Database Security and Auditing: Protecting Data Integrity and Accessibility PDF

Database Security and Auditing: Protecting Data Integrity and Accessibility Chapter 2 Operating System Security Fundamentals  Objectives Explain the functions of an operating system Describe the operating system security environment from a database perspe...

Database Security and Auditing: Protecting Data Integrity and Accessibility Chapter 2 Operating System Security Fundamentals  Objectives Explain the functions of an operating system Describe the operating system security environment from a database perspective List the components of an operating system security environment Explain the differences between authentication methods 2  Objectives (continued) Outline useful user administration best practices List the criteria of strong password policies Describe operating system vulnerabilities Describe security risks posed by e-mail services 3  Operating System Overview Operating system: a collection of programs that allows user to operate computer hardware Three layers: – Inner layer – Middle layer – Outer layer 4 Operating System Overview (continued) 5  Operating System Overview (continued) Key functions of an operating system: – Multitasking, multi sharing – Computer resource management – Controls the flow of activities – Provides a user interface Database Security and Auditing 6  Operating System Overview (continued) Key functions of an operating system (continued): – Administers user actions and accounts – Runs software utilities and programs – Enforce security measures – Schedules jobs Database Security and Auditing 7  The Operating System Security Environment A compromised OS can compromise a database environment Physically protect the computer running the OS (padlocks, chain locks, guards, cameras) Model: – Bank building (operating system) – Safe (database) – Money (data) 8 The Operating System Security Environment (continued) 9  The Components of an Operating System Security Environment Used as access points to the database Three components: – Memory – Services – Files 10 The Components of an Operating System Security Environment (continued) 11  Services Main component of operating system security environment Include – User authentication – Remote access – Administration tasks – Password policies Database Security and Auditing 12  Files Common threats: – File permission – File sharing Files must be protected from unauthorized reading and writing actions Data resides in files; protecting files protects data Database Security and Auditing 13  File Permissions Read, write, and execute privileges In Windows 2000: – Change permission on the Security tab on a file’s Properties dialog box – Allow indicates grant – Deny indicates revoke Database Security and Auditing 14 File Permissions (continued) 15  File Permissions (continued) In UNIX – Three permission settings: owner; group to which owner belongs; all other users – Each setting consist of rwx r for reading, w for writing, and x for executing – CHMOD command used to change file permissions 16  File Permissions (continued) Database Security and Auditing 17  File Transfer FTP (File Transfer Protocol): – Internet service for transferring files from one computer to another – Transmits usernames and passwords in plaintext – Anonymous FTP: ability to log on to the FTP server without being authenticated Database Security and Auditing 18  File Transfer (continued) Best practices: – Use Secure FTP utility if possible – Make two FTP directories: One for uploads with write permissions only One for downloads with read permissions only – Use specific accounts with limited permissions – Log and scan FTP activities – Allow only authorized operators 19  Sharing Files Naturally leads to security risks and threats Peer-to-peer programs: allow users to share files over the Internet Reasons for blocking file sharing: – Malicious code – Spyware – Privacy and confidentiality – Pornography – Copyright issues 20  Memory Hardware memory available on the system Can be corrupted by badly written software Two options: – Stop using the program – Apply a patch (service pack) to fix it Can harm data integrity 21  Authentication Definition: the process of actually confirming identity ********** Imagine the most secure password which could never be cracked. Is proper password creation enough to protect organizational data?  