data security challenges and its solutions in cloud …...2016/11/05 · hardening instances •...
Post on 11-Apr-2020
0 Views
Preview:
TRANSCRIPT
Data Security Challenges and Its Solutions in Cloud EnvironmentThreats, Security Responsibilities, Compliances, Solutions
WAREVALLEYhttp://www.warevalley.com
www.warevalley.com
1. Excessive and Unused Privileges
2. Privileges Abuse
3. Input Injection (Formerly SQL Injection)
4. Malware
5. Weak Audit Trail
6. Storage Media Exposure
7. Exploitation of Vulnerable, Misconfigured Databases
8. Unmanaged Sensitive Data
9. Denial of Service
10. Limited Security Expertise and Education
Top Ten Database Security Threat
Source : 2014 Verizon Data Breach Report
Traditional databases, Big Data / On-Premise or Cloud
www.warevalley.com
1. Default, Blank & Weak Username/Password
2. SQL Injections in the DBMS
3. Excessive User & Group Privilege
4. Unnecessary Enabled Database Features
5. Broken Configuration Management
6. Buffer Overflows
7. Privilege Escalation
8. Denial of Service Attack DoS
9. Unpatched Databases
10. Unencrypted Sensitive data – at rest and in motion
Top Ten Database Vulnerabilities and Misconfigurations
Source : Team SHATTER
www.warevalley.com
Database Security on Cloud
1. What data are you moving ?• Sensitive Data Discovery• IT Compliances after you move data to cloud• Security Hole in data migration
2. Who is accessing the database?• Administrators, Developers and Applications• DAP, Masking, Encryption, Approval Process
3. To where are you moving the data? • Physical and Network Security infrastructures• Who has administration access to the database ?• Different geographic locations = Different regulations, laws and standards
Source : Security Week
www.warevalley.com
Responsibility Challenge on Cloud
1. Protecting the data as it moves to the cloud• Data-in-motion encryption : SSL or VPN
2. Hardening instances• With IaaS, the customer is responsible for securing the operating
system. This includes hardening processes, patches, security software installation and following the database vendor’s security guidelines.
3. Protect management console access• Role-based access to dashboard• Data recovery plan to an external location
4. Prepare plan for availability, backups, DR and Business Continuity• Using IaaS provider’s tools for backup and DR• Customer is responsible for deploying others
Source : Security Week
www.warevalley.com
Shared Responsibility Model for Abstracted Services
CustomerResponsible forSecurity ‘IN’ the Cloud
AWSResponsible forSecurity ‘OF’ the Cloud
www.warevalley.com
Shared Responsibility Model – Microsoft Azure
www.warevalley.com
Shared Responsibility Model by Service Type
www.warevalley.com
Compliance Challenge on Cloud
1. Understanding where the data• Regulated data should be mapped to exact locations.
2. Separation of duties• Between production and test environment data• Between non-regulated and regulated applications• Between the different roles involved with handling the data
3. Identity Management
4. Access controls should be in place• All sensitive data should be governed, monitored and approved.
Source : Security Week
www.warevalley.com
Compliance Challenge on Cloud
5. Encryption and encryption alternatives• Data encryption, tokenization, data masking
6. Detecting, Preventing and mitigating attacks• Detect and prevent attacks on the database (e.g., SQL injection attacks)• Adequate controls and audit infrastructure
7. Operational Security• Govern asset management, • Change management, production access, • Periodic vulnerability scanning, • Adequate remediation procedures, • User access audit, management operation• Event response procedures
Source : Security Week
www.warevalley.com
Considering database security on cloud
Database Access Management Database Firewall Sensitive Data Discovery Database Encryption Dynamic Data Masking Database Authentication SQL Injection Attacks Database Compliance Reports
www.warevalley.com
Amazon RDS Security Features
• Run your DB instance in an Amazon Virtual Private Cloud (VPC) – Network Access Control
• Use AWS Identity and Access Management (IAM) - assign permissions that determine who is allowed to manage RDS resources
• Use security groups - control what IP addresses or EC2 instances can connect to your databases on a DB instance
• Use Secure Socket Layer (SSL) connections with DB instances
• Use RDS encryption - AES-256 encryption algorithm to encrypt your data
• Use network encryption and transparent data encryption with Oracle DB instances
• Use the security features of your DB engine
Source : AWS
www.warevalley.com
Azure Database Security Features
• Firewall - IP addresses, can access a logical Azure SQL Server or a specific database
• Secure Connection - Secure communication from clients based on the TDS protocol over TLS (Transport Layer Security)
• Auditing - auditing events include insert, update, and delete events on tables /Audit logs in Azure table storage and build reports on top of them
• Data masking - SQL users excluded from masking, Masking rules & functions
• Row-level Security - Aimed at multi-tenant applications that share data in a single table within the same database.
