- of
Database Security Shortcomings Raise Red Flags
by Brian Prince
Data Breaches Galore
Roughly the same percentage of people in the 2009 survey declared a data breach was either "inevitable" or "somewhat likely" as they did a year ago. However, the report also found that 9 percent had experienced a data breach over the past year—a slight increase from 2008, when it was 6 percent.
Database Security Priorities
The survey only found a slight change in database security’s rank next to other IT security priorities. But the drop-off here is also taking place in the context of a slowdown in security spending. Thirteen percent said their security budget decreased, as compared with 4 percent in 2008, and even though 28 percent reported a spike in their security spending, that compared with 41 percent last year.
Secure Configurations for the Database
Some 25 percent said all their databases were securely configured, which was a drop-off of 3 percent from last year. While 40 percent said "most" of their databases were configured securely, it should also be noted that the percentage of people who said they were not sure where all their sensitive data is located jumped by 8 percent.
Securing Super Users
Even as data breaches such as the one that occurred at LendingTree underscore the dangers of the insider threat, the survey shows that many organizations have not made much progress in safeguarding against abuses by privilege users.
Users Bypassing Applications and Accessing Application Data
More than a third of users can access application data in the database using ad hoc tools.
Outsourcing and Security
There has been a slight increase in outsourcing of database administration, most likely in response to the economy. However, the percentage of unencrypted databases being sent offsite crept up as well.
Encryption Not Being Deployed
More than 40 percent said they do not encrypt their online and offline database backups and exports. About a third said they did some limited encryption of the data.
Native Database Auditing Used to Monitor Database Activity
The figures here are roughly the same as in 2008. However, just 42 percent said they would be able to detect an unauthorized configuration change on most of their databases. That compares to 51 percent last year.
Monitoring Production Databases
IOUG speculates that budget cuts and a lack of resources may account for the discrepancies between 2009 and 2008 found here.
IT Security & Network Security News & Reviews News & Reviews 
Cloud Data Backup Now Makes Sense for SMBs: 10 Reasons Why 
HP, Lenovo, Asus Laptops, Desktops Offer Consumer Style for Busin[..]
Microsoft`s F#: 10 Reasons Why It`s a Hot Programming Language fo[..]
Data Center Efficiency: 10 Tips to Boost Productivity, Reduce Pow[..]
iPhone Apps to Kick Off the 2012 Summer Season 
Email Security: 10 Steps for Dealing With Dangerous Messages
See All Slideshows
A recent survey of 316 members of the Independent Oracle Users Group paints a troubling picture of database security. As it turns out, respondents this year have taken a number of steps back when it comes to protecting sensitive data, even as a higher percentage reported experiencing data breaches. The key issues—failure to manage privileged access, a lack of encryption and an over-reliance on manual or ad hoc approaches to database security.
Overall, the level of security has slipped when compared with last year’s survey. Whether it’s due to not enough being spent on security or policy enforcement, the survey shows IT professionals have their work cut out for them.