NCAI Exchange Network Tribal User Meeting 9-10 April 2008 Considerations for Tribal Database Application Security Bill Farr President ResourceVue, LLC T: , © 2008 ResourceVue, LLC, All Rights reserved Integrated Data Environments for Natural Resource Management

1 NCAI 9 Apr 2008 NCAI Types of Data to be stored in database applications IT and Data Architectures Threats to data What to ask the database application vendor Examples of answers, solutions Discussion, Demonstration Agenda

2 NCAI 9 Apr 2008 NCAI Tribal Data Types Examples Departmental Data Tracking Haz Waste Land Use, Air etc… Water Resources Departmental Unique Data Tracking Contract, Grant Management Program Management etc… Finance Tribal Common Processes Tribal Business Applications EPA EN Node Clients Water Assets GIS Land Assets Air Ag

3 NCAI 9 Apr 2008 NCAI IT and Data Architectures  Databases typically run on servers that have basic protection Internet Explorer Web Firewall SW Code IIS DB (Oracle) IIS and Oracle can reside on the same server, where IIS communicates with the Oracle database through port 1521 Web Services ServerClient Client connects to IIS server over the Web and through a firewall using port 443 Users are authenticated using PKI certificates and strong passwords

4 NCAI 9 Apr 2008 NCAI Threats to Database Applications  80% of malicious activity on data comes from the inside… (Forester)  Typical database application threats are: –SQL Injection –Inference –Web page hi-jacks  Result: Unauthorized access to data

5 NCAI 9 Apr 2008 NCAI Threats to Database Applications  SQL Injection “…SQL injection attacks allow a malicious activity to execute arbitrary SQL code on the server. The attack is issued by including a string delimiter (') in an input field and following it with SQL instructions. If the server does not properly validate input, the instructions may be executed against the database. “ Malicious DB query

6 NCAI 9 Apr 2008 NCAI Threats to Database Applications  Inference –Inference occurs when users are able to piece together information at one security level to determine a fact that should be protected at a higher security level. Level 1 Level 2 Inference Tribal Member Name Allotment Ownership

7 NCAI 9 Apr 2008 NCAI Threats to Database Applications  Web page Hi-jacks A web page hi jack occurs when a malicious person tries to capture a URL/page name without going though any authentication. Authentication Web page Malicious User Hi-jack Database

8 NCAI 9 Apr 2008 NCAI What to ask the DB Developer  What tiers/layers do you have in your application, and what security is built in?  How do you handle SQL Injection attacks?  How do you handle Inference attacks?  How do you handle Web age Hijacks?  How do you handle User Security?

9 NCAI 9 Apr 2008 NCAI Example Answers  What tiers/layers do you have…… Internet Explorer IISTVUtilsDBUtilsDB The Internet Explorer client communicates to the IIS server through HTTPS The IIS server passes user requests to the TVUtils object, which returns HTML and DHTML The TVUtils object communicates with the DBUtils object using XML The DBUtils object retrieves information from and updates information in the Oracle database using an OLEDB connection Web Services Middle LayerData Layer

10 NCAI 9 Apr 2008 NCAI Example Answers  How do you handle SQL Injection attacks? “Our middle layer performs a format check on the DB request…” DBUtilsDB Data LayerMiddle Is this request the correct format??? - NO: kick out - Yes: proceed

11 NCAI 9 Apr 2008 NCAI Example Answers  How do you handle Inference attacks? “1. If a user does not have the permissions they can not get to the next page, and….. 2. Error messages no display any data.” Level 1 Level 2 Inference Tribal Member Name Allotment Ownership X

12 NCAI 9 Apr 2008 NCAI Example Answers  How do you handle Web page Hijacks? “1. If a user does not have the permissions they can not get to the next page, and….. 2. each page checks the source of the request; if not authenticated, it throws a message: Authentication Web page Malicious User Hi-jack Database

13 NCAI 9 Apr 2008 NCAI Example Answers  How do you handle User Security? “We use a multi-factored security model: Realm: Separate data into virtual instances Rule:Restrict DB operations to what is needed, when.. Roles:Only allows users to perform the functions they need Policy: Written policies on the above

14 NCAI 9 Apr 2008 NCAI User Security Example  ResourceVue – Super Node

15 NCAI 9 Apr 2008 NCAI Mni Sose – Resourcevue Super Node Example MniSose Coalition DB Coalition Tribe 1 DB Omaha Coalition Tribe 3 DB Coalition Tribe 4 DB Coalition Tribe 5 DB Coalition Tribe 6 DB Coalition Tribe 7 DB Web Services Aggregated Multi-tribal Water Quality Data MniSose ‘Super-Node’ Node Client MniSose Portal DB Kickapoo Ponca Prairie Band Potawatomi Sac and Fox Santee Sioux Winnebago Web Services Aggregated Multi-tribal Environmental Data Services MniSose ‘Super-Node’ Node Client Local Data Server Spreadsheet Realm: Separate, Secure Tribal Databases Role: Individual Member Log In EPA EN Searches Reports Documents Roll-up Queries Rule: Only allow operations at certain hous

16 NCAI 9 Apr 2008 NCAI A Solution  Web based – currently hosted at Mni Sose, Rapid City Program Area Apps: Water, Air, Facilities Document Library Member access, security, admin Multi-Tribal Partitions

17 NCAI 9 Apr 2008 NCAI Role: Access to Water Assets  Surface and Ground Water Sources  Monitoring Stations Manage Baseline Data of Water Assets Manage Monitoring Stations

18 NCAI 9 Apr 2008 NCAI Role: Manage of EPA Transactions  Track each node client data submission history –EPA token ID, XML file (WQX)

19 NCAI 9 Apr 2008 NCAI The Process - Node Client Flow  Sample Process for Managing Water Quality Data Exchange Manage Monitoring Stations Water Resources Dept Reviewers Manage Baseline Data of Water Assets Import Data Into Central Repository Prepare EPA Data Exchange Format Invoke Node Client to Push Data Set to EPA Review and Assess Water Quality Data Water Quality Engineers Receive Data Set 410 EPA Gather Water Quality Samples Set Standards 400 DATASTOREPLANNINGDATASTOREPLANNING

20 NCAI 9 Apr 2008 NCAI Questions…..

21 NCAI 9 Apr 2008 NCAI  Bill Farr  ResourceVue, LLC  T: 