Database Security Managing Users and Security Models.
-
Upload
amy-chapman -
Category
Documents
-
view
246 -
download
4
Transcript of Database Security Managing Users and Security Models.
Database Security Managing Users and
Security Models
Managing Users
• Authorization & Authentication
• Creating Users
• Check for Default Users
• Check for weak passwords
• Lock & Remove Accounts
Operating System Authentication
• Many databases (including Microsoft SQL Server 2000) depend on OS to authenticate users
• Reasons:– Once an intruder is inside the OS, it is easier to
access the database– Centralize administration of users
• Users must be authenticated at each level– (defense in depth)
Creating Users
• Must be a standardized, well-documented, and securely managed process
• In Oracle10g, use the CREATE USER statement:– Part of the a Data Definition Language (DDL)
Creating an Oracle10g User• IDENTIFIED clause
– Tells Oracle how to authenticate a user account– BY PASSWORD option: encrypts and stores an
assigned password in the database– EXTERNALLY option: user is authenticated by the OS– GLOBALLY AS option: depends on authentication
through centralized user management method
Example: CREATE USER smith identified by s9 default tablespace users;
ALTER USER smith IDENTIFIED EXTERNALLY; -- by OS
ALTER USER scott ACCOUNT LOCK -- lock a user account
ALTER USER scott ACCOUNT UNLOCK;
ALTER USER scott PASSWORD EXPIRE; -- Force new pwd
• DEFAULT TABLESPACE clause: specifies default storage for the user
• TEMPORARY TABLESPACE clause
• QUOTA clause: tells Oracle 10g how much storage space a user is allowed for a specified tablespace
• PROFILE clause: indicates the profile used for limiting database resources and enforcing password policies
Creating Users (continued)
Creating Users (continued)
Creating Users (continued)
Creating a SQL Server User
• Create a login ID first; controls access to SQL Server system
• Associate login ID with a database user• Must be member of fixed server roles (SYSADMIN
or SECURITYADMIN)• Two types of login IDs:
– Windows Integrated (trusted) login– SQL Server login
Creating Windows Integrated Logins
Creating SQL Server Logins
Removing Users
• Make a backup first
• Obtain a written request (for auditing purposes)
Or
Lock a user’s account
Removing an Oracle User
• DROP command
• CASCADE option: when user owns database objects
• Recommendations:– Backup the account for one to three months– Listing all owned objects– Lock the account or revoke the CREATE
SESSION privilege
Modifying an Oracle User
• ALTER USER statement
• Oracle Enterprise Manager: graphical tool
Modifying an Oracle User (continued)
Default Users
• Oracle default users:– SYS, owner of the data dictionary– SYSTEM, performs almost all database tasks
• SQL Server default users:– SA, system administrator
Database Links
Connection from one database to another: allow DDL and SQL statements
• Public or Private• Authentication Methods
Example:CREATE DATABASE LINK sales.hq.acme.com CONNECT TO scott IDENTIFIED BY tiger USING 'sales';
SELECT * FROM [email protected];
Database Links (continued)
Linked Servers
• Allow you to connect to almost any:– Object Linking and Embedding Database
(OLEDB)– Open Database Connectivity (ODBC)
Linked Servers (continued)
Best Practices
• Follow company’s policies and procedures
• Always document and create logs
• Educate users
• Keep updated on database and security technology
• Review and modify procedures
• Block direct access to database tables
• Limit and restrict access to the server
• Use strong passwords
• Patches, patches, patches
Defining and Using Profiles
• Profile:– Describes limitation of database resources– Defines database users behavior– Prevents users from wasting resources
• Not offered by every database system:– Oracle does– Microsoft SQL Server does not
Creating Profiles in Oracle (continued)
Creating Profiles in Oracle (continued)
• ALTER PROFILE: modifies a limit for a profile
• ALTER USER: assigns a profile to a user
• Oracle Enterprise Manager Security Tool: view all details about users and profiles in a GUI
Creating Profiles in Oracle (continued)
Creating Profiles in SQL Server 2000
• Profiles are not available in Microsoft SQL Server 2000 or 2005
• Query and connection time-outs: handled at application level within OLEDB
Designing and Implementing Password Policies
• Password is the key to open a user account; strong passwords are harder to break
• User authentication depends on passwords• Hacker violations begin with breaking a
password• Companies spend on:
– Training– Education
What Is a Password Policy?
