Computer Security: Principles and Practice Chapter 5

Database

A structured collection of data stored for use by one or more applications

Database Management System (DBMS)

A suite of programs for constructing and maintaining the database and for offering ad hoc query facilities to multiple users and applications

Database

A structured collection of data stored for use by one or more applications

Database Management System (DBMS)

A suite of programs for constructing and maintaining the database and for offering ad hoc query facilities to multiple users and applications

Query Language

Provides a uniform interface to the database for users and applications

Relation

A flat table

Tuples

Are rows

Attributes

Are columns

Primary Key

Is a portion of a row to be used to uniquely identify a row in a table

Foreign Key

Creates a relationship between two tables. Appears as attributes in another table

View

A virtual table. The result of a query that returns selected rows and columns from one or more tables

SQL

A query language. Stands for Structured Query Language

SQLi User Input

Attackers inject SQL commands via suitably crafted user input

SQLi Server Variables

Attackers forge values that are placed in HTTP and network headers. When the query to log the server variable is issued to the database, the attack in the forged header is triggered

SQLi Second-order Injection

Attack occurs when incomplete prevention mechanisms against attacks are in place. Malicious user relies on data that is already present within the system. So when the input modifies the query, it causes an attack that doesn't come from the user, but the system itself

SQLi Cookies

Attacker modifies cookies, to create a query based on the cookies content

SQLi Physical User Input

SQL injection that is made possible by supplying user inputs that construct an attack outside the realm of web requests. This input could take many forms, such as barcodes, RFID, or even paper forms which are scanned using optical character recognition

Inband Attack

An attack that used the same communication for injecting code and retrieving results

Tautology (Inband)

Injects code in one or more conditional statements so they always evaluate to true to circumvent security measures

End-of-line Comment (Inband)

Injecting code into a a field and adding a legitimate code into the comments

Piggybacked Queries

Attack adds additional queries beyond the intended query. Adding an attack on top of the legitimate request allowing several queries at once

Inferential Attack

No transfer of data is made, but the attacker is able to reconstruct the info by sending requests and observing the behavior of the Website or Database

Illegal/Logically incorrect Queries (Infer)

Gathers information via error messages returned by the server. This often reveals vulnerabilities and injection parameters

Blind SQL Injection (Infer)

Series of true false questions are asked in order to damage site functionality when statement evaluates to false

Out of Band Attack

Data retrieval is made using a different channel. Such as an email sending query results

Defensive Coding

An effective way to dramatically reduce threats from SQLi

Manual Defensive Coding Practices

Straightforward approach to eliminating vulnerabilities by checking input type. Also covers pattern matching to distinguish normal inputs and abnormal

Parameterized Query Insertion

Prevents SQLi by creating predefined query structures and only passing value parameters. Query structures cannot be modified

SQL DOM

Automated datatype evaluation. Encapsulates queries to provide safe and reliable way to access databases. Developers are able to systematically apply coding best practices such as input filtering and rigorous type checking of input

Detection

Allows attacks to be found and dealt with

Signature Based (Detection)

Matches specific attack patterns. Constantly updated and does not work against self modifying attacks

Anomaly Based (Detection)

Defines normal behavior and detects outside behaviors. Requires a training phase in which users train the system

Code Analysis (Detection)

Test Suite is used to detect SQLi vulnerabilities. Generates wide variety of attacks and assesses the response of the system

Run-time Prevention

Techniques o the check queries at run-time to see if they conform to a model of expected queries (CHAN12, SHAR13)

Centralized Administration

Small number of privileged user may grant and revoke access rights

Ownership-based Administration

The owner(creator) of a table may grant and revoke access rights to a table

Decentralized Administration

In addition to granting and revoking rights to a table, the owner may grant and revoke authorization rights to other users, allowing them to grant and revoke access rights to a table.

Application Owner

An end user who owns database objects (tables, columns, rows) as part of an application. Database objects are generated by the application or are prepared for use by the application

End User Other Than Application Owner

An end user who operates on database objects via a particular application but does not own any of the database objects

Administrator

Has administrative responsibility for part or all of the database

Fixed Server Roles

Defined at server level and exist independently of any user database. These roles have different permission and are designed to spread administrative abilities without giving complete control over an entire server

Fixed Database Roles

Operate at the level of an individual database. Delegates different admin responsibilities without giving complete control over a single database

User-defined Roles

Customized roles defined by authorized users. These roles may require passwords

Inference Channel

Information transfer path by which unauthorized data is obtained

Inference Detection During Database Design

Removes inference channel by altering the database structure or by changing the access control scheme

Inference Detection At Query Time

Eliminates inference during queries. If inference is detected the query is denied or altered

Key Management

Disadvantage to Encryption: Authorized users must have access to decryption key in order to access database

Inflexible

Disadvantage to Encryption: More difficult to perform searching

User

Human entity presenting requests to the system.

Data Owner

An organization that produced data to be made available for controlled release, either within the organization or for external users

Client

Front end that transforms user queries into queries on the encrypted data stored on the server

Server

An organization that receives the encrypted data from a data owner and makes it available for distribution to clients

Essential Characteristics

Broad Network Access

Rapid Elasticity

Measured Service

On-demand Self-service

Resource Pooling

Service Models

Software as a service (Saas)

Platform as a service (PaaS)

Infrastructure service (Iaas)

Deployment Models

Public Cloud

Private Cloud

Community Cloud

Hybrid Cloud