Brief Overview of Database Security

Database Security refers to protecting the confidentiality, integrity, and availability of stored client data in a database. It is a collective effort of the network and security team to secure data from hackers. It is a combination of processes, tools, and methodologies to protect valuable data in a database environment. Currently, many tools are available in the market to find vulnerabilities, misconfiguration, and risks involved and give recommendations on how to mitigate issues.

Database security involves activities such as monitoring and security assessment constantly, restricting unauthorized access by implementing different roles, load testing to ensure it does not crash on distributed denial of service (DDoS) attacks, physical security of servers, etc.

According to technology vendor Application Security, Inc., the following are the top 10 threats related to databases:

1. Default or weak passwords
2. SQL injection
3. Excessive user and group privileges
4. Unnecessary DBMS features enabled
5. Broken configuration management
6. Buffer overflows
7. Privilege escalation
8. Denial of service
9. Un-patched RDBMS
10. Unencrypted data

To mitigate the above-mentioned threats, You can follow OWASP Database Security Cheatsheet for detailed guidelines.

Database Security Best Practices

1. The backend database used by software applications should be isolated.
2. Allow only encrypted network connections for databases.
3. Implement a strong authentication mechanism to access the database.
4. Database credentials are never stored in software application source code.
5. Access to databases should be based on the principle of least privilege. For critical applications, apply for permissions at levels table-level permissions, column-level permissions, and row-level permissions.
6. Database configuration and hardening should be implemented as per the CIS benchmark or Vendor-specific benchmark.

There are many tools available for database security. I am listing out some good tools available for database security.

1. Scuba Database Vulnerability Scanner: It scans databases for vulnerabilities and misconfigurations, recommends mitigation of identified issues
2. SQL Recon: Scanner used to identify MS SQL Server/ MSDE installations on the network.
3. OScanner: Oracle assessment framework developed in Java and plugin-based architecture available on Kali Linux.
4. DBDEFENCE: Used to encrypt database
5. Fortinet FortiDB: Database security tool provides discovery and vulnerability management, DB activity monitoring and auditing (different roles), etc.
6. IBM Guardium: This tool is used to discover, classify, analyze, protect, and control sensitive data access. It helps in performing vulnerability assessments and how to monitor data and file activity.
7. Vormetric Inc.: Developed by Thales
8. McAfee products (Database Activity Monitoring and Vulnerability Manager for Databases)
9. HP Security Voltage: Data security solution
10. Protegrity USA Inc.: Data Security Solution
11. Trustwave DbProtect: Software-based products help prevent database breaches with database activity monitoring (DAM) and vulnerability assessment.
12. Oracle Advanced Security is an option with Oracle Database Enterprise Edition.

Conclusion

This tutorial provides a high-level brief overview of database security. It covers what is database security, what are the possible threats, mitigation techniques, and tools used in database security.