Database issues in internet - A Critical analysis

DATABASE ISSUES IN INTERNET - A CRITICAL ANALYSIS

Ann priscilla swarnakumari.E , B.Com,LLB (Hons), School of Excellence in law, The Tamilnadu Dr.Ambedkar Law University, Chennai, Tamilnadu.

ABSTRACT

A database is an organized collection of structured information or data, typically stored electronically in a computer system. A database is usually controlled by a database management system (DBMS). The study of this paper is based on the security threats that administrators of the database are facing, cyber attacks caused by the cyber criminals, loopholes of database that the hackers make use of and certain solution as to the prevention of such database exploitation.

key words: cyber criminals, hackers, threats, attackers, vulnerable.

INTRODUCTION

Databases are the back bone of all modern information system. Since computers store contemporary database, the data can be of any size and complexity. Database is nothing but an organised collection of data, so that it can be easily accessed, managed and updated.

In other words, a database is a systematical collection of data. The primary goal of a database is to store a huge amount of data. Database often contain tons of valuable information including usernames, passwords, email-id's, addresses, phone number and much more.

DATABASE SECURITY

Database security includes a collection of measures used to protect the database management system from any cyber attacks and illegal use. Database security programs are not only designed to protect data within the database but also data management system. Database security consists of tool, methodologies, processes in order to protect the data from malicious attacks. Data security is the prime concern of an organization and in current it has become very complicated, skillful to administer database security.

DATABASE SECURITY THREATS

Database are a key target for cyber criminals due to valuable and sensitive information being locked away inside. Hackers world wide can profit from breaching a business server and steal database. Hackers can sell or misuse data for monetary benefits. Cyber criminals also try to breach the servers and damage the database in them.

The following apps have been subjected to breach of database in the following few years: Facebook, Equifax, Google, Apple, Yahoo, Slack and eBay.

So there comes the question of what's the solution?

There are various techniques for database security but first, one should understand the isues leading to such database issues. The most common 10 issues are as follows.

NO SECURITY TESTING IS DONE BEFORE DATABASE DEPLOYMENT

There is negligence on the stage of deployment. Although functional testing is conducted, this type of test can’t show you if the database is doing something that it is not supposed to do. Thus it is important to test website security with different types of tests such as penetration or security tests.

POOR ENCRYPTION STANDARDS

There are network interference within the database, which can be hacked by the hackers easily if your database security is poor. To avoid such pitfall, it is important to use TLS or SSL Encrypted platform.

TLS (Transport layer security):

                               It is a widely adopted security protocol, designed to facilitate privacy and data security for communication over the internet.

SSL (Secure socket layer):

                         It is a protocol for establishing secure links between networked computers.

Encryption directly deals with the security of data in the database. Thus, if the hackers try to hack the database, the database won’t leave any data since it has been encrypted.

HOPSCOTCH

Under this heading we will be discussing of how the hackers make use of a database which has weaker points. Hackers do not take control of a database as a whole, they try to find out the weakest point of a database infrastructure and approach it. They try to launch string of attacks to reach the backend ultimately. Security software's are also not fully capable to protect your system from such insecure behaviour. Even if you keep a constant check on the weaker feature of a database, it is important to keep your database less complex. If the infrastructure of your database is complex you might forget or neglect to check and fix the weaker parts of the database.

Thus, it is important for every department to maintain a congruous degree of control in order to control risk.

DEFECT IN THE FEATURES

Flaws in the features of database make it easier for the attackers to hack the database. A research team has stated that over the last 3 years, every database exploitation that they have seen is due to the misuse of standard database feature. Hackers will break into the employer's credentials and then access the systems to run an arbitrary code which they send to it. Though it seems to be complex hacker’s gain this access by leveraging the fault of the integral features. Security testing can be useful in order to prevent a 3^rd party from accessing the data. The simplest once database and feature be, the easiest it will be for the hackers to hack your database. This abuse of database can be prevented by removing unnecessary tools and by increasing the standard of database feature.

ADMINISTRATIVE ACCESS

Smart division of tasks and powers between the database administrators and the individuals will help to ensure that only limited database is available to users. By following this method it will help the organization to limit the database, to only needed amount of database available to individual users and thereby reduce the risk of loosing excessive data. It is also perfect to limit the number of accounts for individual users as the hackers will find it difficult to access the database. Thus it is advisable to perform a banking software testing before releasing it.  

STOLEN DATABASE BACKUPS

External attackers who penetrate systems to steal data are one major threat, but what about those inside the organization?

There are basically two types of threats. They are, internal threats and external threats to database. Companies and organization suffer with internal threats to the same extent as that of external threats.

External threats are done by the hackers, hacking the database. On the other hand, internal threats are those done by unloyal staffs, stealing the data in company. The report suggests that insiders are also likely to steal archives- including database backups- whether for money, profit or revenge. There are many ways to prevent such threats by encrypting the database archives, imposing fines or penalties in case of violation of database, using top-end cyber security software and also by increasing team awareness by corporate meetings.

SQL INJECTIONS

This one being the most restrictive one on way to database protection. Injections attack the applications and the administrators are made to clean up the mess caused by variables and malevolent code. SQL slammer worm is assumed to be the fastest computer worm in history, that infected 90% of the vulnerable computers within a time period of 10 minutes (in such a shorter time span).

SQL slammer worm targets a vulnerability in Microsoft SQL server but hardly any administrator patched their system. It is because, in the upcoming days cybercriminals are fast to introduce malware which targets the news discovered vulnerabilities in system, it is very difficult to install patches sooner than earlier.

In order to prevent the SQL slammer worm from attacking your system, one must ensure that the patches are regularly installed in their system.

FRAGILE CYBER SECURITY SOFTWARE

In order to have a clear understanding of weak cyber security software, let’s look into the data breach case of Equifax. Here in the case of Equifax, personal details of about 147 million users were compromised. Due to such circumstances, providers lost its credibility entirely. This case has shown how important it is to secure one's database. However due to lack of time and any other difficulties, businesses don't get alarmed to conduct necessary test and to provide regular patches to their system which is an essential.

KEY MANAGEMENT

Key management is nothing but managing cryptographic keys within a crypto system. It can manage by means of generating, exchanging, saving, using and replacing keys as required at the user level. The security of the database is based on successful key management. It is important to pay attention to who exactly has access to keys. Since keys are generally stored on hard drive, it is an easy target for attackers to steal them. A lost or stolen key can lead to costly losses of systems and information. When one's software security tool is unguarded, they must be aware that this makes their system vulnerable to attack.

Thus, keys has to be managed securely in order to avoid such attacks.

DATABASE INCONSISTENCIES

Finally, the researchers has found that, inconsistencies in database leads to vulnerabilities which is an administrative problem rather than database technology problem. There should be a constant check of their database, staying aware of threats and make sure that the vulnerabilities are looked upon. This isn't an easy task, but by way of proper tracking, the information contained in the network is kept safe. In spite of being aware of the test's to be made for security purpose, plenty of business fail to tool it.

Thus, cyber criminals take advantage of such failure, in order to make profits.

CONCLUSION

Database often contains tons of valuable information, including usernames, passwords, email-id's, addresses, phone numbers and much more. There are various kinds of threats on a database and numerous attacks from which a database should be safeguarded.

A good database security practice will eliminate the increasing risk of data breaches. Data security is the prime concern of an organization and in current it has become very complicated and skillful to administer database security. One can decrease the ever increasing threats to database security by using many approaches such as:

·      Encrypt databases

·      Block any malicious web requests

·      Monitor all database access activity

·      Manage user's access rights

·      Remove inactive user's and more