NYCU-LYX

5-Database and Cloud Security

https://www.youtube.com/watch?v=RZLsUL1zL4I

5.1 The Need for Database Security

5.2 Database Management Systems

Database

Database management system (DBMS)
• Suite of programs for constructing and maintaining the database
(用於建置和維護資料庫的程式套件)
• Offers ad hoc query facilities to multiple users and applications
(為多個使用者和應用程式提供臨時查詢功能)

DBMS Architecture

5.3 Relational Databases

Elements of a Relational Database System

⚫ Relation/table/file

⚫ Tuple/row/record

⚫ Attribute/column/field

formal name Common Name Also Known as
Relation Table File
Tuple Row Record
Attribute Column Field
primary key • Uniquely identifies a row
• Consists of one or more column names
Foreign key • Links one table to attributes in another
View/virtual table Result of a query that returns selected rows and columns from one or more tables

Structured Query Language (SQL)

SQL statements can be used to:

5.4 SQL Injection Attacks

SQLi

A Typical SQLi Attack

  1. Hacker finds a vulnerability in a custom Web application and injects an SQL command to a database by sending the command to the Web server. The command is injected into traffic that will be accepted by the firewall.
  2. The Web server receives the malicious code and sends it to the Web application server.
  3. The Web application server receives the malicious code from the Web server and sends it to the database server.
  4. The database server executes the malicious code on the database. The database returns data from credit cards table.
  5. The Web application server dynamically generates a page with data including credit card details from the database.
  6. The Web server sends the credit card details to the hacker.

The Injection Technique

var Shipcity;
ShipCity = Request.form (“ShipCity”);
var sql = “select * from OrdersTable where
ShipCity = ‘” + ShipCity + “‘ ”;

normal input
ShipCity = Redmond;
SELECT * FROM OrdersTable WHERE ShipCity = ‘Redmond’
===============================================================
malicious input
ShipCity = Boston’; DROP table OrdersTable--;
//註解掉原語法的「＇」
SELECT * FROM OrdersTable WHERE ShipCity = ‘Redmond’; DROP table OrdersTable--

SQLi Attack Avenues and Types

SQLi Example I: from User Input

strSQL = “SELECT * FROM users WHERE (name = ‘” + username + “’) and (pw = ‘” + password + “’);

username: 1’ OR ‘1’=‘1
password: 1’ OR ‘1’=‘1

SQLi Example II: from Server Variables

“SELECT user.password FROM admins
WHERE
user=‘“.sanitize($_POST[‘user’].”’
AND
password=‘”.md5($_POST[‘password’]).”’
AND
ip_adr=‘”.ip_adr().”’”


“SELECT user.password FROM admins WHERE user=‘“.sanitize($_POST[‘user’].”’ AND password=‘”.md5($_POST[‘password’]).”’ AND ip_adr=‘”.ip_adr().”’”

HTTP_X_FORWARDED_FOR is not properly sanitized.

function ip_adr() {
  if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    $ip_adr = $_SERVER['HTTP_X_FORWARDED_FOR']; }
  else { $ip_adr = $_SERVER["REMOTE_ADDR"]; }
  return $ip_adr;
}

HTTP_X_FORWARDED_FOR is not properly sanitized. （HTTP_X_FORWARDED_FOR沒有被過濾)

How to launch an SQLi attack with “HTTP_X_FORWARDED_FOR”?

X_FORWARDED_FOR :127.0.0.1' or 1=1# ➝ 用這個condition都會是true

SQLi Example III: from Second-order Injection

“SELECT username FROM sessiontable WHERE session=‘”$_POST[‘sessionid’].”’”
“SELECT ssn FROM users WHERE username=‘”$_POST[‘username’].”’”

