Most Database Security Vulnerabilities

The category: Architecture
06 February 2015

Databases are the primary targets of cyber-criminals as most of the valuable and sensitive data are kept on databases only. Hence, database security is a necessity. There have been several incidents when users’ personal data have been compromised through database hacking. Security measures for databases are taken for data protection and these measures don’t allow hackers get access to any document available on online databases. Though several security measures are adopted in databases, but still there are some failures which occur repetitively. These gaps can be present at any development stage, during integration of applications and updating the database system. Here we have listed ten most common vulnerabilities which are found in database driven systems:

1. Failure in Deploying: The biggest weakness lies in a database is carelessness during the deploying process. Search engine optimisation is valued for success of businesses and when database is sorted, SEO can be successfully completed. A functionality test is a must to make sure about the performance level but these tests cannot make sure if the database is doing something which it’s not expected to do. Hence, before deploying the database, its advantages and disadvantages should be thoroughly checked.

2. Broken databases: If there is any bug in the server database software then most of the vulnerable computers are attacked as soon as the database is deployed. These bugs exploit through buffer-overflow vulnerability and these bugs demonstrate the difficulties in security patches and fixes. Due to lack of time and resources, businesses are always not able to maintain regular patches on their systems. That’s the reason why databases are left vulnerable.
3. Excessive permissions: Most of the databases have users who are configured with excessive permissions. User accounts mostly have unnecessary default advantages and excessive access to functionalities.
4. Leaked Data: Network security is mostly not in focus while deploying a database system. Databases are usually thought to be in back office which is mostly kept away from Internet access, and there is no encryption in data communications in databases. But the networking interface of the database should not be ignored. If the network traffic is accessed by any cyber-attacker, then it’s very easy to get access to user data. Transport Layer Security should always be enabled. Network performance is not very affected by Secure Sockets Layer but it makes very difficult to collect any data from the database system.
5. Insider risks: Databases face two kinds of threats including external and internal. There are some people inside an organisation who can steal information for personal profits. This is one of the most common issues in large organisations. In order to encounter this problem, data archives should be encrypted so that insider risk is reduced.
6. Abuse of database features: In last few years, database exploits have been done mostly from misuse of standard database feature. Hackers are able to gain access through legitimate credentials which can be caused through simple flaws. These flaws allow bypassing of the systems. Some unnecessary tools need to be removed to stop or limit abuse of database features. The surface area, which hackers usually study before attacking, should also be shrinked for the purpose.
7. Weak passwords: Users on databases use weak and sometimes default passwords. If systems don’t enforce stronger passwords then databases can easily be compromised. If there are weak passwords, it also proves that other systems inside the network must have weak credentials. These passwords are easily assumed and hacked and attackers get access to the database,
8. SQL Injections: This problem is a major one when it comes to protection of databases. SQL injections attack applications and database administrators clean up all the mess which are created by malware, inserted into the strings. Web facing databases are best secured by enabled firewalls.
9. Sub-standard key management: Key management systems are aimed to keep keys safe but encryption keys are commonly stored on company disk drives. These keys are sometimes believed to be left on the disk which is caused by database failures and if the keys are left in such locations, then databases are left vulnerable to attacks.
10. Database irregularities: The most important thing is lack of consistency in databases, which is both a administrative and database technology problem. System administrators and database developers should maintain consistency in databases, always stay aware of threats and make sure that vulnerabilities are taken care of. Proper documentation and automation are needed to track and make changes so that all information in enterprise databases are secure.

No comments

The ways to improve Data Storage Performance.

The category: Architecture
06 February 2015
Are you overflooded with ever-increasing amounts of data? Well, this is the biggest headache for IT departments and IT managers are always combating to make the most out of the hardware system, even in limited budget. There are certain ways which can help you to improve the performance of the existing storage hardware. Learn the best eight tools to use in business environments to boost the storage performance:
1. Add Solid State Drives to existing storage:
Storage vendors usually add Solid State Disks or SSDs to the existing enterprise Storage Area Network (SAN). It has certain restrictions in the drives which are deployed with bandwidth limitations. Hard Disk Drives need to be utilised the most and if SSDs are added to the existing architecture, then it needs special caution, as it may cause severe damage to the entire system. Well, this is the simplest option which comes with lowest possible risk factor in tackling bottle-necks. It can also prove beneficial for existing storage management practices. It can also be used in tackling the involved technical challenges.
2. Make use of built-in features:
Storage Quality of Service (QoS) is not a very popular performance booster. It’s used in input-output-intensive virtual machines (VMs) and it don’t impact performance of others. SCSI commands are implemented and not emulated controllers, to boost data storage performance.
3. Throw Hardware at the problem:
Data center infrastructure is a broadly discussed issue. Hardware is sometimes added to solve performance problems and this approach is a time-tested one. It’s easy approach but expensive one. It involves adding more hard disks to the existing storage in order to add IOPS. It’s a legacy way to address the storage issue and it’s one of the most effective ways.
4. Add Flash Cards to servers:
This is one of the simplest ways to address performance challenges. It involves opening servers and adding flash card like PCI Express Cards to the storage design. This is the best approach for single applications and single server environments. But adding flash cards to enterprise storage needs extra caution again. It can sometimes limit the growth factor and functionality of a virtualised solution. It can also limit expansion and restrict direct data and solution growth. But it contains low risk and in this case only the host configuration is modified and not the entire enterprise storage architecture.
5. Place data on the appropriate storage:
Auto-tiering has received a lot of attention and it has become an essential practice in reducing latency. It’s not a brand new technique but now it’s gaining further importance as more people are using flash in their enterprise storage arrays.
6. Boost performance with hybrid storage and flash cache:
If there is a blend of flash and spinning disk in a hybrid storage model then it offers high performance. Flash hybrids are used to determine which written data receives most number of read requests and copy the same data to SSDs, to give quicker access. They also help in transactional applications.
7. Utilizing All-Flash Arrays:
All-flash arrays (AFAs) have flooded into the storage market over last one year. They can provide extremely high input/output rates and they are designed for low latency data delivery. In most cases the project costs minimise the cost justification for standard enterprise class projects. But sometimes it’s the most unsuitable and unbalanced approach as they require extremely high capital and operating expenses. Long-term development plans are affected too.
8. Storage virtualisation technology:
There is always a need of virtualising and pooling storage to improve performance of data storage systems. Storage capacity needs to be aggregated and spread the value-added features of the hardware across the storage. This also creates pools and permits similar results of high-performance storage. Multiple hosts also reduce I/O consumption and it provides features like high-availability storage like load balancing.
No comments