Self-Protection Against Insider Threats In DBMS Through .
(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 8, No. 3, 2017Self-Protection against Insider Threats in DBMSthrough Policies ImplementationFarukh Zaman, Basit RazaAhmad Kamran Malik, Adeel AnjumDepartment of Computer ScienceCOMSATS Institute of Information TechnologyIslamabad, PakistanDepartment of Computer ScienceCOMSATS Institute of Information TechnologyIslamabad, PakistanAbstract—In today’s world, information security of anorganization has become a major challenge as well as a criticalbusiness issue. Managing and mitigating these internal orexternal security related issues, organizations hire highlyknowledgeable security expert persons. Insider threats indatabase management system (DBMS) are inherently a very hardproblem to address. Employees within the organization carry outor harm organization data in a professional manner. To protectand monitor organization information from insider user inDBMS, the organization used different techniques, but thesetechniques are insufficient to secure their data. We offer anautonomous approach to self-protection architecture based onpolicy implementation in DBMS. This research proposes anautonomic model for protection that will enforce Access Controlpolicies, Database Auditing policies, Encryption policies, userauthentication policies, and database configuration settingpolicies in DBMS. The purpose of these policies to restrict insideruser or Database Administrator (DBA) from malicious activitiesto protect data.Firewall, network traffic monitoring, enforcing passwordmechanism and penetration testing [4]. However, it’s difficultto monitor insider’s intent. According to CERT survey, morethan 700 cases were caused by the insider threats [6]. Toprotect against these threats database should have some extrafeatures of Autonomic Computing like self-protection. Wefirst provide an introduction to Autonomic computing and itscomponents.Keywords—autonomic; self-protection; insider threats; policies;DBMSI.INTRODUCTIONData is probably most important and valuable asset onwhich entire organization depends. However, it’s difficult tomemorize some data so these data should be kept in anorganized way in a special storage location called databases.It’s necessary to build a trustworthy relationship with anorganization and its clients by protecting its data from possiblethreats. Data should protect by imposing CIA (Confidentiality,Integrity, and Availability) security model which should beguaranteed in any kind of security system [5] [34] [35] [36][37] [38]. Without CIA security model data can be lost ordestroyed. Some security threat against database managementsystems are: Misuse of sensitive data by the authenticated user Malware infection causing damage to data or programs Physical damage of database server Weak parameter setting or design flaws causingvulnerabilities in DBMS Unauthorized access of DBMSDatabase threat may have initiated either in an externalway or from within an organization. The external threat can bedetected by imposing software tools and technologies such asAutonomic computing has the ability to self-manage itssystem [39] [40]. It controls all the functionality of computersystems or applications without any user involvement.Autonomic computing concept is taken from human body’sautonomic nervous system, which controls human bodyfunctions such as heart rate, respiratory rate, pupillaryresponse parts and Digestive system without the consciousinput of an individual [2]. How the human body mechanismsmanage itself without external involvement in many cases?The main objective of autonomic computing is to build asystem that has a self-managed characteristic and make adecision on its own by using high-level functionalities whenany unpredictable problem occurs. Autonomic computingframework based on autonomic components that interact witheach other. The autonomic computing system has the ability torespond to any problems occur and make the system preciseand available to the user. Instead of directly user input in thesystem, User defines general procedures and policies thatguide the self-management process. IBM defines four mainself-* components [7] [41] [42] [43] [44] [45]. Self-optimization Self-healing Self-configuration Self-protection.Some other extended self-* features are defined as in [8]are Self-Adaption, Self-regulation, Self-learning, Selfawareness, Self-organization, Self-creation, Self-managementand Self-descriptive. When all these self-* features of selfmanaged apply to any system that system has the ability toprotect any external or internal threats and heal itself when itis needed without any user input [9][3]. Autonomic functionsand their management are automated in a control loop taskcalled MAPE. Self-optimization consists of the system’sautomatic ability to configure and optimize itself to achievetop level performance against current settings, workload, andresources [9]. In DBMS environment different features are239 P a g ewww.ijacsa.thesai.org
