1. Database Vulnerability And Encryption Presented By: Priti Talukder

2. Content  Different types of Threats.  How will organization protect sensitive data?  What is database encryption, and how does it work?  Is database encryption alone enough to protect data from compromise?  Does encrypting a database impact server performance?

3. Threats  External Threats Hackers breach a software company’s website, stealing credit card information.  Internal Threats A disgruntled employee accesses confidential salary information and distributes it.  Physical threats Thieves strike a data center.

4. Example Of Threats  Stolen 55,000 credit card records from the database of CreditCards.com by Mexus. mirror image of Mexus’s web site.mirror image of

5. Database encryption  What is Database encryption? Protect data from compromise and abuse.  How does it work? Credit Card Number 011112345677999 1234567890123456 + Encrypted Credit Card Number Encryption Key + Encryption Algorithm 04wØ×1ve

6. Encryption Strategy  Inside DBMS  Advantages and Disadvantages Least impact on application Security vulnerability- encryption key stored in database table. Performance degradation To separate keys, additional hardware is required like HSM.  Outside DBMS  Advantages and Disadvantages –Remove computational overhead from DBMS and application servers. –Separate encrypted data from encrypted key. –Communication overhead. –Must administer more servers.

7. Is database encryption enough?  Compromising with web server.  Hacking while transfer(MITM)  Solution Additional security practices such as SSL and proper configuration of firewall.

8. Application Spher

9. Structure Firewall Telnet Http DPI, IPS Application Sphere Sql injection Buffer overflow Cookie poisoning Front Door Metal Detector Pick pocket XSS

10. Statistics AttackPercent vulnerable Cross-site scripting 80% SQL injection62% Parameter tampering60% Cookie poisoning37% Database server33% Web Server23% Buffer overflow19%

11. Application security-essential element InformationDatabase Business LogicApplication server ApplicationWeb custom HostOS, Network, System, Memory NetworkTCP, UDP, Port over IP

12. References  http://www.imperva.com http://www.imperva.com  http://databases.about.com/library/weekly/aa1215 00b.htm http://databases.about.com/library/weekly/aa1215 00b.htm  http://www.governmentsecurity.org/articles/Datab asesecurityprotectingsensitiveandcriticalinformati on.php http://www.governmentsecurity.org/articles/Datab asesecurityprotectingsensitiveandcriticalinformati on.php  http://techlibrary.wallstreetandtech.com/data/rlist? t=itmgmt_10_50_20_24 http://techlibrary.wallstreetandtech.com/data/rlist? t=itmgmt_10_50_20_24