1 RELATIONAL DATABASE EXAMPLE 2 DATABASE ACCESS CONTROL 3 SQL ACCESS CONTROLS 4 ROLE-BASED ACCESS CONTROL 5 INFERENCE 6 STATISTICAL DATABASES (SDB) 7 PROTECTING AGAINST INFERENCE 8 DATABASE ENCRYPTION 9 SQL INJECTION ATTACKS

1. 1
DATABASE SECURITYDATABASE SECURITY
ITSY3104 Computer Security A - Lecture 7 Database Security
Mr. RAJASEKAR RAMALINGAM
Department of IT, College of Applied
Sciences, Sur.
Sultanate of Oman.
http://vrrsekar.wixsite.com/raja
Based on
William Stallings, Lawrie Brown, Computer Security:
Principles and Practice, Third Edition

2. CONTENT
 7.1 RELATIONAL DATABASE EXAMPLE
 7.2 DATABASE ACCESS CONTROL
 7.3 SQLACCESS CONTROLS
 7.4 ROLE-BASED ACCESS CONTROL
 7.5 INFERENCE
 7.6 STATISTICAL DATABASES (SDB)
 7.7 PROTECTING AGAINST INFERENCE
 7.8 DATABASE ENCRYPTION
 7.9 SQL INJECTION ATTACKS
2ITSY3104 Computer Security A - Lecture 7 Database Security

3. 3
7.1 RELATIONAL DATABASE EXAMPLE
ITSY3104 Computer Security A - Lecture 7 Database Security

4. 7.2 Database Access Control
Database access control
system determines:
Database access control
system determines:
If the user has access to the entire
database or just portions of it
What access rights the user has
(create, insert, delete, update, read,
write)
Can support a range of
administrative policies
Can support a range of
administrative policies
Centralized administration
•Small number of privileged users may
grant and revoke access rights
Ownership-based administration
•The creator of a table may grant and
revoke access rights to the table
Decentralized administration
•The owner of the table may grant and
revoke authorization rights to other users,
allowing them to grant and revoke access
rights to the table 4

5. 7.3 SQLAccess Controls
 Two commands for managing access rights:
 grant
used to grant one or more access rights or can be
used to assign a user to a role
 revoke
revokes the access rights
 Typical access rights are:
 select, insert, update, delete, references
5ITSY3104 Computer Security A - Lecture 7 Database Security

6. 6
 GRANT { privileges | role } [ON table] TO { user | role |
PUBLIC } [IDENTIFIED BY password] [WITH GRANT
OPTION]
 e.g. GRANT SELECT ON ANY TABLE TO ricflair
 REVOKE { privileges | role } [ON table] FROM { user |
role | PUBLIC }
 e.g. REVOKE SELECT ON ANY TABLE FROM ricflair
Typical access rights are:
 SELECT, INSERT, UPDATE, DELETE, REFERENCES
NETW4005 - SPRING 2017 - LECTURE 9 - DATABASE SECURITY

7. 7.4 Role-Based Access Control (RBAC)
 Role-based access control eases administrative burden and
improves security
 A database RBAC needs to provide the following capabilities:
 Create and delete roles
 Define permissions for a role
 Assign and cancel assignment of users to roles
 Categories of database users:
7

8. 8
7.5 INFERENCE
 Process of performing authorized queries & deducing
unauthorized information from the legitimate responses
received.
 The inference problem arises when the combination of a
number of data items is more sensitive than the individual
items, or when a combination of data items can be used to
infer data of a higher sensitivity.
 The attacker may make use of nonsensitive data as well as
metadata.
 Metadata refers to knowledge about correlations or
dependencies among data items that can be used to deduce
information not otherwise available to a particular user.
ITSY3104 Computer Security A - Lecture 7 Database Security

9. 9
 The information transfer path by which unauthorized data is
obtained is referred to as an inference channel.
 Two inference techniques can be used to derive additional
information:
1. Analyzing functional dependencies between attributes within a
table or across tables; and
2. Merging views with the same constraints.
ITSY3104 Computer Security A - Lecture 7 Database Security

10. 10
INFERENCE EXAMPLE…
Figure a : Shows a table Employee with five columns.
Figure b : Shows two views.
Figure c : This violates the access control policy that the
relationship of attributes Name and Salary must not be disclosed.
ITSY3104 Computer Security A - Lecture 7 Database Security

11. 11
7.5.1 INFERENCE COUNTERMEASURES
 Inference detection at database design
 alter database structure or access controls
 Inference detection at query time
 by monitoring and altering or rejecting queries
 Need some inference detection algorithm
 a difficult problem
 cf. employee-salary example
ITSY3104 Computer Security A - Lecture 7 Database Security

12. 12
7.6 STATISTICAL DATABASES (SDB)
 Provides data of a statistical nature (Counts & Averages)
 Two types:
1. Pure statistical database
 This type of database only stores statistical data.
 An example is a census database.
 Access control for a pure SDB is straightforward.
 Certain users are authorized to access the entire database.
2. Ordinary database with statistical access
 This type of database contains individual entries;
 This is the type of database discussed so far in this chapter.
 The database supports a population of nonstatistical users
who are allowed access to selected portions of the database.
ITSY3104 Computer Security A - Lecture 7 Database Security

13. 13
7.6.1 STATISTICAL DATABASE SECURITY
 Use a characteristic formula C
 A logical formula over the values of attributes
 e.g. (Gender=Male) AND ((Major=CS) OR (Major=EE))
 Query set X(C) of characteristic formula C, is the set of
records matching C
 A statistical query is a query that produces a value calculated
over a query set
ITSY3104 Computer Security A - Lecture 7 Database Security