Source : blogs.msdn.microsoft.com
www.warevalley.com
DCAP Capabilities offered by Vendors
Source : Gartner (Nov. 2014)
Data-Centric Audit and Protection
www.warevalley.com
Chakra MAX V2 • Database(System) Audit and Protection• Database(System) Activity Monitoring• Database(System) Work Approval Process• Dynamic Data Masking• Sensitive Data Discovery• Compliance Reports
SystemsWindows
HP-UXAIX
SolarisLinux
Mainframe
DatabasesOracle / Time-Stan /Exadata
Microsoft SQL ServerIBM DB2 (Mainframe, UDB)
SAP Sybase IQ/ASESAP HANA
Mysql / MariaDBIBM Netezza
TeraDataPostgreSQL / Greenplum
Altibase / Tibero / Cubrid / Kairos / SunDBAmazon RedShift / Aurora
Dameng DM7Fujitsu Symfoware
PetaSQL
Chakra MAX(Database Audit and Protection) on Cloud
www.warevalley.com
Chakra MAX(Database Audit and Protection) on Cloud
DB service
STAP
Chakra MAX for AWS RDS(DB as a service)• Sniffing is Impossible - Port Mirror (X), TAP(X), STAP(X)• Gateway(Proxy Sever) is OK
Chakra MAX for EC2 (Infrastructure as a service)• Sniffing is Possible – STAP• Gateway(Proxy Server) is OK
DB service
STAP
RDS
EC2
Gateway Only
Gateway + Sniffing
www.warevalley.com
Chakra MAX(Database Audit and Protection) on Cloud
Client A
AWS
Client B
WAS (EC2)
DB (RDS)
Chakra Max SAGENT
Chakra Max (EC2)
SAGENT analyze end user’s informationand notify it to Chakra MAX
Client A
Client B
WEB Users
Internet
DB Users
①
①
①
②
Internet
②DB users connect to DB through Chakra MAX server as gateway(Proxy) mode.
Blocking backdoor connection
User Access Control
DNS
Mapping DNS to real IP Address
Sniffing Mode (Database Activity Monitoring)Gateway Mode (Database Audit and Protection)
www.warevalley.com
Systems DatabasesWeb
Cyclone V3• Auto Service Discovery• Sensitive Data Discovery in System/DB• Database Audit / Change Management• DB Vulnerability Assessment• Compliance Reports
Cyclone(Database Security Assessment) on Cloud
www.warevalley.com
Cyclone(Database Security Assessment) on Cloud
Sensitive Data, Security Holes, Vulnerabilities on your Database !
www.warevalley.com
Plugin
Authorized User (Plain Text)
Unauthorized User (Cipher Text or Masked)
Sensitive Data (Columns)has been Encrypted
End User (Plain Text)
Galea(Database Encryption-Column Level) on Cloud
API
Authorized Applications
www.warevalley.com
Galea(Database Encryption-Column Level) on Cloud
Column-Level Encryption Plan(Algorithm, Keys ..)
Authorization Policies to Decrypt(Client IP, DB User, Application, Time & Date)
Return Masked DataReturn Encrypted Data
Return Decrypted Data
Unauthorized Users
Authorized Users
No need to modify customer’s application !
www.warevalley.com
WAREVALLEY : Database Security and Management
DB Encryption (Plugin) DB Encryption (API)
DB (System) Audit and ProtectionDynamic Data Masking
Work Flow Process
DB Administration, Performance MonitoringData Quality Assessment
Sensitive Data DiscoveryDB Security Assessment
DB Vulnerability Assessment
Big Data AnalysisDatawarehouse
top related