3 Steps To Make Your Database More Secure

Database security often takes a backseat to performance and other concerns. Heres how to strike a balance that works.

Download the entire
InformationWeek
supplement
, distributed in an all-digital format as part of our
Green Initiative
(Registration required.)
We will plant a tree for each of the first 5,000 downloads.
Sound IT risk management is all about identifying critical data assets and giving them the most protection. The more critical an asset, the more defenses should be around it. Unfortunately, when it comes to databases, most companies get that formula backward.
The problem is that database performance can take priority over security at many companies. Rather than balancing security and performance issues, database security is too often left for some other time.
DBAs and the application developers just dont have time or dont want to deal with security. It increases the cost of their product development, says Julie Lockner, an analyst at research firm Enterprise Strategy Group. Theyre being asked to add more applications and features, and deal with rising data volume, and thats making their test cycles longer. Says Lockner: Its a priority thing: Do we get the features out? Or do we take the extra cycles to tie in and add the security layers around it?
Malicious insiders and wily hackers can take advantage of this priority war within IT departments. Theyre accessing data they shouldnt, launching SQL injection attacks to take advantage of poorly protected app-to-database links, and exploiting vulnerabilities in database management systems to get into potentially huge and valuable data stores.
The only way to truly protect data is to make critical database security a top concern. It starts with these three principles of database protection.
Know Thyself
Many companies arent able to protect mission-critical data because they simply dont understand how all the moving parts of their database environments work. For controls to work, IT must have a clear understanding of where the important data is, whos using it, and how its being used.
You have one data store, but you might have many applications hooked into it. You might not know who it is thats using the systems if youve given out a lot of privileges, says Mel Shakir, CTO of NitroSecurity, a database activity monitoring (DAM) and security information and event monitoring company recently purchased by McAfee. And you might not even know where the critical data is if its been copied off the system and moved to, say, test databases somewhere else.
Valuable steps include scanning for unsanctioned, rogue databases that might have been set up on the fly by other departments, documenting privilege schemas, and classifying a companys database assets by risk according to the type of data they hold. That can help get more out of database security investments.
Once IT teams know where all your databases are, they can make sure theyre securely configured and patched, and use vulnerability assessment to decide what level of protection they need. For example, they can decide if they warrant constant oversight through activity-monitoring software to track what users are doing in these data stores at all times.
To read the rest of the article,
Download the Oct. 31, 2011
InformationWeek
digital supplement

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
3 Steps To Make Your Database More Secure