If data are the crown jewels of enterprises, then the database should be as close to Fort Knox as possible without sacrificing things like performance.
Saying that out loud is the easy part. The rest is where Tanya Baccam’s presentation at the Oracle OpenWorld 2008 conference in San Francisco comes in.
Baccam, a certified instructor for the SANS Institute, laid bare Sunday some of the more common database vulnerabilities exploited by hackers and some answers to the problems they pose. Leaving aside the plethora of database security products out there for a moment, here are a few basic tips culled from the presentation to help deal with issues such as SQL injection attacks.
For starters, limit the amount of information given out by applications in error messages. Even the act of having different error messages if, for example, someone enters an incorrect user name versus entering a wrong password can give hackers unnecessary clues.
Web applications accessing databases create their own set of potential security issues. SQL injection remains one of the favorite activities of hackers and can mean trouble for corporations looking to keep their data safe. To mitigate that, organizations should validate input from users and use an index value or reference map to protect against direct object reference attacks, Baccam suggested.
She also urged organizations to use stored procedures rather than dynamic SQL.
“You do not want to use dynamic schema,” she explained after her talk. “You want to parameterize the stored procedures. So you specify, -Here’s the parameter, here’s the SQL statement.'”
Another tip: Pay attention to database configuration. Limiting access privileges can minimize the damage hackers can do in the event of a SQL injection attack.
Baccam also addressed Web vulnerabilities such as cross-site scripting and cross-site request forgery that can result in data theft. Mitigating cross-site request forgery can be difficult, she said during the presentation, since it may require rebuilding the vulnerable Web application. Two solutions she said are CAPTCHAs and the use of anti-cross-site request forgery tokens.
Protecting session identifiers is also vital for securing Web surfers, Baccam said.
“The big thing [is to] make sure you have long, random session identifiers, because that will take away the brute-force possibility and the prediction possibility,” she said.