Database Security 3.0

RSA is here

Byamba is back and entertaining the crowds here at RSA in San Fran. Stop by our booth at 2539 and take a photo. Mention this post to Jeff or Jen and get a free hat.

Jeff Coveney



Sent via wireless BlackBerry. Please excuse brevity or typos.

Mass 201 - Ten Days and Counting

What is Mass 201 and how does it affect your database security requirements?

In an effort to protect Massachusetts residents from fraud and identity theft associated with the theft of sensitive data, the State of Massachusetts has implemented anew regulatory requirements to protect personal information. Effective March 1, 2010, the state will require mandatory compliance with 201 CMR 17.00 - Standards for the Protection of Personal Information of Residents of the Commonwealth (also known as just 201 CMR 17, or the Massachusetts Privacy Law). The Massachusetts Privacy Law establishes a minimum standard to be met for the protection of Massachusetts resident’s personal information (PI). The legislation addresses information contained in both paper and electronic records. For the purpose of being compliant with the new Massachusetts data privacy law, PI is defined as a resident's first name and last name or first initial and last name in combination with any of the following:

1) Social Security Numbers
2) Drivers License or MA ID Numbers
3) Financial Account Numbers, Credit Card Numbers, Debit Card Numbers
4) Biometric Indicators

The following excerpt describing security requirements has been cut and pasted directly from the bill:

17.04: Computer System Security Requirements
Every person that owns or licenses personal information about a resident of the Commonwealth and electronically stores or transmits such information shall include in its written, comprehensive information security program the establishment and maintenance of a security system covering its computers, including any wireless system, that, at a minimum, and to the extent technically feasible, shall have the following elements:
(1) Secure user authentication protocols including:
(a) control of user IDs and other identifiers;
(b) a reasonably secure method of assigning and selecting passwords, or use of unique identifier technologies, such as biometrics or token devices;
(c) control of data security passwords to ensure that such passwords are kept in a location and/or format that does not compromise the security of the data they protect;
(d) restricting access to active users and active user accounts only; and
(e) blocking access to user identification after multiple unsuccessful attempts to gain access or the limitation placed on access for the particular system;
(2) Secure access control measures that:
(a) restrict access to records and files containing personal information to those who need such information to perform their job duties; and
(b) assign unique identifications plus passwords, which are not vendor supplied default passwords, to each person with computer access, that are reasonably designed to maintain the integrity of the security of the access controls;
(3)Encryption of all transmitted records and files containing personal information that will travel across public networks, and encryption of all data containing personal information to be transmitted wirelessly.
(4) Reasonable monitoring of systems, for unauthorized use of or access to personal information;
(5) Encryption of all personal information stored on laptops or other portable devices;
(6) For files containing personal information on a system that is connected to the Internet, there must be reasonably up-to-date firewall protection and operating system security patches, reasonably designed to maintain the integrity of the personal information.
(7) Reasonably up-to-date versions of system security agent software which must include malware protection and reasonably up-to-date patches and virus definitions, or a version of such software that can still be supported with up-to-date patches and virus definitions, and is set to receive the most current security updates on a regular basis.
(8) Education and training of employees on the proper use of the computer security system and the importance of personal information security.

This is strong legislation and an important step towards securing sensitive data. I've talked to a lot of merchants in the past few weeks and it seems that many have only heard of the requirements in the past few weeks. This last minute awareness, especially among small to medium sized merchants has resulted in a lot of calls to lawyers and security experts. Fortunately there are automated solutons available to help organizations meet the requirements of this legislation - and obvioulsy AppSec is one of the vendors that is here to help.

To find out how AppSec and assist you in meeting the requirements of Mass 201, CMR 17, give us a call.

Litchfield DBMS_JVM_EXP_PERMS 0-day on Oracle

At last week’s BlackHat D.C., David Litchfield revealed 0-day vulnerabilities in Aurora, the Java implementation built into Oracle.

Vulnerabilities in the following packages:

• DBMS_JAVA
• DBMS_JAVA_TEST
• DBMS_JVM_EXP_PERMS
  

allow an attacker to escalate their privileges to sysdba and take complete control of the database. It was successfully demonstrated how a low privileged user can grant themselves sysdba privileges, access on every file on the Oracle host server and execute those files, including a shell. It was also shown how to load binary code into the Oracle process and execute it. Finally a way to bypass Oracle Label Security was demonstrated.

