Hardening Database Server

Presentation on database security, type of database attacks, and two use cases on how to hardening database server using Oracle and MySQL

1. Hardening the Defense
of Database Server
Database Security

2. Presentation Outline
The Importance of Database Security1
Finding Database Server Holes2
Type of Database Attacks3
Oracle Study
Case
4
MySQL Study Case5

3. Importance of Database Security
Databases often store sensitive data
Incorrect data or loss of data could
negatively affect business operations
Databases can be used as bases to attack
other systems from

4. Principles of Finding Holes
Don't believe the documentation
Implement your own client
Debug the system to understand how it works
Identify communication protocols
Understand arbitrary code
execution bugs
Write your own "fuzzers"

5. Top Six Database Attack* [1]
Brute-force (or not) cracking of weak or default
usernames/passwords
Privilege escalation
Exploiting unused and unnecessary database
services and functionality
Targeting unpatched database vulnerabilities
SQL injection
Stolen backup (unencrypted) tapes
* based on : http://www.darkreading.com/security/encryption/211201064/index.html

6. Top Six Database Attacks [2]
Cracking username/password
Not to change default password is disaster
It is also better to change password periodically
Privilege Escalation
Give right person right privilege
Avoid giving low-level user all database (even read only
access)
Exploiting unnecessary service
Attacker always find open listener feature
Only install features we need

7. Top Six Database Attacks [3]
Unpatched database vulnerabilities
Many companies reluctant to patch their database
because of availability
Database bugs many times posted in hacker website
Not to install small patch can lead big disaster
Stolen backup (unencrypted) tapes
Type of insider or accidental attack
Encrypt the backup to prevent attack

8. Top Six Database Attacks [4]
SQL Injection
Old but still widely used attacks
Usually exploit web application weakness
Result of poor practice application development
Use statement binding to filter user input

9. Case Study

10. Security Checklists [1]
Oracle TNS Listener
Set a TNS Listener Password (encrypted) to prevent
unauthorized administration of the Listener
Turn on Admin Restrictions to ensure certain commands
cannot be called remotely
Turn on TCP Valid Node Checking allow certain hosts to
connect to the database server and prevent others
Turn off XML Database if it is not used
Turn off External Procedures if not required
Encrypt Network Traffic using the Oracle
Net Manager tool

11. Security Checklists [2]
Accounts
Lock and Expire Unused Accounts
Define a user account naming standard
Define and Enforce a Good Password Policy
Roles
Be careful to make new role and give meaningful name
All user accounts should be assigned to specific role with
minimal privileges
Revoke any unnecessary permissions

12. Security Checklists [3]
DBA Role
Enable data protection to prevent users access sensitive
tables
User secure PL/SQL coding standard, to ensure
developers make secure PL/SQL programs
Perform security audits regularly
Before installing database, use checklist of what is
needed and what is not
Install patching as soon as possible

13. Case Study

14. Security Checklists [1]
Background
Since MySQL is open source, find many resources in the
Internet to find bugs and patches
Stay tune to MySQL security issue and MySQL update
Routine Audit
Check logs to search common SQL injection
Audit the users and check the granted privileges
Check the hashing user password to double check password
patterns

15. Security Checklists [2]
MySQL Users
Use strong password
Rename the root MySQL user to something obscure
Restrict MySQL users by IP address and passwords
Never give anyone access to the mysql.user table
MySQL Configuration
Enable logging via the --log option
Disallow the use of symbolic links
Remove the default test database
Ensure MySQL traffic is encrypted

16. Security Checklists [3]
Operating System
Turn off unnecessary services or daemons
Ensure MySQL data files cannot be read by users other than
the root or Administrator account
Use a low-privileged MySQL account to run the
MySQL daemon
Ensure MySQL users cannot access files
outside of a limited set of directories