Database Security and Countermeasures practices.

Databases have become the central information library that organisation needs to function effectively. Whether for accounting, logistics, document management or sales

leads each dataset is available to retrieve upon request from users who need to have access it. Generally, these environments are secure as even if someone could get access to a network they would still need the credentials to get through to the database. That being the case, and with the advent of GDPR, there are still persistent threats to the information held within. These are a few of the issues that need to be addressed for the Database security and countermeasures, you can take.

Aggregation:

This is the ability to run separate reports from the data set and with the ability to link that information with another set to reveal sensitive information. Having a list of account numbers could then be linked to names to establish personal addresses.

Inference:

Is the implication from a data set to then work backwards to the original meaning. An example would be list of prescriptions for patients could then clean the illness.

Query attacks:

Each database can perform commands, queries or functions. A script could get the release of specific information or get the database to behave against its core programming.

Interception of data:

Related to the former is the ability to capture data while it is in transit and export it from the system.

Server access:

Most databases files arts stored on a central server or cloud installation. Physical access to the physical environment and local tables would need to be controlled.

TOC/TOU

Time of check/time of use is the function of changing the time of the core system to command or roll back and make the security features inoperable. Manipulating the time or date functions can make systems susceptible to vulnerabilities.

Web Security:

Some databases maybe be available over the internet to allow customer access to their information. Internet banking is just one form of am internal organisations systems being made available to the public. This makes the database susceptible to “SQL injections” which can insert commends to relinquish information.

Counter measures:

User Locks:

The basic administration is checking of administrator accounts which allow only the authorised user to have access to that part of the data set they are entitles to.

Atomicity: All or nothing.

This a rule that the dataset should behave as one unit for each component work in sync with the other. That an accounting journal will only be able to post in an open financial year. This is an all or nothing approach to database management so the whole database remains integral in any state, at backup, restore or in use, the data remain integral.

Consistency: Illegal rules

Related to the former, these are a set of rules that tell the database how to function for a purpose. A sales lead reminder in a CRM system would need to be associated with a contact for example. These rules are there to maintain the information integrity as data is linked between the contact table and the reminders table. Other wise there would be reminders, but whom, or contacts with no activities.

Isolation.

This implies that a function of the of producing a transaction will not be lodged into the system until it is committed to the database. This information to be prepared and corrected until it is lodged Putting in an address but not committing it until everything is entered including postcode.

Durability.

On from the previous, this is the concept that once information is committed then it remains from audit purposes and reliability of the information. In accounting systems, a journal will be unchangeable, so a credit must be raised for any reversals. This is the main difference between a database and Excel as the former is a finished paint where Excel as a rough sketch book. Database are meant to store reliable historical information that can recalled at any time. Excel is for short term calculations.

Apply Rules:

This relates to what areas the database can be accessed so that work can not be done on a Ny section that does not relate to your work role. A sales rep would not be able to run a profit and loss report from accounting for example.

Views:

Views is a way of using the visual user interface to hide information that is not relevant to the user. A reactionist may be able to lodge phone calls but not see the ordering a section. This is very useful in relational databases which have one datafile but sperate modules for each department.

Concurrency controls.

Stops a user changing a section of the dataset whilst another person is editing or entering information onto that record. Prevents data clash.

 

For those orgainastions that need asistance with upgrading or implementing a database strucure or compliance with GDPR see our services page.