There is currently no fix available from Oracle, however Oracle’s access control features allow for a workaround. By default EXECUTE is granted to PUBLIC for the above mentioned packages.

In order to protect against these current threats, database administrators should revoke execution privileges on these packages from PUBLIC and any other user that does not require them. The AppDetective and DbProtect ‘Object privilege granted to PUBLIC’ Oracle Vulnerability Assessment checks can be used to help find and remediate these privileges.

Application Security has also made available for download a custom policy and check to specifically find these privileges and learn if your Oracle databases are vulnerable. With Application Security, Inc.’s User Rights Review (URR) platform, customers will also be able to determine which users can exploit the vulnerability as well as an explanation of how to fix the vulnerability.

Team SHATTER also suggests adhering to the following general security considerations to minimize the risk of new attacks like this:

• Always stay up-to-date on the latest security patches
• Minimize the attack surface by only installing and enabling functionality that is required for the business task
• Remove all unused default components, accounts and databases
• Assign only minimal privileges required
• Assign privileges through roles, not directly to users

Related links:
SHATTER Security Bulletin

How Do You Assess Your Vulnerability Management Profile?

It’s interesting today when you’re thumbing through analyst reports and the like to find what the hot trends in security and compliance are. Sometimes you feel as though you never really find what you are looking for, exactly.

Dark Reading recently created some Tech Centers that address very specific IT Security and Compliance components with news and analysis. Real analysis, it’s cool.

The freshly minted Vulnerability Management Tech Center published a report from InformationWeek Analytics that recommends a very straight-forward process by which organizations can address overall vulnerability management. (You have to register and its free)

What’s unique about this report is that it looks through a regulatory lens, keeping continuous compliance the goal. It’s also chock full ‘o survey data, we at AppSec love. But what is interesting about Richard  Dreger’s report is that you could pull this up and use it as a quick-reference guide to check your steps throughout an implementation process.

Here’s a few highlights:

· Of the 379 business professionals surveyed, 65% cited HIPAA as the most common regulatory requirement they are concerned with.

· 35% of organizations say they have 4+ regulations their companies are required to comply with.

· As far as compliance drivers, 59% say they fear legal ramifications being found in non-compliance. 38% fear negative audit results, 36% fear negative publicity. That’s a lot of fear, and it proves fear still makes companies do stuff.

· But you have to get down to the 36% who want to implement a comprehensive security program where you scratch your head. Why isn’t this the number one driver? Just speaks to how folks want to avoid interim strikes against them but have no intention of being proactive.

· As for recommendations, starting at the security level is good – and integrating operational guys, technical guys and management into the process is key – agreed.

· At this point I won’t give the whole thing away – but the recommended process is excellent, starting with knowing your goals, an initial configuration check, discovery, deep testing, pen testing your environment for proactive security and compliance – and finally reporting.

· The most telling figure is that only 23% of respondents said their info sec program is very secure and well-documented.

Check this report out and tell these guys they created a nice resource for our market.

How Do You Protect 27% of the World’s Wealth?

An interesting story broke today that is flying under the radar. It’s being reported that Swiss Banks are in conversations with the government on sharing sensitive data. Switzerland has been called out by France for the lack of a cohesive policy around how they share highly confidential customer information.

The bulk of this discussion centers around taxes, and how foreign tax authorities are requiring information – basically because Switzerland had to make some deals with the UK, US and France to stave off a blacklisting by the OECG as being a tax haven for evasion.

What’s interesting are the data security challenges associated with whatever mandate the Swiss government enacts. Why? Because 27% of the world’s privately vested offshore wealth resides in Swiss bank accounts. Not a small chunk of change. And likely a LOT of data.

Guess where the data at most of those Swiss banks probably lives? Oh yes, multiple databases. And guess where the most coveted information exists? You guessed it, in those databases.

But the million-dollar question is do all those banks have the right database controls and protection deployed so that they can ensure that confidential information remains confidential? And will the Swiss government require the right levels of protection to comply? And once they roll out the requirements (and its announced publicly) will the hacker community pounce on it, knowing some of the banks won’t implement what they need to during this equivalent of a patch gap? Probably.

This all speaks to the issue of continuous compliance in the database and the need for a methodology that should enable an organization to know what the audit result will be before that database is audited. And it speaks to the need for the right combination of scanning and monitoring functionality to avoid that ‘gap’ which can leave systems extremely vulnerable to attack.

