Documentos de Académico
Documentos de Profesional
Documentos de Cultura
Version 2.0
February 1, 2009
Database Security Consortium
Security Guideline WG
Table of Contents
3/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
Chapter 1 Introduction
1.1 Objective
In recent years, security incidents involving information leaks have
occurred more frequently in society. Much of this critical information is
stored in databases, which adds to the importance of implementing
database security controls. Thus there is a need for a technical and
procedural standard for the protection of database systems, which lies at the
heart of information systems. Such a standard shall serve as a guide to the
setting up and operation of; systems that provide and maintain a safe and
secure environment. Said standard will eventually help in the establishment
of an advanced information and telecommunications network society.
In light of the need for security measures that encompass the broad fields
of database and security, a guideline that defines the policies and
requirements of database security, has been lacking in Japan.
1.3 Notice
Before using this Guideline, read the following notice.
-Copyright
The copyright of this Guideline belongs exclusively to the Database
Security Consortium (DBSC).
-Restrictions on Use
This Guideline may not be sold for commercial purposes. Otherwise,
there is no restriction to providing any service that is based on the
contents of this Guideline.
-Reference Citation
When referring to parts or the entire Guideline, always include the
citation Database Security Guideline, regardless of whether the use is
for commercial or non-commercial purposes.
-Disclaimer
DBSC shall not be responsible nor shall it be held liable for any
financial loss or damages resulting from the use of this Guideline.
5/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
-Publicizing
When using this Guideline for publicizing in the news or other media,
contact the DBSC secretariat at info@db-security.org.
1.4 Revising this Guideline
Requirements for security controls (i.e. mandatory or recommended)
based upon the importance of information assets has been reviewed and
revised. See the following annex for the results. (*1)
Annex 1: Table of Information Asset Value and Security Control Level
Mandatory: a serious security problem shall arise in the database system if the
control is not implemented
6/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
WWW Server
DMZ
Role
Player
Scope of
Guideline
1) Ordinary User
Firewall
Internal
Zone
DB
Server
Firewall
Application
Server
Publicly Available
Systems
Internal Systems
3) System Manager
8) Database
Operator
Operations/Management
Zone
Office
Zone
4) System Developer
Development
Environment
7) Database
Administrator
5) System
Administrator
6) System
Operator
2) Internal User
1. Network controls
2. Web controls
3. Application auditing
4. Database controls
5. Terminal controls
This guideline shall focus on "4. Database Controls" and the details shall
be described in Chapter 4 "Database Security Controls."
The applicable security controls for the system model is shown below in
Figure 2.
System Diagram
Internet
Role
Player
2. Web controls
-Security scanning
-Security patch application
-Unnecessary port closure
-Access log management,
etc.
WWW Server
DMZ
Scope of
Guideline
1) Ordinary User
Firewall
1) Network Controls
-Firewall access controls
-IDS/IPS intrusion monitoring
-IP/VPN encryption
-Virus, worm detection, etc.
3) System Manager
Internal
Zone
DB
Server
Firewall
Application
Server
5. Terminal controls
-Biometric authentication
-BIOS password
-Screensaver settings
-Hard drive encryption, etc.
3. Application auditing
-ID/Password management
-Coding rules
-Access controls
-XSS, application monitoring, etc.
Publicly Available
Systems
Internal Systems
8) Database
Operator
Operations/Management
Zone
Office
Zone
4. Database controls
-Access control
-Authentication
-Encryption
-Monitoring, etc.
