Hackers often target databases as they store sensitive information such as credit card details and personal identities. That is why database security should not be taken lightly and organizations need to reinforce their database security and safety to make sure they can recover them when an intentional or accidental incident occurs.
Given the significant rise in both volume and sophistication of cyber threats, companies are increasingly more exposed to data breaches and ransomware attacks. Hackers often target databases as they store sensitive information such as credit card details and personal identities. That is why database security should not be taken lightly and organizations need to reinforce their database security and safety to make sure they can recover them when an intentional or accidental incident occurs.
What is Database Security?
Database security refers to the process of protecting your most valuable business assets against system failure, unauthorized use, and malicious threats.
It involves a large scope of tools, methodologies, processes, and people to protect data within your environment and throughout its lifecycle. Additionally, the laws on database security and data protection are strictly regulated with severe penalties if businesses fail to comply with the required standards.
Database security is therefore not a simple undertaking, it requires an ongoing team’s effort to ensure its efficiency and consistency.
Why is data security important?
Implementing a strong data security strategy can be a key business differentiator since consumers pay increasingly more attention to their data protection and privacy.
For businesses, data is a critical success factor as it enables them to personalize their customer’s experience but can also be a hassle to protect. Modern workplace practices such as remote working, mobile devices, and public network connections have increased the risk of a data breach.
Technology and business leaders are perfectly aware of this and so are cybercriminals.
So, what is truly at risk?
- Personal health records
- Financial transactions and data
- Banking information
- Insurance information
- Criminal justice records
- Personal communications
- Intellectual Property (IP)
- Etc.
The aftermath of a data breach can be disastrous for businesses. Not only on the operational side as it will involve a business disruption but more importantly on the communication and financial sides. A data breach can seriously tarnish a brand reputation and cause a significant revenue loss.
Consequently, data security is crucial for organizations to remain compliant, protect their reputation and finances, and retain their customers.
What are the Most Common Database Security Issues and Best Practices?
1. Failure during Deployment
During the deployment phase, many businesses neglect how their database is set up to run in production environments which leads to many issues linked to security. Many corporations do not restrict application or personnel access to the development, test, UAT environments. Subsequently when the application is rolled out to the production environment, where security is correctly configured to a least privilege model, it fails to perform as expected. All database environments should have their security configured in an identical fashion. This will ensure that the application will have the access it requires and nothing more.
Even though functional testing and other types of software testing are performed on the to-be-deployed application, these tests don’t check the database security. This testing is for the usability of the application not the security of the database. Therefore, it is paramount to test the to-be-deployed application and supporting database with several tests such as penetration and security tests. These tests will ensure there is no gap in the database such as misconfiguration that might be used by hackers to break in.
2. Poor password management
Poor password management remains a top threat to database security. Despite the warnings over password security, over 70% of employees reuse passwords at work according to a recent Verizon Data Breach Investigations Report. The report also found that 81% of hacking-related breaches were due to stolen and/or weak passwords. Educating and training employees will help prevent stealing passwords but better yet is instituting multi-factor authentication.
3. Weak Encryption
Obsolete or incorrect use of encryption algorithms might lead to sensitive data exposure, broken authentication or key leakage. According to the 2019 Thales Global Cloud Security Study, only 49% of organizations are encrypting sensitive data in their data repositories, regardless of where it is located. If encryption is not done properly, this can jeopardize your database security. Consequently, hiring seasoned database developers is important to prevent this type of issue.
4. Excessive User Privileges
Most of the time, system administrators grant employees unnecessary database privileges. This happens when employees need more access rights to complete a task and the administrator fails to remove these additional privileges later and make the appropriate controls to monitor the activity of these privileged users. Over time, excessive privilege can pile up and lead to serious security issues. According to Centrify’s Privileged Access Management in the Modern Threatscape survey, 74% of data breaches start with privileged credential abuse. Yet, most organizations do not take any steps to prevent excessive user privileges. Something as simple as implementing the Least Privilege Principle in Active Directory can protect your data.
This should be applied across all database environments as most corporations re-use copies of their production databases in lower level database environments. This ensures that when developing or testing changes any database model changes are incorporated as well. But generally, security is not a concern in these non-production environments. The data may only be a few days old and it is left far more open as it is not in “production” and therefore not at risk.
5. SQL Injections
SQL injections involve an attacker inserting malicious SQL into a web application database query to take complete control over your database. The best ways to protect against these threats are to regularly test your applications using both static and dynamic testing as well as enforcing least privilege on your database.
6. Poor Patch Management
In 2017, Equifax, one of the three largest consumer credit reporting agencies revealed that it had lost the personal data of 147 million people. What caused this breach? The attackers exploited a weakness in the Apache Struts software which was not patched and updated accordingly. Unfortunately, poor patch management happens more often than we think.
According to a ServiceNow study, 60% of breaches in 2019 involved vulnerabilities where patches were not applied. Manual updates can be tedious, but they are absolutely critical to the environment’s health and should be a regularly scheduled process.
7. Inadequate Data Backup
Critical data loss can be catastrophic for businesses. As a matter of fact, 94% of companies don’t survive after a major data loss incident. Yet, many businesses still have an inadequate backup facility or procedures in place.
A robust data backup strategy involves taking regular database backups offline/offsite or in the cloud to provide frequent restore points. Two questions need to be answered to ensure that the backup strategy is meeting your needs. What is the RTO (Recovery Time Objective), basically this is how long do you want to be down for? This will help to determine if you require to keep recent backups close to the database server as well as off-site. What is the RPO (Recovery Point Objective), basically this is how much data you are comfortable losing in the event of a critical failure. This in turn will drive your recovery model and frequency of data and log file backups.
As well, ensure that the System databases are using a full recovery model and that both the data and log files are backed up frequently. The Master and MSDB databases are critical to the database server and it’s processes, without them there is no database server.
8. Inconsistencies in Databases
Irregularities in databases often lead to vulnerabilities. Test website security and assure data protection on the regular basis. If any inconsistencies are found, they need to be fixed to avoid threats.
Database security should always be a pressing concern. In order to help you keep your corporate assets safe, we have put together three database security checklists to prepare you for the most important security items to examine and ensure you are prepared for any attacks or incidents.
Written By:
Caroline Blivet
As Softlanding's Marketing Lead, Caroline and is responsible for driving lead generation, developing a go-to-market strategy and, delivering marketing campaigns. Outside of work, Caroline enjoys hiking the beautiful trails of British Columbia.
More By This Author
