Lukas Raska, COO, APAC, ESET
When we give privacy or security advice, we usually talk about strong passwords, backing up your data, using security applications, keeping systems up to date, and avoiding default settings. In general, these are the most basic and essential precautions any systems manager must consider. However, depending on the system you want to protect, there are some additional issues to consider.
According to a survey by ESET on the cybersecurity state of SMBs in APAC, the average cost per breach is over US$36,000.Given the alarming frequency of information theft and leaks and high cost per breach, here are five key tips for keeping databases secure, especially when they are hosted in the cloud or by third-party providers.
1. Control Access to The Database
The saying “too many cooks spoil the broth” is spot on when it comes to information security. Very rarely do you get a positive result when lots of people meddle in something. Therefore, the more you limit permissions and privileges to your database, the better.
Rigorous access control is the first step to keeping attackers away from your information. In addition to basic system permissions, you should also consider:
• Limiting access to sensitive data for both users and procedures—in other words, only authorizing certain users and procedures to make queries relating to sensitive information.
• Limiting the use of key procedures to specific users only.
• Whenever possible, avoid simultaneous use and access outside normal or office hours.
It is also a good idea to disable all services and procedures that are not in use in order to prevent them from being attacked. Whenever possible, the database should also be located on a server that is not directly accessible from the internet as this prevents information from being exposed to remote attackers.
2. Identify Sensitive and Critical Data
The first step, before considering protection techniques and tools, is to analyze and identify what important information must be protected. To do so, it is important to understand the logic and architecture of the database, to make it easier to determine where and how sensitive data will be stored.
Not all data is critical or needs protection, so it is productive to spend time and resources on identifying on-sensitive information.
The first step, before considering protection techniques and tools, is to analyze and identify what important information must be protected
We also recommend keeping an inventory of the company databases, taking all departments into account. The only way to effectively administrate and avoid losing information is to keep a record of the entire company’s instances and databases.
What’s more, an inventory is particularly useful when doing an information backup and acts as an added measure to avoid missing critical data out during backup.
3. Encrypt information
Once the sensitive and confidential data have been identified, it is good practice to use robust algorithms to encrypt that data.
When an attacker exploits a vulnerability and gains access to a server or system, quite often the first thing they will try to steal is the databases. These are a valuable treasure, as they usually contain many gigabytes of important information. The best way to protect a database is to make it illegible to any person who accesses it without authorization. One measure organizations can adopt to prevent unauthorized access would be to implement two-factor authentication (2FA) solutions. In APAC, only 34 percent of SMBs have implemented 2FA solutions.
4. Anonymise non-production databases
Many companies invest time and resources in protecting their production databases, but when developing a project or creating a test environment, they simply make a copy of the original database and use it in environments that are not as tightly controlled.
Masking, or anonymization, is a process through which a similar version is created, maintaining the same structure as the original but modifying the sensitive data so that it remains protected. With this technique, values are changed while maintaining the format.
The data can be changed in different ways: mixing it together, encrypting it, mixing up the characters or substituting words. The specific method used and the rules and formats that need to be respected will be up to the administrator. Whatever method is used, it is critical to ensure the process is irreversible; that is, no amount of reverse engineering will enable anyone to obtain the original data again.
This technique is especially used - and recommended - for databases that are part of a testing and development environment because it allows you to preserve the logical structure of the data while ensuring that sensitive client information is not available outside the production environment.
5. Monitor your database activity
Being aware of auditing and recording actions and data movement means that you know what information has been handled, when and how, and by whom. Having a complete history of transactions allows you to understand data access and modification patterns, and thus avoid information leaks, control fraudulent changes and detect suspicious activity in real time.
Remember to follow these tips and be very careful when managing and protecting your databases. The information they hold is very valuable to the company and a very attractive prize for attackers, so it should definitely deserve your full attention.