Any problems with the following? CREATE TABLE `users` ( `username` varchar(25), `password` varchar(128), CONSTRAINT `user_pk` PRIMARY KEY (`username`) ); INSERT INTO `users` VALUES ('ormond', 'database'); 23  Operating System Authentication Many databases (including Microsoft SQL Server 2000) depend on OS to authenticate users Reasons: – Once an intruder is inside the OS, it is easier to access the database – Centralize administration of users Users must be authenticated at each level 24 Operating System Authentication (continued) 25  Authentication Methods Authentication: – Verifies user identity – Permits access to the operating system Physical authentication: – Allows physical entrance to company property – Magnetic cards and biometric measures Digital authentication: verifies user identity by digital means Database Security and Auditing 26  Authentication Methods (continued) Digital certificates: a digital passport that identifies and verifies the holder of the certificate Digital token (security token): – Small electronic device – Displays a number unique to the token holder; used with the holder’s PIN as a password – Uses a different password each time https://www.youtube.com/watch?v=iVeenkfa-0s 27  Authentication Methods (continued) Digital card: – Also known as a security card or smart card – Similar to a credit card; uses an electronic circuit instead of a magnetic strip – Stores user identification information Database Security and Auditing 28  Authentication Methods (continued) Kerberos: – Developed by MIT – Uses tickets for authentication purposes https://www.youtube.com/watch?v=1yWW7VQUX0A 29  Authentication Methods (continued) Lightweight Directory Access Protocol (LDAP): – Developed by the University of Michigan – A centralized directory database stores: Users (user-name and user ID) Passwords Internal telephone directory Security keys – Efficient for reading but not suited for frequently changing information Database Security and Auditing 30  Authorization Process that decides whether users are permitted to perform the functions they request Authorization is not performed until the user is authenticated Deals with privileges and rights Database Security and Auditing 31  User Administration Create user accounts Set password policies Grant privileges to users Best practices: – Use a consistent naming convention – Always provide a password to an account and force the user to change it at the first logon – Protect passwords – Do not use default passwords Database Security and Auditing 32  User Administration (continued) Best practices (continued): – Create a specific file system for users – Educate users on how to select a password – Lock non-used accounts – Grant privileges on a per-host basis – Do not grant privileges to all machines – Use Secure FTP – Isolate a system after a compromise – Perform random auditing procedures Database Security and Auditing 33  Password Policies First line of defense Dictionary attack: permutation of words in the dictionary Make it hard for hackers to enter your systems Best password policy: – Matches your company missions – Enforced at all levels of the organization Database Security and Auditing 34  Password Policies (continued) Best practices: – Password aging – Password reuse – Password history – Password encryption Database Security and Auditing 35  Password Policies (continued) Best practices (continued): – Password storage and protection – Password complexity – Logon retries – Single sign-on Database Security and Auditing 36  Vulnerabilities of Operating Systems Top vulnerabilities to Windows systems: – Internet Information Services (IIS) – Microsoft SQL Server (MSSQL) – Windows Authentication – Internet Explorer (IE) – Windows Remote Access Services Database Security and Auditing 37  Vulnerabilities of Operating Systems (continued) Top vulnerabilities to Windows (continued): – Microsoft Data Access Components (MDAC) – Windows Scripting Host (WSH) – Microsoft Outlook and Outlook Express – Windows Peer-to-Peer File Sharing (P2P) – Simple Network Management Protocol (SNMP) Database Security and Auditing 38  E-mail Security Tool must widely used by public May be the tool must frequently used by hackers: – Viruses – Worms – Spam – Others Used to send private and confidential data as well as offensive material 39  E-mail Security (continued) Used by employees to communicate with: – Clients – Colleagues – Friends Recommendations: – Do not configure e-mail server on the same machine were sensitive data resides – Do not disclose technical details about the e-mail server Database Security and Auditing 40  Summary Operating system: – Collection of programs that allows programs and users to interact with the computer resources – Main access point to the DBMS Authentication: – Validates the identity of the user – Physical authentication – Digital authentication Database Security and Auditing 41  Summary (continued) Authorization: – Determines whether the user is permitted to perform the function he or she requests – Is not performed until the user is authenticated – Deals with privileges and rights that have been granted to the user Database Security and Auditing 42  Summary (continued) Password policy: – First line of defense – Must match your company missions – Must be enforced at all levels of the organization Security problems with files: – File permissions – File transfer and sharing E-mail security Database Security and Auditing 43