Do You Want to Secure Your Database? Use a Multi-Layered Security Architecture

As companies become more dependent on information technology, the problem of protecting databases remains relevant. A database system is suitable storage for corporate documentation and information. Businesses entrust it with the customer and employee information, product and sales data, financial statistics, and so on. At the same time, managers worry about how to protect sensitive information from failures and hacks. Let’s talk about an efficient way to protect databases by building a multi-level architecture.

Four rules of cyber defense

70% of a 451 Research survey participants indicated that the need for database security is one of the top priorities for enterprises. System failures or information leaks have fatal business consequences. For example, an organization may lose the trust of customers and business partners, receive a fine, or acquire legal problems.

There are tectonic shifts in data requirements. The location for data is changing: they are not in a separate data center but are distributed among companies in hybrid locations. Packet processing is being replaced by real-time data processing, which is beneficial for business. Access to a database becomes centralized, which allows managing information in a role model common to an organization. The data structure is no more relational but combined because there is a whole range of solutions for a specific case (document databases, graph databases, in memory). Considering global changes, it is necessary to improve data protection tactics.

Researchers from the same survey give good advice on database security:

– Configure the protection of critical data. Today, for security, it is not enough to protect the perimeter. It is necessary to ensure security at the level of rows and tables and provide detailed access for certain types of commands. Row-level security helps restrict access to rows of data. For example, you can give employees access only to those rows of data that are related to the work of their department. Another example is giving customers access only to the data that is relevant to their company.

– Implement high-security levels (B1-A1) — advanced access control architecture and security verification system to provide instant secure access to data without the need to store it physically. In the past 20 years, the problem of data fragmentation has arisen in cybersecurity. Data is everywhere: in storage, in lakes, and in the cloud. And, accordingly, each element of these technologies must be protected by all possible means. Even if 9 copies of the data are well protected in proprietary systems, and the 10th one is poorly defended, then the database is protected as much as the most vulnerable copy. It is vital to pay attention to each detail of the database.

– Security tools should comply with requirements and have a user-friendly UI for managing access policies, monitoring and settings, failover, backup, and recovery.

– Allocate a dedicated cyber security specialist to manage the database. In organizations, information is stored in data warehouses and lakes, partly in the cloud. This happens, for example, when data cannot be moved to the cloud legally. Or an organization has rules that prohibit the storage of confidential information outside the firewall. Data is in different locations, managed by different technologies, and must be dealt with centrally. Therefore, an experienced database administrator is needed in each department where information is collected.

Let’s look at how companies can minimize security risk through a multi-layered database structure using the open-source Postgres as an example.

Source: Jelvix

How to build 11 levels of protection for a database

Multi-layered architecture means providing security at the network, transport, and database levels. It is necessary to provide such security in which a database will be protected like a bank vault. In this case, to open a “door”, it is necessary to open another one, protected by a secret key. To protect data, security measures are needed wherever it is theoretically possible to access them.

A multi-layered security architecture includes secure limited access to the host (physical), the corporate network, the database host, the DB application, and the data.

Most organizations operate under the AAA model (Authentication-Authorization-Auditing), where a participant’s right to access data is tracked. Authentication allows you to understand that a certain user is the one who claims this identity. Authorization ensures that the user is allowed access. Auditing means that database activities are logged. This proven model can be used as a basis for monitoring database protection methods.

Organizations can leverage the AAA security model by using an 11-layer security approach:

1. Physically secure data centers. If a data center has no lock on the door, then all the other efforts become meaningless to a large extent.
2. Protect access to the host by controlling user rights through authorization and authentication mechanisms. These tools ensure that the user does not enter the database without authorization.
   PostgreSQL features a detailed system of user rights based on roles. Therefore, any database account name is a role with the login attribute, thanks to which a user connects to the database. Roles can also have other attributes that allow them to bypass access checks, create databases, and create other roles and features. Users are given group membership with certain privileges for database objects.
3. Encrypt the file system on the disk using Vormetric or VeraCrypt. Storing data in the encrypted form will protect them against theft and confiscation.
4. Secure the connection to the database server through the “hba.conf” configuration file. This document includes entries about connection type, client IP address, database name, username, and user authentication method. You can also protect the server by blocking access to the node on which the database is running (at the port level using a firewall). By default, PostgreSQL listens on TCP port 5432. You can block other ports using the iptables utility (Linux) or by creating an incoming connection rule (Windows).
5. Encrypt information on the network using an SSL certificate to provide a secure connection to the database host and protect against man-in-the-middle attacks. PostgreSQL implements native support for SSL connections to encrypt client-server communications.
6. Check the function of the DBMS to prevent SQL injections. Make sure that the DBMS blocks such intrusions.
7. Set up the user authentication process through passwords, certificates, OS credentials, LDAP, and other methods. Authentication should be linked to general user management. This will be useful in the future to revoke access credentials when users move on to other projects, leave, or stop using the database.
8. Give users rights to work with the database, but with fewer privileges.
9. Encrypt data at the column and row levels by defining an access control policy. For example, allow users to change or delete only certain elements of a table.
10. Set up database auditing to track procedures inside it. Such a measure will allow the monitoring of user actions according to privileges. You should analyze user connections, DDL changes, data changes, and data presentation.
11. Implement the information masking function for a group of users. Raw data is replaced with dummy or arbitrary character sets using built-in or custom masking functions. This does not change the information stored on the disk. DDM uses T-SQL commands and finds protected data by fields, sets up an appropriate masking function, and hides data from queries. To do this, you do not need to encode, encrypt or change actual information.

Source: Cssonline

Conclusion

As you’ve seen with Postgres, a multi-layered security architecture for databases allows companies to better control data and reduce the risk of failure and theft. However, when choosing database security solutions, you should focus on infrastructures, the company’s IT policy, and the current security scenario. As ICIT Senior Research Fellow James Scott said, there is no one-size-fits-all solution to cybersecurity, multi-layered defense is the only viable defense. Therefore, it is important to protect data on each level: on the external one (VPN, antivirus, firewalls), in the middle (distribution of rights and access control), and on the internal level — directly in the database itself.

From Infosec Writeups: A lot is coming up in the Infosec every day that it’s hard to keep up with. Join our weekly newsletter to get all the latest Infosec trends in the form of 5 articles, 4 Threads, 3 videos, 2 Github Repos and tools, and 1 job alert for FREE!