4) System Developer
Development
Environment
7) Database
Administrator
5) System
Administrator
6) System
Operator
2) Internal User
Terminal
Network
WWW
Server
Application
Server
DB
Server
OS
1) Ordinary
User
2) Internal User
5) System
Administrator
6) System
Operator
7) Database
Administrator
8) Database
Operator
to
OS Management Information
4) System Developer*
*No
access
rights
operational systems
3) System Manager
OS Non-management Information
DBMS
1) Ordinary User
2) Internal User
3) System Manager
4) System Developer
5) System Administrator
6) System Operator
7) Database Administrator
10/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
-DBMS operation
8) Database Operator
Information Asset
Personal Information
Medium
Low
External personal
Internal personal
No personal
information
information
information contained
(personal information
(personal information
outside the
inside the
organization)
organization)
11/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
Company Information
Confidential
Publicly Available
information
(Information whose
Information
(Information whose
access is restricted to
access is restricted to
company personnel
authorized personnel
only)
only)
Note: Mandatory and Recommended indications for each control described in this
Guideline are for assets with Medium value. The indications for High and Low
assets are mapped in Annex 1: Table of Information Asset Value and Security Control
Level.
12/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
What?
Players)
(Information
How? (Means)
Action? (Unauthorized
Authorized or
Action)
Unauthorized
Assets)
Access
1) Ordinary
DBMS
packet eavesdropping
-Unauthorized
User
Management
password dictionary
modification or
2) Internal
Information
attack
destruction of DBMS
User
stealing ID/password
information
3) System
-Unauthorized access of
Manager
unauthorized access of
DBMS information
4) System
DBMS information by
Developer
exploiting errors in
5) System
settings
Unauthorized
13/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
Administrator
unauthorized access of
6) System
DBMS information by
Operator
exploiting DBMS
vulnerability
unauthorized removal
of information through
an unauthorized route
1) Ordinary
DBMS
unauthorized removal
-Unauthorized use of
User
Non-management
of information through
Information
an authorized route
SQL execution with the
intent of disrupting
resource exhaustion)
Authorized
service
2) Internal
DBMS
unauthorized removal
-Unauthorized use of
User
Non-management
of information through
Information
an authorized route
SQL execution with the
intent of disrupting
resource exhaustion)
Authorized
service
1) Ordinary
DBMS
packet eavesdropping
-Unauthorized
User
Non-management
password dictionary
modification or
2) Internal
Information
attack
destruction of DBMS
stealing ID/password
information
User
Unauthorized
14/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
unauthorized removal
of information through
an unauthorized route
3) System
DBMS
packet eavesdropping
-Unauthorized
Manager
Non-management
password dictionary
modification or
4) System
Information
attack
destruction of DBMS
Developer
stealing ID/password
information
5) System
-Unauthorized access of
Administrator
unauthorized access of
DBMS information
6) System
DBMS information by
Operator
exploiting errors in
Unauthorized
settings
unauthorized access of
DBMS information by
exploiting DBMS
vulnerability
unauthorized removal
of information through
an unauthorized route
creating backdoors
-Unauthorized
4) System
DBMS
Developer
Management
modification or
Information
destruction of DBMS
Unauthorized
information
-Unauthorized access of
DBMS information
DBMS
creating backdoors
-Unauthorized
Non-management
modification or
Information
destruction of DBMS
information
-Unauthorized access of
DBMS information
15/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
3) System
DBMS
unauthorized access of
-Unauthorized
Manager
Management
DBMS information by
modification or
5) System
Information
creating unauthorized
destruction of DBMS
DBMS administrator or
information
operator account
-Unauthorized access of
Administrator
Unauthorized
DBMS information
DBMS
unauthorized access of
-Unauthorized
Non-management
DBMS information by
modification or
Information
creating unauthorized
destruction of DBMS
DBMS administrator or
information
operator account
-Unauthorized access of
DBMS information
3) System
DBMS
unauthorized access of
-Unauthorized
Manager
Management
DBMS information by
modification or
6) System
Information
modifying database
destruction of DBMS
files
information
Operator
Unauthorized
-Unauthorized access of
DBMS information
DBMS
unauthorized access of
-Unauthorized
Non-management
DBMS information by
modification or
Information
modifying database
destruction of DBMS
files
information
-Unauthorized access of
DBMS information
7) Database
DBMS
unauthorized removal
-Unauthorized use of
Administrator
Management
of information through
Information
an authorized route
using management
-Unauthorized
information to access
modification or
ID/password
destruction of
unauthorized access of
information
Authorized
DBMS information by
modifying management
information
16/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
intent of disrupting
resource exhaustion)
service
DBMS
packet eavesdropping
-Unauthorized
Non-management
unauthorized removal
modification or
Information
of information through
destruction of DBMS
an unauthorized route
information
Unauthorized
-Unauthorized access of
DBMS information
8) Database
DBMS
packet eavesdropping
-Unauthorized
Operator
Management
password dictionary
modification or
Information
attack
destruction of DBMS
stealing ID/password
information
-Unauthorized access of
unauthorized access of
DBMS information
Unauthorized
DBMS information by
exploiting errors in
settings
unauthorized access of
DBMS information by
exploiting DBMS
vulnerability
unauthorized removal
of information through
an unauthorized route
DBMS
unauthorized removal
-Unauthorized use of
Non-management
of information after
Information
obtaining from an
Authorized
authorized route
SQL execution with the
intent of disrupting
resource exhaustion)
service
17/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
Example:
-Personal information, confidential information
3.1.2 Risk Assessment
In order to apply security controls effectively, the following controls must
be implemented.
