On Monday, November 19, 2007, David Litchfield will be releasing the Database Exposure Survey for 2007 on his databasesecurity.com website. According to CIO.com, Litchfield estimates that there are roughly 500,000 database servers on the Internet that are openly accessible (with no firewall protection).
I believe many sysadmins overlook database security believing that “no one knows its there so how could be attacked?” It’s a foolish notion. I think other admins believe that database servers are no vulnerable to attack in the same way that other services are. We hear about worms and trojans targeting desktop users, IM clients, and web applications, but less often we hear about buffer overflows in server applications. However, vulnerabilities in RDBMS services do occur, and often enough to make you worry. Remote code execution is a potential problem for any services that you can connect to directly.
Even if your database server is patched-up you have to worry about accounts on the database server. Do all your database users accounts have passwords? I have seen poor password selection on database accounts far too often. It makes my skin crawl actually. It’s hard to explain to programmers sometimes why password choice is important or sometimes even why passwords are necessary at all.
Many people believe that database servers are “behind the scenes” and inaccessible to Internet. Litchfield’s survey demonstrates how often that assumption is wrong.
Defense-in-depth applies to database security as much as any other network service:
- You need a firewall configured to deny access to your database server except to the few people that really need to connect.
- Ever account on your database should have a non-empty password and it should be a strong password.
- Accounts should have limited access to database. Read-only access should be your default. No account should have access to all your database unless necassary.
- You should monitor database access. Do you have logs showing which users logged in and when and from where?
- When put together, “limiting account access” and “monitoring” mean you should be able to tell who accessed which database from what application. Each web application should use a different account to access your databases (at the very minimum).
- Finally, you should have a process for auditing data integrity. Would you be able to tell if data in a database had been inserted or if data was invalid or inconsistent?
