Database Security Managing Users and Security Models

Managing Users Authorization & Authentication Creating Users Check for Default Users Check for weak passwords Lock & Remove Accounts

Operating System Authentication Many databases (including Microsoft SQL Server 2000) depend on OS to authenticate users Reasons: –Once an intruder is inside the OS, it is easier to access the database –Centralize administration of users Users must be authenticated at each level –(defense in depth)

Creating Users Must be a standardized, well-documented, and securely managed process In Oracle10g, use the CREATE USER statement: –Part of the a Data Definition Language (DDL)

Creating an Oracle10g User IDENTIFIED clause –Tells Oracle how to authenticate a user account –BY PASSWORD option: encrypts and stores an assigned password in the database –EXTERNALLY option: user is authenticated by the OS –GLOBALLY AS option: depends on authentication through centralized user management method Example: CREATE USER smith identified by s9 default tablespace users; ALTER USER smith IDENTIFIED EXTERNALLY; -- by OS ALTER USER scott ACCOUNT LOCK -- lock a user account ALTER USER scott ACCOUNT UNLOCK; ALTER USER scott PASSWORD EXPIRE; -- Force new pwd

DEFAULT TABLESPACE clause: specifies default storage for the user TEMPORARY TABLESPACE clause QUOTA clause: tells Oracle 10g how much storage space a user is allowed for a specified tablespace PROFILE clause: indicates the profile used for limiting database resources and enforcing password policies Creating Users (continued)

Creating a SQL Server User Create a login ID first; controls access to SQL Server system Associate login ID with a database user Must be member of fixed server roles (SYSADMIN or SECURITYADMIN) Two types of login IDs: –Windows Integrated (trusted) login –SQL Server login

Creating Windows Integrated Logins

Creating SQL Server Logins

Removing Users Make a backup first Obtain a written request (for auditing purposes) Or Lock a user’s account

Removing an Oracle User DROP command CASCADE option: when user owns database objects Recommendations: –Backup the account for one to three months –Listing all owned objects –Lock the account or revoke the CREATE SESSION privilege

Modifying an Oracle User ALTER USER statement Oracle Enterprise Manager: graphical tool

Modifying an Oracle User (continued)

Default Users Oracle default users: –SYS, owner of the data dictionary –SYSTEM, performs almost all database tasks SQL Server default users: –SA, system administrator

Database Links Connection from one database to another: allow DDL and SQL statements Public or Private Authentication Methods Example: CREATE DATABASE LINK sales.hq.acme.com CONNECT TO scott IDENTIFIED BY tiger USING 'sales'; SELECT * FROM

Database Links (continued)

Linked Servers Allow you to connect to almost any: –Object Linking and Embedding Database (OLEDB) –Open Database Connectivity (ODBC)

Linked Servers (continued)

Best Practices Follow company’s policies and procedures Always document and create logs Educate users Keep updated on database and security technology Review and modify procedures Block direct access to database tables Limit and restrict access to the server Use strong passwords Patches, patches, patches

Defining and Using Profiles Profile: –Describes limitation of database resources –Defines database users behavior –Prevents users from wasting resources Not offered by every database system: –Oracle does –Microsoft SQL Server does not

Creating Profiles in Oracle (continued)

ALTER PROFILE: modifies a limit for a profile ALTER USER: assigns a profile to a user Oracle Enterprise Manager Security Tool: view all details about users and profiles in a GUI

Creating Profiles in Oracle (continued)

Creating Profiles in SQL Server 2000 Profiles are not available in Microsoft SQL Server 2000 or 2005 Query and connection time-outs: handled at application level within OLEDB

Designing and Implementing Password Policies Password is the key to open a user account; strong passwords are harder to break User authentication depends on passwords Hacker violations begin with breaking a password Companies spend on: –Training –Education

What Is a Password Policy? Set of guidelines: –Enhances the robustness of a password –Reduces the likelihood of password breaking Deals with: –Complexity –Change frequency –Reuse

Importance of Password Policies First line of defense Most companies invest considerable resources to strengthen authentication by adopting technological measures that protect their assets Forces employees to abide by the guidelines set by the company and raises employee awareness of password protection Helps ensure that a company does not fail audits

Designing Password Policies Complexity: set of guidelines for creating passwords Aging: how long a password can be used Usage: how many times a password can be used Storage: storing a password in an encrypted manner

Implementing Password Policies Oracle; using profiles: –CREATE PROFILE –Oracle Enterprise Manager –PASSWORD_VERIFY_FUNCTION

Implementing Password Policies (continued)

Grant and Revoke User Privileges

In SQL Server (continued): –Database privileges: Fixed database roles Statement permissions –Grant permission using the GRANT statement –Revoke permission using the REVOKE statement –Enterprise Manager –Deny permission using the DENY statement

Grant and Revoke User Privileges (continued)

Security Models Access Matrix Model: –Represents two main entities: objects and subjects: Columns represent objects Rows represent subjects –Objects: tables, views, procedures, db objects –Subjects: users, roles, privileges, modules –Authorization cell

Main vulnerabilities People Having too many privileges Default Users and Passwords Known vulnerabilities that are not patched Too many open ports by default Solution –Must be trained to put yourself in the place of the hacker [Pete Finnigan]

Who has DBA ROLES ?

Default Passwords Easiest way to log into an Oracle database is to use a default account with a known password [Finnigan] This site has scripts that will identify all default users and lets you know if they still have their default passwords. You may download these scripts.

Password Cracking At there are tools that you can download to crack the passwords. You need to verify this against the DB, because you can be sure that the hacker has these tools.

Find all Privileges sqlhttp:// sql Script to find which privileges have been granted to a particular user. This scripts lists ROLES, SYSTEM privileges and object privileges granted to a user. If a ROLE is found -- then it is checked recursively. Output can be directed to the screen or to a file.

Benchmark your DB mlhttp:// ml Set of tools that will tell you how secure your Oracle DB is compared to other Oracle DB and allows you to fix vulnerabilities.

Encrypted Passwords allows you to extract encrypted passwords (hashes) from a Windows system and use the hashes, without knowing the password, in order to authenticate to other Windows systems with users having the same passwords.

Listener Password e In Oracle, by default you don’t need a password to activate to run lsnrctl.exe. Verify that there is a password to activate listener, otherwise create one using Oracle Net manager. Otherwise, somebody can hijack listener and avoid future connections by 1) Installing oracle on their local machine 2) Update the listener.ora file on local machine to include access to remote server 3) From OS prompt: “lsnrctl stop”

Linux Vulnerabilities exploit.org/backtrack.htmlhttp:// exploit.org/backtrack.html Tools to verify Linux vulnerabilities

More Oracle tools Checks for SID, Database users, etc.

Security Models (continued)

Application Security Models Models: –Database role based –Application role based –Application function based –Application role and function based –Application table based

DB Security Models Plan, Policy, Procedure, Model Model: scheme to implement Plan, Policy, Procedure MAC versus DAC (two extremes) Many different Models –Bell LaPadula Model (MAC, focus on confidentiality) –Harrison-Ruzzo-Ullman Access Matrix Model –Sea View Model (Relational Imp. Of LaPadula) –Jajodia Sandhu Model (adaptation of Sea View) –Biba Model (focus on Integrity) MLS, Polyinstantiation

Document User Administration Part of the administration process Reasons to document: –Provide a paper trail –Ensure administration consistency What to document: –Administration policies, staff and management –Security procedures –Procedure implementation scripts or programs –Predefined roles description