-Identify threats and perform risk assessment. (Mandatory)
-Implement necessary database security controls based upon the
importance of assets and the results of risk assessment. (Mandatory)
account
-Allocate necessary access rights to DBMS
(non-management) information
authorization
- Prohibit users from storing database information into
anything other than authorized media
- Prohibit users from writing down ID/passwords and leaving
them visible to the public/others
- Prohibit anyone from becoming both database administrator
and system operator
24/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
4.1.1.1 Installation
(1) Using the Latest Version
In order that the latest security controls are available, the following
controls must be implemented.
-Install the latest security patches. (Mandatory)
-Determine and use the latest version of DBMS that are available.
(Recommended)
25/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
4.1.2 Authentication
Current database authentication systems use password authentication
during logins. To prevent unauthorized users from using authorized
accounts to leak or modify information, account information must be tightly
managed. Furthermore, as DBMS administrator accounts enable users to
do everything, their account information must be managed more tightly
than ordinary user accounts.
26/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
4.1.4 Encryption
Information is compromised more often by internal causes, such as theft
by internal personnel or loss of laptops being used outside office premises,
rather than by external attacks. Important data must be protected from
compromise.
32/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
(Mandatory)
- Database server connection terminals (PCs) must be hardened
before access is granted. (Mandatory)
-Terminal (PC) users must be authenticated before access is granted.
(Mandatory)
-Software installed on terminals (PCs) and their use must be
monitored. (Mandatory)
-Access to printers (from terminals (PCs)) must be controlled.
(Mandatory)
4.1.6 Others
We have been presenting preventive controls involving DBMS settings
and configurations. DBMS security levels can be increased further by
implementing server access and resource controls.
(Recommended)
4.2.1.1 Logging
(1) Obtain Login Logs
In order to monitor logins, the following controls must be
36/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
implemented.
-Produce login logs. (Mandatory)
(2) Obtain DBMS Information Access Logs
In order to monitor access to personal, confidential, and other
important information, the following controls must be implemented.
-Produce logs relating to access/changes to personal,
confidential, and other important information. (Mandatory)
(3) Obtain DBMS Management Information Access Logs
In order to monitor access to DBMS management information, the
following controls must be implemented.
-Produce logs relating to access/changes to DBMS management
information. (Mandatory)
(4) Obtain Logs to Database Object Changes
In order to monitor changes to database objects, the following
controls must be implemented.
-Produce audit logs of database object (e.g. database accounts,
tables, views, etc.) creation and changes. (Mandatory)
Example:
-Tapes, LTO device, disks, external servers, external
database, etc.
Note: 'External' refers to a system or device other than the database system or
the third party system in which the log data is stored
40/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010
41/41
All Rights Reserved, Copyright Database Security Consortium (DBSC) 2008-2010