14. 14
STATISTICAL DATABASE EXAMPLE ….
ITSY3104 Computer Security A - Lecture 7 Database Security

15. Some Queries of a Statistical Database
15

16. 16
7.7 PROTECTING AGAINST INFERENCE
 SDB implementers have developed two distinct approaches to
protection of an SDB from inference attacks.
1. Query restriction:
 Rejects a query that can lead to a compromise.
 The answers provided are accurate.
 Query restriction techniques defend against inference by restricting
statistical queries so that they do not reveal user confidential
information.
 Restriction in this context simply means that some queries are
denied.
 The simplest form of query restriction is query size restriction.
ITSY3104 Computer Security A - Lecture 7 Database Security

17. 17
2. Perturbation:
 Provides answers to all queries, but the answers are approximate.
 Due to the addition of noise to the statistics generated from the
original data.
 This can be done in one of two ways:
1. Data Perturbation :
The data in the SDB can be modified (perturbed) so as to produce
statistics that cannot be used to infer values for individual records.
2. Output Perturbation :
 When a statistical query is made, the system can generate
statistics that are modified from those that the original database
would provide, again thwarting attempts to gain knowledge of
individual records.
ITSY3104 Computer Security A - Lecture 7 Database Security

18. 18
PROTECTING AGAINST INFERENCE….
ITSY3104 Computer Security A - Lecture 7 Database Security

19. 19
7.8 DATABASE ENCRYPTION
 Databases typical a valuable info resource
 Protected by multiple layers of security:
 Firewalls, Authentication, O/S Access Control Systems,
DB Access Control Systems, and Database Encryption
 Can encrypt
 Entire database - very inflexible and inefficient
 Individual fields - simple but inflexible
 Records (rows) or columns (attributes) - best
 also need attribute indexes to help data retrieval
ITSY3104 Computer Security A - Lecture 7 Database Security

20. ITSY3104 Computer Security A - Lecture 7 Database Security 20
Query
Processor
1. Original query
metadata
4. Plaintext
result
2. Transformed
query
3. Encrypted
result
Client
User
Data owner
Server
Encrypt/
Decrypt
Query
Executor
Meta
Data
Meta
Data
Encrypted
database
Data-
base

21. 21
 A database encryption example is depicted in Figure. Four
entities are involved:
1. Data owner: organization that produces the sensitive data.
2. User: that presents requests (queries) to the system.
3. Client: Front-end that transforms user queries into queries on
encrypted data
4. Server: that receives encrypted data from a data owner and
makes them available for distribution to clients.
The server could in fact be owned by the data owner but more
typically, is owned and maintained by an external provider.
Database Encryption…
ITSY3104 Computer Security A - Lecture 7 Database Security

22. 22
Database Encryption…
 A user at the client can retrieve a record from the database
with the following sequence:
1. The user issues an SQL query for fields from one or more
records with a specific value of the primary key.
2. The query processor at the client encrypts the primary key,
modifies the SQL query accordingly, and transmits the query
to the server.
3. The server processes the query using the encrypted value of
the primary key and returns the appropriate record or records.
4. The query processor decrypts the data and returns the results.
ITSY3104 Computer Security A - Lecture 7 Database Security

23. 7.9 SQL Injection Attacks (SQLi)
• One of the most prevalent and
dangerous network-based
security threats
• Designed to exploit the nature
of Web application pages
• Sends malicious SQL
commands to the database
server
• Most common attack goal is
bulk extraction of data
• Depending on the environment
SQL injection can also be
exploited to:
• Modify or delete data
• Execute arbitrary operating
system commands
• Launch denial-of-service
(DoS) attacks
ITSY3104 Computer Security A - Lecture 7 Database Security 23

24. Figure 5. 5 Typical S QL I njection Attack
Legend: .
Internet
Router
Firewall
Switch
Wireless
access point
Web servers
Web
application
server
Database servers
Database
Data exchanged
between hacker
and servers
Two-way traffic
between hacker
and Web server
Credit card data is
retrieved from
database
ITSY3104 Computer Security A - Lecture 7 Database Security 24

25. 7.9.1 Injection Technique
ITSY3104 Computer Security A - Lecture 7 Database Security 25

26. 7.9.2 SQLi Attack Avenues
• Attackers inject SQL commands by providing suitable crafted user input
User inputUser input
• Attackers can forge the values that are placed in HTTP and network headers and exploit this
vulnerability by placing data directly into the headers
Server variablesServer variables
• A malicious user could rely on data already present in the system or database to trigger an SQL
injection attack, so when the attack occurs, the input that modifies the query to cause an attack
does not come from the user, but from within the system itself
Second-order injectionSecond-order injection
• An attacker could alter cookies such that when the application server builds an SQL query
based on the cookie’s content, the structure and function of the query is modified
CookiesCookies
• Applying user input that constructs an attack outside the realm of web requests
Physical user inputPhysical user input
ITSY3104 Computer Security A - Lecture 7 Database Security 26

27. 7.9.3 SQLi Countermeasures
 Three types:
• Manual defensive
coding practices
• Parameterized query
insertion
• SQL DOM
Defensive
coding
Defensive
coding
• Signature based
• Anomaly based
• Code analysis
DetectionDetection • Check queries at
runtime to see if they
conform to a model
of expected queries
Run-time
prevention
Run-time
prevention
ITSY3104 Computer Security A - Lecture 7 Database Security 27