Only As Strong As The Weakest Link

By now we have all heard about how hacker, Albert Gonzales, and a cohort of his victimized Heartland Payment Systems, Hannaford Brothers, 7-Eleven by stealing over 130 million credit and debit card numbers by exploiting SQL Injection vulnerabilities.  The same hacker is also accused of breaching TJX Companies, Dave & Busters, and the Boston Market chains.

Because of the enormous size of the breaches, there have been a number of lively responses by the security and compliance industry regarding the technical details of the breaches as well as renewed scrutiny of the industry PCI-DSS regulation.  Details are sketchy but one thing we know for certain is that it starts with an exposed application and a database.  The rest of the breach involves getting into the network and navigating around, which brings me to my point.  Security pundits have taken to heart long ago that your IT environment is only as strong as your weakest link.  In these cases, the entry point to the network was though the application and the database, but the anatomy of the attack certainly went well beyond that.  They got into the network, installed software, and presumably navigated around the corporate network performing reconnaissance, before digging for the payload, getting it out and covering their tracks.  Once a hacker gets in, they start to exploit found vulnerabilities to take on the credentials of privileged applications, and armed with what is pretty much a fake passport, digitally travel around the corporate network.

We work with many companies on their security & compliance programs and one thing everyone tries to do is to reduce the scope of what needs to be protected-- draw a circle around a defined set of systems and apply specific controls to them.  It's the practical thing to do because a company only has so many resources. This is done by identifying the systems and applications that house the most critical information-- usually systems that contain information that is regulated by SOX, PCI, HIPAA, FISMA, etc.  But one area that tends to be forgotten is that networks are connected, and the network is "only as strong as its weakest link." We always have to remain keenly aware that threats can start outside of the scoped network, and any vulnerabilities or misconfigurations, is fair game to a person with malicious intentions.  So remember to consider and keep connected networks just as secured.

It is certainly not hopeless.  Today's existing technology combined with security best practices are up to the task today.  Companies just need to apply it, and certainly most don't do enough today.

$25.95 is all it takes…

Let's get this straight – insurgents in Iraq made a monumental hack last week into our military’s communications system that powers the Predator drones. These drones are perhaps one of the more effective weapons used in modern warfare to monitor areas and movements of the enemy.

But now with SkyGrabber, a Russian-developed, offline satellite internet downloader, which can be purchased for the low, low price of $25.95, you can put yourself on the path toward intercepting messages and information that have traditionally given the U.S. the leading edge in intelligence and surveillance.

That’s right, the Russian-developed program is all it takes. But this is just the tip of the iceberg. It’s been reported this year that U.S. military systems are fending off close to 3 million probes on its systems every day.

This speaks to the fact that even sophisticated criminals, have demonstrated an unyielding thirst for information, whether they’re attacking corporate networks, storefront systems or military systems.

To quote Brian Krebs, who writes the Security Fix blog for the Washington Post, “I’ve said it before, and I’ll say it again: cyber gets no respect until people start dying because of vulnerabilities.” Maybe a hack like this will put things in perspective to wrap up a year that saw over 220 million records stolen because of vulnerable systems – someone out there is making a lot of money.

Is it possible we have hit the crisis point?

Our annual study with Enterprise Strategy Group usually generates a lot of buzz around what firms aren't doing to protect their most critical applications that house sensitive information - you guessed it, the database.

But what we've seen in our survey that we launched today isn't just a bunch of statistics – it’s a grim reminder that we are facing perhaps the worst of threats to our confidential data, and there are things we are either overlooking, don't understand...or, simply doing nothing about.

We polled 175 IT Security execs at large organizations, and based on some of the staggering numbers, it’s possible we may have a crisis on our hands...

The study reveals that 60% of organizations don’t feel their existing database controls adequately protect their organization’s confidential data. Coming from security executives, this doesn't inspire a lot of confidence.

In addition, the data reports that nearly 70% of organizations do not feel that their existing database controls are well-defined. Again, considering the source, if controls aren't spelled out and communicated appropriately, how can IT Security even do its job?

The survey reveals that despite the fact that over two-thirds of organizations are spending moderate to significant amounts of time writing custom scripts, remediating compliance issues, and engaging in associated tasks - which means costly manual processes are the norm. 