(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 8, No. 3, 2017used to achieve the best optimization. The query optimizer isused to optimize and execute the query execution plan. TheDatabase statistic manager is used to collect statistics ofdatabase objects. Such features are already configured toobtain self-optimization in DBMS.Self-healing is to recover the damaged part or dataautomatically without any human intervention in order toremain active and operating correctly [9] [45]. Self-healing isa grand-challenge to an autonomic system which first detects aproblem in the system, diagnoses it, and then repairs itautomatically. Self-Healing deals with lacking precision inthe uncontrolled situation and recovers it according to thedynamics. Healing the system is a serious problematicsituation when the information is being corrupted by amalicious attack or any insider’s malicious intent or bymistake as this could lead to disastrous decisions when itcomes to Military or Health database. For this, the systemmust be smart enough that it can detect the problem, prepare aplan against it and execute it to bring the database to a normalstate.An autonomic computing system configures itscomponents automatically to achieve its goal [9]. In thisenvironment, the system automatically detects changes andconfigures, reconfigures its components accordingly [48].Since the adaptation needs to achieve optimal performance,the category of self-configuring is close to self-optimize.Following features provide self-configuration in figuration, supporting objects for performance purpose,such as indexes, materialized views, partitions, etc. are allcomponents which are used to provide self-configurationability in the Database. Self-protection is a key component ofself-managed systems capable of automatically defend againstmalicious attacks at runtime. A self-protecting system orapplication proactively identifies malicious threats andtriggers necessary actions to stop them [9] [46] [47]. Securityprofessionals used different tools and skills such as (protectionfilters, detectors of suspicious activity, logging mechanism &backtracking tools) to protect their systems [1].The organization of this research paper comprises of thefollowing sections. Section 2 discusses autonomic computingin Database Management system that mainly focuses on theself-protecting perspective. Section 3 discusses currentapproaches to database protection and section 4 presentproposed autonomic model w.r.t self-protection. providesanalysis and discussion of database protection and section 5concludes the research and provide future directions.II.AUTONOMIC COMPUTING IN DBMSIn today’s era Complex Databases and their manageabilityhave become a serious concern for organizations nowadays.These databases need to be easily accessible and available totheir clients. For this purpose, it requires expert DatabaseAdministrators (DBA) for their continuous monitoring,evaluation, and availability. Keeping in view the scarcity ofsuch expert Database Administrators in the market and thecost of their hiring, the concept of the Autonomic DatabaseManagement System is introduced which is capable ofmanaging and maintaining such databases without any humanintervention [2].A. Self-Protection in DBMSSelf-protection of the database is to protect your data fromboth external threats and internal threats and make available24/7 to their clients. Experienced DBAs are being hired byorganizations for continuous monitoring and availability ofcomplex databases. As a DBA has full access to the databaseso he or she can easily carry out or harm organization data.The organization uses different techniques and methods toprotect their information or data from the internal user, butthese techniques and methods are insufficient or not enough.In this regard, the database should have some extra ability orfeatures of autonomic computing, i.e. Self-healing, Selfprotection, Self-configuration and Self-optimization to protectand manage its information without any human interventions.The autonomic computing system has the capability torespond automatically to any issue occurred and to make thesystem precise and available to the user.A number of authors use different techniques andapproaches to achieve database security. Data is an importantasset for any organization and its security is critical formaintaining the relationship between an organization and itsend users. Different techniques such as access control,encryption scheme, auditing policies, and inference control areused in database management system by a differentresearcher. While combining autonomic properties such asself-healing and self-protection with database security featuressuch as access control, encryption, database auditing features,we can get the more secure DBMS without the involvement orintervention of any DBA or security engineer. Such autonomicproperties are very useful for insider threat or monitoringDBA activities. Table I, presents protection techniques againstdifferent attacks and Self-protection of external threat ismostly implemented by configuring the firewall and networktraffic monitoring. On the other hand, self-protection againstinternal threat or insider’s malicious intent should achieve byobtaining best security policies [2]. Implementing thesepolicies within a database block every attempt to compromisethe state of the database. Database security achieved by useraccess control mechanism and by using stored procedures tomanage the internal database threat. When the attackerattempts a request to change security configuration requestcarried to the stored procedure for verification. Fig 1 showssome critical areas need to be considered in Database Security[5] and how different researcher use different techniques andmethods to mitigate these risks.240 P a g ewww.ijacsa.thesai.org
