How to Safeguard Databases Against Malicious Attacks

Strategy No. 5: Encrypt, but not as a panacea

Encryption is often the first thing that comes to mind when thinking of securing data and is certainly recommended for sensitive data. However, it can be both expensive and difficult to use, and it is certainly difficult to manage in a way that is secure. Encrypt only sensitive data that requires it. Be careful how you manage the encryption/decryption keys and change them on a regular basis. It is also important to combine encryption with other means and procedures such as activity monitoring, auditing, periodic vulnerability assessments and user authentication.

Strategy No. 6: Development, testing and staging environments

Many organizations invest efforts in securing their production databases, but neglect to do so in development, testing and staging environments. As the staging environment code is often copied into production when it is ready, it should obviously be as secure as the production version. Beyond that, it is often the case that real production data is used in non-production environments without any masking. This poses a serious security risk. It is recommended to treat non-production environments with the same tools and procedures one applies to the production environment.

Strategy No. 7: Apply patches

Much has been said and written about how DBMS vendors cope with vulnerabilities and how quickly they should patch them. The reality over the past few years shows that the number of reported vulnerabilities is rising. And, while vendors are doubling their efforts to patch them, so are the security researchers and hackers.

Additionally, it usually takes the vendor several months or more to distribute a patch. It then takes an additional several months for customers to install the patches, which usually require testing and database downtime. Many customers do not apply the patches at all, and their databases remain vulnerable to severe attacks. Be sure to apply patches as soon as they are made available.

Slavik Markovich is CTO and a co-founder of Sentrigo, bringing with him over 13 years of experience in infrastructure, security and software development. Previously, Slavik was vice president of R&D and chief architect at db@net Ltd., an IT architecture consultancy, and led projects for clients such as Orange, Comverse, Actimize and Oracle. In addition, Slavik has held positions at several IT consulting companies.

Slavik, a renowned authority on Oracle and JAVA/JavaEE technologies, has contributed to open-source projects such as Spring Framework Toplink integration (later incorporated by Oracle), and is a regular speaker at industry conferences. He can be reached at slavik@sentrigo.com.