Database Security Best Practices and Common Vulnerabilities
This content delves into database security, focusing on best practices, common vulnerabilities from 2010 and 2018, and solutions for safeguarding against threats. Learn about broad user privileges, SQL injections, audit management, backup storage, and more to enhance your database security measures.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Database Security for Developers Ilya Verbitskiy WebStoating s.r.o.
About me 15 years of experience in finance and e-commerce field Co-founder of WebStoating s.r.o. Solutions architecture, system integration and e-Commerce
The cost of bug fixing 160 140 120 100 80 60 40 20 0 Requirements Design Code Test Production We are hacked!
Common Vulnerabilities (2010) Default, blank, and weak username/password SQL injections Extensive user and group privileges Unnecessarily enabled database features Broken configuration management Buffer overflows Privilege escalation Denial-of-service attack Unpatched databases Unencrypted sensitive data at rest and in motion
Common Vulnerabilities (2018) Broad user's privileges SQL injections Missing audit Insecure backup storage RDMS vulnerabilities and configuration issues Insecure data processing Weak passwords Denial-of-Service attacks
Broad user's privileges Principle of least privilege Grant limited permissions to monitoring users Start with read only access Log database errors within your app Grant CRUD permissions once needed Grant permissions explicitly in your SQL scripts pgTAP PostgreSQL unit-testing framework Static code analyzers for ORM (Roslyn, typescript-parser, Esprima, Acorn, etc.) Row level security sepgsql Label-based mandatory access control based on SELinux
SQL injections Injections in client code Injections in dynamic SQL statement inside stored procedures Injections in a connection string Injections in ORM queries Tools: sqlmap
Missing audit PostgreSQL error reporting and logging Windows Event Log pgAudit READ, WRITE, FUNCTION, ROLE, DDL, MISC pgAudit Analyze
Insecure backup storage Backup and recovery procedures are periodically tested. Backup retention intervals are documented and sufficient to meet the business needs. Make sure that backups are encrypted and decryption keys are not stored together with backups. Make sure you remove sensitive data from development and staging databases.
Insecure backup storage pg_dump DATABASE DATABASE | bzip2 | openssl smime -encrypt -aes256 binary \ -outform DEM -out DATABASE.sql.bz2.enc DATABASE.sql.bz2.enc "PUBLIC_KEY.pem.pub" "PUBLIC_KEY.pem.pub" openssl smime -decrypt -in DATABASE.sql.bz2.enc -inkey PRIVATE_KEY.pem PRIVATE_KEY.pem | bzcat > DATABASE.sql DATABASE.sql.bz2.enc -binary -inform DEM \ DATABASE.sql
Vulnerabilities and configuration issues Apply all new security patches as soon as possible and not later than a month Firewall pg_hba.conf Disable all trust connections Use strong authentication (scram-sha-256 (PostgreSQL 10), gss, ldap, radius, cert) Limit connections only from allowed IP Use SSL connection Anti-virus
Insecure data processing Password encryption SCRAM or MD5 Client encrypts password before it is being sent across the network Encryption for specific columns pgcrypto Data partition encryption eCryptfs, EncFS (Linux), EFS (Windows), etc.
Insecure data processing Encrypting data across a network pg_hba.conf: host, hostssl Certificate authentication Client-side encryption No indexing No searches No calculations
Weak passwords ALTER ROLE VALID UNTIL timestamp ; passwordcheck CrackLib integration Need to update Makefile and recompile Kerberos, LDAP, RADIUS, PAM auth_delay Tools: Metasploit MDCrack
Denial-of-Service attacks Install the latest patches Firewall Anti-DDoS solutions
Summary Install all security updates Principle of least privilege Firewall and pg_hba.conf Implement password policy SQL injections are not just about SQL pgAudit Encrypt backups, test backup and recovery procedures Encrypt your data
Thank you! https://verbitskiy.co/ Twitter: @ilich_x86 GitHub: https://github.com/ilich
