Database Security for 21st century business

Introduction

Most companies have servers for different purposes; however, the most critical servers any company has is the database servers. Data such as client details, financials, and human capital are the data that support any business in operations. For this reason, there is an increasing concern about the general protection of databases. Any breach of security would lead to either loss of data, exposure of sensitive data, unauthorized access to sensitive information or access to classified files. As companies develop, so is the need to secure the data stored within the databases. The benefits of controlled, protected access to the classified files as well as the preservation of the general integrity, standards and consistency of these data is much more expensive (Shamimabi, & Nicholas, 2008).

The concept of database security is much more focused on the, physical security, network security, encryption and authentication. The main constructs that the concept of database security thrives on includes confidentiality or protection from informal disclosure, integrity or prevention from illegal data access, and availability of equipment for identifying and recovering errors that might cause a denial of access to information. In the process of ensuring that the data stored are secure, most companies try to restrict access using software, reduce vulnerability, eliminate interference as well as upgrade their database auditing mechanisms.

Database security problems

Physical Commuters are becoming physically accessible to unauthorized users

Personnel Organizations are becoming more involved in system administration and database security

Procedural Most organizations have same people manage various operation of the database. This exposes the organization and its data to various risks, which necessitates the need for background checks.

Technical Storage, manipulation, and transmission of the data stored in the database. This needs safeguarding by technology that can enforce particular information control policies.

Database securities current and future trends

Database has undergone a number of metamorphoses; the main metamorphosis is the security lay out. Amongst these is the activity monitoring and blocking, classification, Encryption, consolidation, and configuration. However, organization can achieve these using various software. In this light, most companies dealing within database security have tried to developed software and application, but the most effective one is the product of oracle. it has solution for activity monitoring and blocking protection of databases irrespective of the platform is important, however, it should also be cost effective. Most companies use firewalls for windows based databases forgetting the vulnerability of their databases if open source software are used to hack into these databases (Shamimabi, & Nicholas, 2008).

The activities of the database on any network need monitoring to prevent any form of unauthorized access. Oracles have achieved this by preventing SQL injection and role escalations. Any database security system must prevent these in real time. The SQL grammar technology is an effective platform for reducing millions of SQL statement to few SQL characteristics. It has a high level of accuracy, performance and flexibility (Sandhu, 2008).

The system should be able to enforce white; lists and blacklists (positive and negative security model to provide protection without costly false positives. It should be able to allow for addressing SOX, PCI, HIPAA/HITECH, any other regulatory requirement. This should be easy to achieve without necessarily changing the existing databases.

Privileged User and Multi-Factor Access Control:

The cost of protecting corporate data should not be hefty therefore; organization should seek ways of protecting their data cheaply. The most trusted is the Oracle Database Vault; oracle database vault is an effective way by which organization can address regulatory directives. Organization also needs to secure their existing application, as is a mandatory requirement by some regulation of which Gramm-Leach-Bliley Act (GLBA) is the key. They call for separation of the duties from the any other activities related to data management with the aim of securing data and make certain that the veracity of data is managed. Organization face increased challenge of proactively safeguarding of their application data kept in their databases. In this way, organization will use data for the intended purpose and not adversely. Only Privileged database clients should only access data. This requires the need for multifactor policy within the organization that can control the level of access by use of any built in factor. This may include instance, IP address, application record, application bypasses as well as the authentification methods.

Data Classification:

Shamimabi, & Nicholas, (2005), argue that industry leading application software is important. The bottom line of any database security is to classify data effectively in order to mediate access to organization data stored within the databases irrespective of the classification. A good database security system should be seamless to meet all the level of security. Organizations specifically design these systems to meet the requirement of the multilevel security requirements. Organization need systems that can classify data to allow access based on need to know. In this way, organization can protect the privacy of their data and realize the regulatory compliances.  Label security should be integrated with identity management to enable centralized definition of the organization policy. The database systems should be able to support parent Data Encryption and offer hold up for PKI, Kerberos, and any other RADIUS-based well-built validation systems.

Sandhu, (2008), argues that database security should be cost effective and comply with various privacy and regulatory requirement such as the Sarbanes-Oxley, or the Payment Card Industry (PCI) and even the latest Data Security Standard (DSS). However, the Health Insurance Portability and Accountability Act (HIPAA), is a new regulatory mandate, which might require constant upgrading necessitating the need for flexibility and compatibility of systems. Customers should be able to transparently encrypt any of their application data and other sensitive columns like their credit card numbers social security and PIN numbers while in the database as well as in back up devices or even over then networks. The systems need to be cost effective.

Consolidated Auditing And Reporting:

There are many insider threats that most organizations phase. However, databases security systems need to automatically collect and consolidate the audits that the organization carries out in search of quality and total security. Organization are in need of systems that offer them secure and scalable audit warehouses that also enable simplified recording and automating the collection and final consolidation of audit data. Organization need to control database audit centrally and managed from within the database security system to reduce the cost related to IT security.

Secure Configuration Management,

According to Baker, et al, (2009), organization should be ready to increase the level of the database security and compliance with the IT control frameworks. This includes frameworks like Control Objectives for Information and related Technology: (COBIT), global directives require internal control, database security configuration management global directives. It should enhance discovery, and vulnerability scanning while ensuring compliance benchmarking, including any other functionality such as central management of database configuration. Organizations require this to detect and prevent configuration drift in the databases. Organizations should also have systems that can alert them in case of critical patches issued by various security framework developers. This, might help in invoking a patch wizard that automatically deploys patches and ensure that application databases within organizations are always updated and secure from unauthorized access (Bertino, Byun, & Kamra, 2007)..

Data Masking

There is increasing need for marking of sensitive information by replacing them realistic values. In this way, organization can use production data for the purpose of analysis, development, and even sharing with the out-sourced partners. Organization can also share these data with offshore partners as well. This might apply the use of templates readily available in libraries and the format rules. This consistently transforms data with the view of maintaining referential integrity for all application used within the organization.

Conclusion

While protecting the database from intrusion is important, it is also important to underscore the need for management restrain and controlled access. This will go a long way in ensuring that the company has the best protection from espionage, hacking, data leaks and data theft. The main database protraction platforms include oracle.

References

Baker, H., Hutton, A., Hylender, D., Novak, C., Porter, C., Sartin, B., Tippett, P., & Valentine, (2009). The 2009 data breach investigations report. Verizon Business. Retrieved January 31, 2010,

Bertino, E., Byun, J., & Kamra, A. (2007). Database security. security, privacy, and trust in modern data management (Data-centric systems and applications) (pp. 87-102).New York: Springer-Verlag.

Sandhu R., (2009). Database security concepts, approaches, and challenges: IEEE Dependable secure computing

Shamimabi P., & Nicholas R., (2008).Protocol engineering for web service conversations: journal of Engineering Applications of Artificial Intelligence, Special Issue on Agent-oriented Software Development