• Set of guidelines:– Enhances the robustness of a password– Reduces the likelihood of password breaking
• Deals with:– Complexity– Change frequency– Reuse
Importance of Password Policies
• First line of defense
• Most companies invest considerable resources to strengthen authentication by adopting technological measures that protect their assets
• Forces employees to abide by the guidelines set by the company and raises employee awareness of password protection
• Helps ensure that a company does not fail audits
Designing Password Policies
• Complexity: set of guidelines for creating passwords
• Aging: how long a password can be used
• Usage: how many times a password can be used
• Storage: storing a password in an encrypted manner
Implementing Password Policies
• Oracle; using profiles:– CREATE PROFILE– Oracle Enterprise Manager– PASSWORD_VERIFY_FUNCTION
Implementing Password Policies (continued)
Grant and Revoke User Privileges
• In SQL Server (continued):– Database privileges:
• Fixed database roles
• Statement permissions
– Grant permission using the GRANT statement– Revoke permission using the REVOKE statement– Enterprise Manager– Deny permission using the DENY statement
Grant and Revoke User Privileges (continued)
Security Models
• Access Matrix Model:– Represents two main entities: objects and
subjects:• Columns represent objects• Rows represent subjects
– Objects: tables, views, procedures, db objects– Subjects: users, roles, privileges, modules– Authorization cell
Main vulnerabilities
• People Having too many privileges
• Default Users and Passwords
• Known vulnerabilities that are not patched
• Too many open ports by default
• Solution– Must be trained to put yourself in the place of
the hacker [Pete Finnigan]
Who has DBA ROLES ?
Default Passwords
• Easiest way to log into an Oracle database is to use a default account with a known password [Finnigan]
• http://www.petefinnigan.com/default/default_password_checker.htm
• This site has scripts that will identify all default users and lets you know if they still have their default passwords. You may download these scripts.
Password Cracking
• At http://www.toolcrypt.org/index.html there are tools that you can download to crack the passwords. You need to verify this against the DB, because you can be sure that the hacker has these tools.
Find all Privileges
• http://www.petefinnigan.com/find_all_privs.sql
• Script to find which privileges have been granted to a particular user. This scripts lists ROLES, SYSTEM privileges and object privileges granted to a user. If a ROLE is found -- then it is checked recursively.
• Output can be directed to the screen or to a file.
Benchmark your DB
• http://www.cisecurity.org/bench_oracle.html
• Set of tools that will tell you how secure your Oracle DB is compared to other Oracle DB and allows you to fix vulnerabilities.
Encrypted Passwords
• http://www.cqure.net
• allows you to extract encrypted passwords (hashes) from a Windows system and use the hashes, without knowing the password, in order to authenticate to other Windows systems with users having the same passwords.
Listener Password
• http://www.integrity.com/downloads.lsnrcheck.exe
• In Oracle, by default you don’t need a password to activate to run lsnrctl.exe. Verify that there is a password to activate listener, otherwise create one using Oracle Net manager.
Otherwise, somebody can hijack listener and avoid future connections by
1) Installing oracle on their local machine
2) Update the listener.ora file on local machine to include access to remote server
3) From OS prompt: “lsnrctl stop”
Linux Vulnerabilities
• http://www.remote-exploit.org/backtrack.html
• Tools to verify Linux vulnerabilities
More Oracle tools
www.databasesecurity.com/dbsec/OAK.zip
Checks for SID, Database users, etc.
Security Models (continued)
Application Security Models
• Models:– Database role based– Application role based– Application function based– Application role and function based– Application table based
DB Security Models• Plan, Policy, Procedure, Model• Model: scheme to implement Plan, Policy,
Procedure• MAC versus DAC (two extremes)• Many different Models
– Bell LaPadula Model (MAC, focus on confidentiality)– Harrison-Ruzzo-Ullman Access Matrix Model – Sea View Model (Relational Imp. Of LaPadula)– Jajodia Sandhu Model (adaptation of Sea View)– Biba Model (focus on Integrity)
• MLS, Polyinstantiation
Document User Administration
• Part of the administration process• Reasons to document:
– Provide a paper trail– Ensure administration consistency
• What to document:– Administration policies, staff and management– Security procedures– Procedure implementation scripts or programs– Predefined roles description
http://www.oreilly.com/catalog/orasec/chapter/ch07.html