Network Security & Hardware - eWeek

Network Security & Hardware: Database Security Shortcomings Raise Red Flags


A recent survey of 316 members of the Independent Oracle Users Group paints a troubling picture of database security. As it turns out, respondents this year have taken a number of steps back when it comes to protecting sensitive data, even as a higher percentage reported experiencing data breaches. The key issues—failure to manage privileged access, a lack of encryption and an over-reliance on manual or ad hoc approaches to database security.

Overall, the level of security has slipped when compared with last years survey. Whether its due to not enough being spent on security or policy enforcement, the survey shows IT professionals have their work cut out for them.
 
  • Database Security Shortcomings Raise Red Flags
    by Brian Prince
  • Data Breaches Galore
    Roughly the same percentage of people in the 2009 survey declared a data breach was either "inevitable" or "somewhat likely" as they did a year ago. However, the report also found that 9 percent had experienced a data breach over the past year—a slight increase from 2008, when it was 6 percent.
  • Database Security Priorities
    The survey only found a slight change in database securitys rank next to other IT security priorities. But the drop-off here is also taking place in the context of a slowdown in security spending. Thirteen percent said their security budget decreased, as compared with 4 percent in 2008, and even though 28 percent reported a spike in their security spending, that compared with 41 percent last year.
  • Secure Configurations for the Database
    Some 25 percent said all their databases were securely configured, which was a drop-off of 3 percent from last year. While 40 percent said "most" of their databases were configured securely, it should also be noted that the percentage of people who said they were not sure where all their sensitive data is located jumped by 8 percent.
  • Securing Super Users
    Even as data breaches such as the one that occurred at LendingTree underscore the dangers of the insider threat, the survey shows that many organizations have not made much progress in safeguarding against abuses by privilege users.
  • Users Bypassing Applications and Accessing Application Data
    More than a third of users can access application data in the database using ad hoc tools.
  • Outsourcing and Security
    There has been a slight increase in outsourcing of database administration, most likely in response to the economy. However, the percentage of unencrypted databases being sent offsite crept up as well.
  • Encryption Not Being Deployed
    More than 40 percent said they do not encrypt their online and offline database backups and exports. About a third said they did some limited encryption of the data.
  • Native Database Auditing Used to Monitor Database Activity
    The figures here are roughly the same as in 2008. However, just 42 percent said they would be able to detect an unauthorized configuration change on most of their databases. That compares to 51 percent last year.
  • Monitoring Production Databases
    IOUG speculates that budget cuts and a lack of resources may account for the discrepancies between 2009 and 2008 found here.
xڽZ[s۸~~d_nw7ŗXbwIHB ,JVeSjy|8oi&4oAuB>K9lHbc.!KvfzC7o``ƛVYQ|v$UK*7-;RLDL1OwҨxLO^>.B࿎F:|=F#mX021q #yF.#An{R7Yh[((6j{A،LQLDruzH&$fvȿ+|>o~QLg\M<4#9 "L7'f*Ή{'_tt6g4Wln(3сױ1,?ۈnS3aܰ)M)vtZ4ܪwP臑WhNdm\)I;-<><:1)+Vʢ M&x9tKS:f:bLÃnF1>PC ';!{0#p\V5Ra5G\攪1O|؈{G{(a(;}eq+)P0nC-U̥zU\Ɋn'p` Ձ ^2R`-*T հq셜Þݙo&)?>d R_E!*aR= ׼>Iqv* .[1aCuTD,O4͌3Ky W&?׀c:sBrZ)ĺQĴdv-[9Ϛ 7s.9n ٝօrI/ ah~I%_zlgŎvjf]ffSO0[h>\ !I$STؖN ik'?aWyQq& XR?Ó,)uN~t@|@>c/1)rd|>s\MbSH;{$+}7icqD8 +9 (< ^0ZV {7VeLt"dY> "6#h9p\+ɻtqO@"f.[㑙CB0e_.Ն^ovﶍ#+𫄐Х$^Xr:= vA͘wsN%!JfI+knsqeQapS#Z7>g67c 3O#$vjڧDw% vӂֽWˆלWestOuO~)\9c.4ga-q a cp+)=jѤ:>*7p}SUA^8/VK@V ncFјfTT>g_Y#xO3+(XP.u1sgֽ]0? V|țjUxמo4g{l qEig`oiXI%k#׉x`+,B!S]OLmSgNVӪ2讞]BU:m-.U3g`GG*ar;LmTkqء9j[Xo2cQ JvV_ܔ&˼C]`I`z#p7PD'RMApuPy#y&յy8$Pc.kEb oDz j*cnW~#Z3H䈘 M؞(.D-bt7")th8ɗn &5 ;όF)xp98R.'2]([yw~ޑZuU )RX^c݆̪f;OY*@Λ5`(3<>яv&NXyB)@ SPpxdMADfTaz8ak`9 &*nZS4,PB qٓu"fˆI^KerDdT!Ǫl or AmkB Cs.)(iͩu ?YdbPds[6d$ͺ4X9X؅$ wwv3]»C.0x` acmA4sǑg,Rm.!?^>qL玩&G \01cX{}=+rx>qekZFEbp\|rvP~|x{/: L"s}{zap'xtOO{Wp QXa,m7:~y3Ne`)7}x/\t| Zh3Ow?7mXΊF+c+Ѩ~=ŴYI2UeTF,7vZFSƼ ܟ.^: w%16:tq@N㭲P ƫzD>,