when you use unencrypted streams.

10.1.1 Anatomy of the vulnerability: Sniffing data

If a hacker is to eavesdrop and steal data, two things must occur: (1) the
hacker must be able to physically tap into the communications between the
database clients and the database server and (2) the hacker must be able to
understand the communication stream at a level that allows extracting the
sensitive data. Of the two, getting the physical tap is certainly the harder
task, especially in well-designed switched networks.
In order to tap into the TCP/IP communication stream, a hacker must
run his or her tools on a machine that is able to see the packets transmitted
from the client to the server and back. One option is to run these tools on
the client machine, and another is to run the tools on the database server—
both of these machines obviously see the entire communication stream. As
an example, if your application uses an application server architecture and if
a hacker can compromise the application server or the host on which the
application server is installed, then the hacker can secretly install some form
of network sniffer to tap into all database communications between that
application server and the database.
However, there are additional places on the network that are just as use-
ful—nodes that you may not even know about. For example, most net-
works today are Ethernet networks, and Ethernet by definition uses a
broadcast protocol. This means that if the hacker's machine is connected on
the same Ethernet segment of the database or of the client machine, then
the hacker will be able to see all communications between the client and the
server. If you are on a switched network, another way to eavesdrop is
through the SPAN ports on a switch. Finally, if a hacker can gain access to
the physical location in which some of this communications equipment
resides, he or she can always put in a network TAP. A detailed explanation
of all of these options is provided in Appendix 10.A.
Now let's move on to the second thing a hacker needs to do—understand
the communications. As you may recall from Chapter 3,

SQL travels from
database clients to database servers, and result sets (among other things)
travel from the server to the client. This data is packaged with the database's
protocol stack (e.g., Net9 over TNS for Oracle 9i). Each of the other data-
base products has its equivalent protocol stack, and in all cases, when the