(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 8, No. 3, 2017TABLE. I.PROTECTION TECHNIQUES AGAINST DIFFERENT ATTACKSProtection TechniquesAccess Control PoliciesMixed Cryptographic DatabaseRSA Encryption TechniqueAttributes Based EncryptionHash-Based EncryptionData Centric ApproachSQL Injectionand insider misuse detection systemAuditing MethodAttack typeUsed for both insider and outsider attacksUsed for both insider and outsider attacksInsider attackUsed for both insider and outsider attacksUsed for both insider and outsider attacksInsider attackReference[11, 12, 16, 19, 22][13][15,17][3][18, 28, 29][23]Used for both insider and outsider attacks[20]Used for both insider and outsider attacks[24, 27]Hackers exploit these critical areas and security holes in adatabase application to gain database administrator (DBA)level grants and privileges to access sensitive data and cause adenial of service (DOS) attacks. Following are the securitythreats that need attention [10]. Excessive and unused privileges: granted extraprivileges to user that exceed the requirement of theirjob function Privilege abuse: authenticated user misuse authenticdatabase privileges for illegal purposes SQL injunction: targets traditional database and bigdatabase [NoSQL]. Inserting malicious statement intothe input field of web application and big datacomponents. Malware: an advance attack that uses multipleapproaches to stealing organization data. theseapproaches are phishing emails and malware. Weak audit trail and misconfigured database Storage media Disclosure such as backup media needsfor special protection.III.CURRENT PROTECTION APPROACHESDatabase security has the main concern of computersecurity or information security. Security Analyst usesdifferent security controls, i.e. (physical, procedural andtechnical) to protect their organization data. Protectingdatabases on multiple hosts and securing information withinthe database are done with these controls. It’s all requireddeeper research to protect the database from maliciousactivities. Researcher used different method and techniquessuch as Access control [4] [11] [12] [14] [16], Encryptiontechnique [3] [13] [15], Audit Trail [19] [24] [27] mechanismfor Database security purposes. The Summary of thesemethods and techniques are as follows.A. User IdentificationUser identification means to verify any user or applicationidentity who use information or data. User identification isbased on password management system and password shouldkeep secret all times. Password management system controlthrough the user profile. Self-protection is a key component ofself-managed systems capable of automatically defend againstthe malicious user, attacks at runtime. A self-protecting systemor application proactively identifies users, malicious threatsand triggers necessary actions to stop them [9] [46] [47].Security professionals used different tools and skills such as(protection filters, detectors of suspicious activity, loggingmechanism & backtracking tools) to protect their systems [1].B. Access ControlJabbour, et al. [4] presents Insider threat securityarchitecture (ITSA), of self-protection in databases againstinsider threats. In this architecture privileged usercompromised the database state where ITSA can protect. ITSAframework consists of security policy and defense mechanismmanaged by the super system owner. Security policy containssystem parameter and their values while built-in logic isembedded in defense mechanism in the form of storedprocedures and triggers and this logic is used to protect thesystem parameters. Three main components of ITSA areAutonomic Access Control Enforcement (AACE), IntegratedSelf-Protection Capability (ISPC), and Integrated BusinessIntelligence Capability (IBIC). The author discussed how thesame scenario can be moderated under the Insider threatsecurity architecture framework.Jabbour, et al. [11] present notion based self-protectionframework within the database by using the policy basedapproach. These policies are created by the system owner andblock every attempt that compromises the Database state. Eachaction in the database is verified by the system owner before itapplied to the database. Protection is achieved byimplementing stored procedures, functions and triggers thathave the built-in logic of checking insider user request. Whenan insider or attacker wants to change database securityparameters, its request for changing parameters goes through averification process through stored procedures before thefollowing change can be applied to the database. If the changerequest truly verifies set of policies, then it can be applied tothe database and its audit trail is maintained in the database. Ifthe request is not verified from stored procedures, then changerequest is blocked and system owner is alerted through emailand audit trail is maintained. Author present four types ofpolicies, i.e. verifying and controlling user actions, monitoringdatabase resources, changing security policy conditions andtheir parameters.241 P a g ewww.ijacsa.thesai.org
(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 8, No. 3, 2017Fig. 1. Critical areas need to be considered in DBMS SecurityJabbour, et al. [12] addresses a protective framework forsecuring autonomic system policies. The author used twotypes of methodology in this framework. The first type is topartition security policies, blocks into numerous levels andthen adding complexity to the entire architecture of thepolicies. This assists the purpose by adding alleged obscurity,which denies the potential attackers from decoding thepolicy’s contents and directives. The second method is toinsert false sense or false elements to different partitions of thepolicies (parameters and their values). Whose purpose is tooconfusing an attacker and giving a false sense ofaccomplishing his/her goal. K. Ahmed, et al. [14] addresseddifferent types of a security layer, i.e. Database administrator(DBA), the System administrator (SA), Security officer (SO),Database developers and client or end user. These securitylayers are applied at almost all DBMS i.e. (Oracle, SQLServer, DB2, Teradata) environment. Theses