Protect Your Databases by Detecting Suspicious Activity

by Apr 16, 2020

Categories

Tags

Administration agent-based monitoring Agentless Monitoring alert responses alert thresholds alerting Alerts Amazon Aurora Amazon EC2 Amazon RDS Amazon RDS / Aurora Amazon RDS for SQL Server Amazon Redshift Amazon S3 Amazon Web Services (AWS) Analytics application monitoring Aqua Data Studio automation availability Azure Azure SQL Database azure sql managed instance Azure VM backup Backup and recovery backup and restore backup compression backup status Backup Strategy backups big data Blocking bug fixes business architecture business data objects business intelligence business process modeling business process models capacity planning change management cloud cloud database cloud database monitoring cloud infrastructure cloud migration cloud providers Cloud Readiness Cloud Services cloud storage cloud virtual machine cloud VM clusters code completion collaboration compliance compliance audit compliance audits compliance manager compliance reporting conference configuration connect to database cpu Cross Platform custom counters Custom Views customer survey customer testimonials Dark Theme dashboards data analysis Data Analytics data architect data architecture data breaches Data Collector data governance data lakes data lineage data management data model data modeler data modeling data models data privacy data protection data security data security measures data sources data visualization data warehouse database database administration database administrator database automation database backup database backups database capacity database changes database community database connection database design database developer database developers database development database diversity Database Engine Tuning Advisor database fragmentation database GUI database IDE database indexes database inventory management database locks database management database migration database monitoring database navigation database optimization database performance Database Permissions database platforms database profiling database queries database recovery database replication database restore database schema database security database support database synchronization database tools database transactions database tuning database-as-a-service databases DB Change Manager DB Optimizer DB PowerStudio DB2 DBA DBaaS DBArtisan dBase DBMS DDL Debugging defragmentation Demo diagnostic manager diagnostics dimensional modeling disaster recovery Download drills embedded database Encryption End-user Experience entity-relationship model ER/Studio ER/Studio Data Architect ER/Studio Enterprise Team Edition events execution plans free tools galera cluster GDPR Getting Started Git GitHub Google Cloud Hadoop Healthcare high availability HIPAA Hive hybrid clouds Hyper-V IDERA IDERA ACE Index Analyzer index optimization infrastructure as a service (IaaS) infrastructure monitoring installation Integrated Development Environment interbase Inventory Manager IT infrastructure Java JD Edwards JSON licensing load test load testing logical data model macOS macros managed cloud database managed cloud databases MariaDB memory memorystorage memoryusage metadata metric baselines metric thresholds Microsoft Azure Microsoft Azure SQL Database Microsoft PowerShell Microsoft SQL Server Microsoft Windows MongoDB monitoring Monitoring Tools Monyog multiple platforms MySQL news newsletter NoSQL Notifications odbc optimization Oracle PeopleSoft performance Performance Dashboards performance metrics performance monitoring performance schema performance tuning personally identifiable information physical data model Platform platform as a service (PaaS) PostgreSQL Precise Precise for Databases Precise for Oracle Precise for SQL Server Precise Management Database (PMDB) product updates Project Migration public clouds Query Analyzer query builder query monitor query optimization query performance Query Store query tool query tuning query-level waits Rapid SQL rdbms real time monitoring Real User Monitoring recovery regulations relational databases Releases Reporting Reports repository Restore reverse engineering Roadmap sample SAP Scalability Security Policy Security Practices server monitoring Server performance server-level waits Service Level Agreement SkySQL slow query SNMP snowflake source control SQL SQL Admin Toolset SQL CM SQL code SQL coding SQL Compliance Manager SQL Defrag Manager sql development SQL Diagnostic Manager SQL Diagnostic Manager for MySQL SQL Diagnostic Manager for SQL Server SQL Diagnostic Manager Pro SQL DM SQL Doctor SQL Enterprise Job Manager SQl IM SQL Inventory Manager SQL Management Suite SQL Monitoring SQL Performance SQL Quality SQL query SQL Query Tuner SQL Safe Backup SQL script SQL Secure SQL Security Suite SQL Server sql server alert SQL Server Migration SQL Server Performance SQL Server Recommendations SQL Server Security SQL statement history SQL tuning SQL Virtual Database sqlmemory sqlserver SQLyog Storage Storage Performance structured data Subversion Support tempdb tempdb data temporal data Tips and Tricks troubleshooting universal data models universal mapping unstructured data Uptime Infrastructure Monitor user experience user permissions Virtual Machine (VM) web services webinar What-if analysis WindowsPowerShell