How to launch an SQLi attack with existing data?

username: XXX' OR username='JANE

Three Categories of SQLi Attacks

SQLi Countermeasures

defensive coding

Manual coding practices:

Manual defensive coding practices

Parameterized query insertion

SQL DOM -codegen

using (SqlConnection conn = new Sq1Connection(NorthwindConnectionstring))
{
  string query = "SELECT * FROM Products WHERE ProductID = @Id";
  SqlCommand cmd = new Sq1Command(query, conn);
  cmd.Parameters.AddwithValue("@Id", Request.Querystring["Id"]);
  conn.Open();
  using (SqlDataReader rdr = cmd.ExecuteReader())
  {
    DetailsView1.DataSource - rdr;
    DetailsView1.DataBind();
  }
}

Parameterized query insertion:

SQL DOM:

Detection

Signature-based:

Anomaly-based:

Code analysis:

Run-time prevention

• Check queries at runtime to see if they conform to a model of expected queries

5.5 Database Access Control

SQL-Based Access Definition

Cascading Authorizations

Role-Based Access Control

Microsoft SQL Server

5.6 Inference

Figure 5.8a shows an Inventory table with four columns.

Figure 5.8b shows two views, defined in SQL as follows:

Figure 5.8c. This violates the access control policy that the relationship of attributes Item and Cost must not be disclosed.

CREATE view V1 AS
SELECT Availability, Cost
FROM Inventory
WHERE Department = “hardware”

CREATE view V2 AS
SELECT Item, Department
FROM Inventory
WHERE Department = “hardware”

Inference Detection: Two Approaches

Example: Inference Problem and Solution

Employees (Emp#, Name, Address)
Salaries (S#, Salary)
Emp-Salary (Emp#, S#)

What if a new attribute, employee start date, is needed? Where should it be added?

Employees (Emp#, Name, Address)
Salaries (S#, Salary, Start-Date)
Emp-Salary (Emp#, S#)

Employees (Emp#, Name, Address, Start-Date)
Salaries (S#, Salary)
Emp-Salary (Emp#, S#)

5.7 Database Encryption

A user at the client can retrieve a record from the database with the following sequence:

  1. The user issues an SQL query for fields from one or more records with a specific value of the primary key.
  2. The query processor at the client encrypts the primary key, modifies the SQL query accordingly, and transmits the query to the server.
  3. The server processes the query using the encrypted value of the primary key and returns the appropriate record or records.
  4. The query processor decrypts the data and returns the results.

Example for a Straightforward Approach

For example, consider this query, which was introduced in Section 5.1, on the

database of Figure 5.4a:

 SELECT Ename, Eid, Ephone
        FROM Employee
        WHERE Did = 15

    SELECT Ename, Eid, Ephone
        FROM Employee
        WHERE Did = 1000110111001110

More Flexible Approach

Cloud Security

Cloud Computing Elements

Cloud Service Models

Containers vs. Virtual Machines

Here’s a breakdown of the key differences between containers and virtual machines:

Virtualization level:

Resource allocation:

Application packaging:

Use cases:

Here’s a table summarizing the key differences:

Feature Containers Virtual Machines
Virtualization level Shared kernel Guest OS
Isolation Lower High
Resource allocation Dynamic Pre-allocated
Packaging Image Entire OS + application
Startup time Fast Slow
Scalability High Moderate
Use cases Microservices, cloud-native, multi-tenant Legacy apps, resource-intensive, high isolation

Ultimately, the choice between containers and VMs depends on your specific needs and priorities. Consider factors like isolation requirements, resource utilization, and application compatibility when making your decision.

Typical Cloud Computing Context

NIST Cloud Computing Reference Architecture

Cloud Security Risks and Countermeasures

Cloud Security as a Service (SecaaS)

Elements of Cloud Security as a Service

5.8 Data Center Security

teacher doesn’t teach this section

Data Center Elements

teacher doesn’t teach this section

Data Center Security Considerations

teacher doesn’t teach this section

TIA-492

teacher doesn’t teach this section

5.9 Key Terms, Review Questions, and Problems

  1. 5.1  Define the terms database, database management system, and query language.
  2. 5.2  What is a relational database and what are its principal ingredients?
  3. 5.3  What is an SQL injection attack?
  4. 5.4  What are the implications of an SQL injection attack?
  5. 5.5  List the categories for grouping different types of SQLi attacks.
  6. 5.6  Why is RBAC considered fit for database access control?
  7. 5.7  State the different levels at which encryption can be applied to a database.
  8. 5.8  List and briefly define four data center availability tiers.