CHAPTER 6: DATABASE SECURITY

CHAPTER 6: DATABASE SECURITY

1. 1. THE NEED FOR DATABASE SECURITY

2. 2. DATABASE MGT SYSTEMS

   • Structured collection of data stored for use by one @ more apps.
   • Query language - provides a uniform interface to the database
   • DBMS - Suite of programs for constructing & maintaining the database

3. 3. DATABASE RELATIONAL DATABASES

   • Elements of relational database system
     • Primary key : Uniquely identifies a row
     • Foreign key : Links one table to attributes in another
     • View/virtual table : Result of a query that returns selected rows & columns from 1 @ more tables
   • Structured Query Language (SQL)
     • Standardized language to define schema, manipulate, & query data in a RD
     • Follow the same basic syntax & semantics
   • A collection of tables (relations). Individual values in a table can be used to link one table to another

4. 4. SQL INJECTION ATTACKS

   • SQLi countermeasures
     • Defensive Coding : Parameterized query insertion
     • Detection : Signature based
     • Run-time Prevention : Check queries at runtime to see if they conform to a model of expected queries
   • SQLi attack avenues and types
     • Attack Avenues
       • User input
       • Server variables
       • Second-order injection
       • Cookies
       • Physical user input
     • Attack Types
       • Inband Attacks
         • Tautology
         • End-of-line comment
         • Piggybacked queries
       • Inferential Attack
         • Illegal/logically incorrect queries
         • Blind SQL injection (True @ False)
       • Out-of-Band Attack
   • The injection technique
     • Typically works by prematurely terminating a text string & appending a new command
     • Subsequent text is ignored at execution time
   • A typical SQLi attack
     • Bulk extraction of data
     • Sends malicious SQL commands to the database server
     • Designed to exploit the nature of Web apps. pages

5. 5. INFERENCE

   • Inference Detection
     • 2 approaches :
       • Inference detection during database design
       • Inference detection of query time

6. 6. DATABASE ACCESS CONTROL

   • SQL-based access definition
   • Cascading authorizations
   • Role-based access control (RBAC) : eases admin. burden & improves security
     • Needs to provide the following capabilities
       • Create & delete roles
       • Define permissions for a role
       • Assign & cancel assgnmnt of users to roles
   • 2 commands for managing access rights : grant & revoke
   • 5 typical access rights :
     • Select
     • Insert
     • Update
     • Delete
     • References

7. 7. DATABASE ENCRYPTION

   • Protected by multiple layers of security
   • Can be applied to the entire database, at the record level, the attribute level @ level of the individual field
   • Disadvantages to encryption : key mgt : inflexibility