Some of an organization’s most important computing systems are the databases that store its information assets. They may contain multiple types of data that are extremely valuable to the enterprise. In some cases, a database can store sensitive personal information that needs to be protected according to specific guidelines to remain compliant with regulatory guidelines. Other systems may hold proprietary information that gives a company its competitive edge. The business consequences associated with the misuse of this information can be quite severe.

The amount of attention that a database attracts from unauthorized entities is directly proportional to the value and sensitivity of the information it contains. Nobody is going to spend much time or energy trying to break into an SQL Server database that contains publicly available information. Even though the information may be organized in a particular way to address some business requirements, the fact that it can be obtained elsewhere minimizes its potential for being misused.

Using a database without proper authorization entails some risk for the perpetrator. The risk can manifest itself in a variety of ways depending on the identity of the culprit, the data that was compromised, and what was done with the information. It can range from a strongly worded memo from management to a substantial fine and potential criminal charges. The severity of the penalty is often commensurate with the damage done by the database intrusion.

Internal Threats to Your Databases

When considering data breaches and unauthorized use of information resources, the focus is usually on keeping outside actors from accessing the systems. This is usually done with a combination of network and system monitoring techniques that attempt to thwart access by unscrupulous groups or individuals. Monitoring of this kind is considered best practice and forms the first line of defense guarding your databases.

Sometimes overlooked is the threat posed by insiders who may have a certain level of authorization but misuse it either mistakenly or for nefarious purposes. A case in point is the healthcare industry in which 58% of security incidents in 2018 were caused by insiders. These breaches were perpetrated for several reasons.

  • 48% of insider breaches were financially motivated.
  • 31% were done out of curiosity or for entertainment reasons.
  • 10% of internal data breaches occurred over unsecured data handling procedures practiced because they were convenient for users.

Health records are protected by strong security regulations such as HIPAA and their unauthorized use exposes organizations to financial penalties for lack of compliance. The damage done to the individuals whose data was compromised can also be considerable and may impact their lives for years to come.

Another example of insiders using sensitive data inappropriately can be seen in this case of misuse by law enforcement officials in California. Over the last decade, more than 1,000 law enforcement agency workers were found to have misused the state’s California Law Enforcement Telecommunications System (CLETS). In one case, an officer used the database to run criminal background checks on tenants renting apartments from his girlfriend in violation of the department’s usage policies.

Other instances of misuse include officers using information to locate individuals who were later harassed with repeated phone calls to their homes. One officer was caught writing phony tickets to individuals with whom they were involved in past litigation. In many cases, no criminal charges were filed against the officers. The impact of these data breaches included a loss of public confidence in the ability of the department to safeguard sensitive information.

Tightening SQL Server Security

Identifying internal misuse of databases and information assets can be challenging for IT teams. It is not as simple as stopping intruders at the door or network level since they are already inside the organization. The individual misusing data may be authorized to access a particular database for certain reasons and have decided to take advantage of their level of permission. It takes some thinking outside the box for DBAs to discover this type of internal data breach.

IDERA’s SQL Secure can help address the difficulty in stopping internal misuse of SQL Server databases. Using its security analysis and reporting capabilities, DBAs can look at security aspects such as effective rights and database roles permissions that may need to be modified to fully protect their systems. The details of logon and configuration services can be displayed and a security scorecard lists possible issues with your SQL Servers. Built-in and customizable reports can be used for security analysis and compliance evidence.

Understanding the permissions that have been granted to users can identify credentials that need to be modified to conform to security standards. This allows teams to trim the level of permission to minimize the potential of sensitive data being accessed improperly from within the organization. Repeated attempts by certain users to access data for which they are not authorized can point to potential human security weaknesses in the enterprise. Additional scrutiny can be focused on these individuals to prevent the misuse of valuable data resources.