security layersare responsible for implementing some well-defined securitypolicies. The purpose of implementing these policies to ensuresecurity features such as Confidentiality, integrity, efficiency,access control and privacy within the database.A. Patil, et al. [16] presented Access control policymechanism is used to secure a database against insider user.Three types of AC policies are mainly used, i.e. discretionaryaccess control policy (DAC), Mandatory access control policy(MAC) and Role Base access control policy (RBAC). DACbased on the discretion of information creator or owner of thedata. DAC used to restrict access of user on the basis of useridentity and authentication. In MAC all users follow the samerule created by the Database administrator. RBAC used in alarge organization where turnover rate of the employee is high.RBAC model built on the notion of role where role signifies aspecific function within the organization. Each user performs aspecific action which is granted to the specific role associatedwith it.C. AuditingAuditing is one of the important components in Databasesecurity infrastructure. In the database production environmentin various database operations such as user login, Datamanipulation language statements (DML), Data definitionlanguage statements (DDL) are needed to obtain an audit trail.Different methods and techniques are used by Researcher forauditing. The Database auditing purpose is to monitor andrecord user actions what he or she performs on the database.Olumuyiwa O. Matthew et al. [24] discussed severalalready existing database auditing techniques such asstatement auditing, privilege auditing, schema object auditingand fine-grained auditing etc. at various databaseenvironments. The author also discussed issues concerningabout handling of audit trails against different databaseenvironment. According to author Database Auditing performslevel by level. At first level logging (login and logoff)activities are a monitor, second level privileges check are anaudit. In third level changes made to database schema aremonitored, fourth level database DML activities are monitoredand fifth level concerned with auditing changes made to astored procedure, function and other codes. In next leveldatabase error is an audit and in the last level auditing anychanges made to the definition of what is to be audited.Li Yang [25] developed to extend auditing concept andtechnique by applying practical lab experience on security andauditing of a relational table that comprising an audit log of allcommands and causes data changes on the target table. SomeCommon techniques of database auditing for monitoringdatabase access control attempts, user login and logoffattempts, Data Control Language (DCL) activities, Data
to monitor insider’s intent. According to CERT survey, more than 700 cases were caused by the insider threats [6]. To protect against these threats database should have some extra features of Autonomic Computing like self-protection. We first provide an introduction to Autonomic computing and its components.
The Cost of Insider Threats ObserveIT 2018 Cost of Insider Threats: 159 Global Organizations surveyed Insider Threats caused by: Negligence (64%); 3.81M USD Criminal insider (23%); 2.99M USD Credential Theft (13%): 1.96M USD Average of 73 days to contain an incident 16% contained in 30 days
IBM Security 2 Stay ahead of insider threats With insider threats on the rise, security teams need to monitor users and quickly investigate suspicious activity— whenever and wherever it occurs. The IBM QRadar Security Intelligence Platform helps security teams do precisely this. At the core, IBM QRadar Security Information and Event
Dyer Alan Insider Wissen plus - Sterne ab 9 Graf Mike Insider Wissen plus - Stürme ab 9 Wade Rosalyn Insider Wissen plus - Naturgewalt Eis ab 9 Wilkinson Philip Insider Wissen plus - Das antike Rom ab 9 Murphy Glenn Insider Wissen plus - Verborgene Schätze ab 9 Hartmann Markus Lesezug.
mbaMission Insider’s Guide to the MIT Sloan School of Management mbaMission Insider’s Guide to New York University’s Leonard N. Stern School of Business mbaMission Insider’s Guide to the Stanford Graduate School of Business mbaMission Insider’s Guide to the Stephen M. Ross School of Business at the University of Michigan
Counter-Insider Threat Program Director's vision to integrate the social and behavioral sciences into the mission space. As part of a partnership with the PERSEREC Threat Lab, CDSE provides links to their insider threat resources in the Insider Threat toolkit. This promotes the applied use of research outcomes to the insider threat community.
Most debated aspects of insider trading included whether insider trading is rational and whether it should be regulated. The pros can cons of insider trading is also a topic that has been actively discussed in literature on law, economics and finance (Chauhan, Chaturvedula, and Iyer, 7). The existence of insider trading laws and their
the CERT Division's National Insider Threat Center (NITC) at Carnegie Mellon University's Software Engineering Institute. Serves as the Chair of the Open Source Insider Threat (OSIT) information sharing group for industry insider threat practitioners. Develops detection and mitigation strategies for insider threat programs.
awakening – relaxed, reflective, taking its time – which soon turns to a gently restless frustration and impatience as Arianna waits for Theseus to return. The following aria, whilst sensuous, continues to convey this sense of growing restlessness, with suggestions of the princess's twists into instability reflected in the music. In the .