38% of organizations still failed database security audits, which tells us that while companies may be better this year in identifying database audits as important, they aren't taking a continuous approach to compliance. Therefore they may be passing one audit, but what happens in the next one a month or even a week later? 

The study further reveals the troubling statistic that less than 4% of IT budgets are spent protecting the data where it lives – in the database. Why is it troubling? Well, if companies looked at their overall IT Security spend and re-prioritized their misplaced spending, they'd be able to ground both their compliance initiatives and protections in the database.

 

IBM's Guardium acquisition

By acquiring Guardium at such a significant multiple, IBM has validated the database security, risk and compliance marketplace. However, this acquisition adds yet another point solution to their already disparate database tools portfolio, and such an "rfp check box" architecture approach will not satisfy the integrated platform requirements of serious customers seeking enterprise wide data governance.      

- John Ottman, President & CEO, Application Security, Inc.

Stolen Customer Data Indicates Things Are Getting Worse

 The recent insider attack at T-Mobile where an employee stole personal details of thousands of mobile phone customers and was sold to its competitors is the biggest data breach of its kind, according to the Guardian.

This breach isn’t shocking given that the threat environment has seen a massive uptick in recent weeks. Malicious insiders are the root cause of approximately 75% of all breaches - especially in the still-dire economy, people are disgruntled and are looking to capitalize on the sensitive enterprise data that they may have access to.

What’s compelling is that the breach put T-Mobile’s customer information directly in the hands of their competitors in the UK. So now, their competitors know when customer contracts are expiring – so there is a major risk for loss of revenue.

What’s perhaps more scary, and it’s probably too early to tell, is that the customer info being leaked to competitors is bad, but the potential for fraudulent activity is likely very high. So now T-Mobile is going to have to undertake a massive effort at a massive cost to somehow curb the effect of this thing. 

Is there a silver bullet to stop data loss on such a large scale? Well, a few things have to be considered.  First, a thorough review of access controls on the database regularly is critical to maintaining a protected DBMS environment - and passing database audits.

Second, there is something to be said for knowing what those with access are up to. So database activity monitoring would have alerted administrators that inappropriate activity was happening, which would have in turn allowed administrators and management to take corrective action immediately.

IOUG also reported a 50% increase in breaches from 2007 to 2008, and that about 35% of organizations have their databases are configured securely. With only one in four databases protected, clearly, this is an enormous issue, possibly that contributed this breach, although it seems it was a number of factors.

Organizations really have to look at database security, risk and compliance as an ongoing, continuous and business-critical process that doesn't start when you are breached – it needs to be driven by the security organization with management.  We wish them luck and hope they call us to help!

Authorized Database Roles - Where do they go when someone leaves?

By now you know the drill - another data breach, more identity theft, more records potentially compromised. MassMutual experienced a database breach of employee information over the weekend through a contracted vendor database.

There's some information that's come to the surface already, and it appears they've been able to curb the damages and take the proactive steps to protect employees.

What this breach underscores is the fact that organizations are still not taking the right steps to protect sensitive, confidential information in a comprehensive way. What also persists to be a major issue is the lack of segregation of duties in the database.

As the unemployment rate hovers around 10% and organizations are still slashing headcount, roles and privileges to data still exist, possibly even if that employee has been let go, has moved on or has been reassigned. When those access controls still exist, organizations are at risk.

Databases contain sensitive information are large, enterprise organizations. 99% of enterprise data exists in some form inside a database. Yet with breach numbers up to 340,102,273 you'd think there would be a massive call to action for organizations who have are facing a radically scaled-up threat environment.

Now Showing...The Unprotected!

Its not everyday you see an enterprise software organization have this much fun...or be this creative...but that's just us! Today we launched a new, original dramatic Web film series entitled “The Unprotected.”   Echoing the gritty, fast-paced, dramatic style of "The Wire" and "24", the five-part "webisodic" series highlights real world database security, risk and compliance issues that enterprise organizations face every day.

“The Unprotected" is the first film project developed by Application Security, Inc. The trailer can be viewed immediately and the pilot episode will debut on October 19, with weekly releases of new “webisodes” through mid-November. I mean, we have to keep you in suspense...

The Unprotected" tells the story of Greencrest Financial, a financial services firm that must achieve compliance by the end of the quarter. Unfortunately, Greencrest is failing its audit and also realized they were hacked, compromising tens of thousands of sensitive customer records.

For more information on our exciting new film series, visit www.theunprotected.net yourself, and check out the press release.