PreventionInsider Threat Insider could be anyone within the organization who has access to the data beyond the general public.1.Protection of the memory keysThe typical threat model in an organization recites in either hardware or software. Attackers are often assumed to have physical access to the sensitive information in various ways.
The target for these attackers is mainly to get the encryption key which is hidden in the chip boundary. This increases the workload of the attacker since it requires expertise knowledge. The cryptographic keys unlike most data in the computer memory, are random. Looking through memory structures can be an easy way to reveal the key material. Well made libraries for use like the Local Encryption Services help to a great extent in protecting keys in memory. Key-encryption keys are used to encrypt the key while it is in the memory and then this encrypted key is divided into several parts and then spread throughout the memory spread. Memory holding the key should be immediately cleared as soon as this cryptographic process is finished.
To increase the security Master key must be backed up separately.2.Denial of service (DOS)It is not possible to completely eradicate DOS but to some extent we can avoid it.
It becomes very difficult to differentiate between an authentic request and a fake request because both of them use the same ports and protocols which may resemble each other. Some of the ways to prevent this can be :· Purchasing a lot of bandwidth: This can be the easiest but is the most expensive. Enterprise with a huge amount of bandwidth would be less susceptible to DOS since it has more bandwidth than an attacker has to clog.· Prepare a DOS response: The use of throttling and rate-limiting technologies reduces the risk of DOS attacks.
This response stops all the new inbound connections in the DOS attacks, allowing only the established connections and new outbound connections to continue.· Using DOS attack identification and detection technique: This can help to differentiate between authentic and fake traffic. Activity profiling can be used for this, it measures average traffic rates and flag significant increase in traffic. Identifying the DOS attack can help organization to determine the type of attack i.e.
DDOS attack or domain name system amplification attack. 3.Preventing Data in cloudUsing the cloud can come with a great ease and a great threat to the data. But if done smartly this can help to a great extent.· Use private clouds: Private clouds are more expensive but much more secure than public clouds. Private cloud providers are in better position to monitor your account, enabling them to preemptively deflect attacks and minimize their impact.
· Choose passwords wisely: Passwords must be strategically chosen since they are the most avoidable and common cyber security attack. The idle password must be at least 8 character long, utilizes a wide range of symbols, no complete words, no word related with the company. If CEOs credentials get into the hands of cybercriminals, they can send emails to the employees to take action without the knowledge of the CEO.· Use secure data transfer channel: Always encrypt the sensitive data before sending .
This reduces the attacks up to a great extent.4.Using system TriggersA trigger is a special kind of stored procedure that automatically executes when the event occurs in the database.DML executes when the user tries to alter data using data manipulation language(DML). DML events are INSERT,UPDATE,DELETE statements.
DDL executes in response to the variety of data Data Definition Language(DDL)System triggers can be used to detect when something suspicious is going on in the database. System events that could be triggered are CREATE,ALTER,DROP.CREATE TRIGGER -creates or enables database triggers in database.ALTER TRIGGER-enable, disable or compile a database trigger.
DROP TRIGGER-removes a database trigger from the databaseThese can be triggered either before or after the actions. Example: if a trigger is to be fired after all the CREATE events, then the trigger itself is not fired because it was not committed at the time when the trigger on Create was triggered. Whereas, if a trigger is DROPPED that was supposed to be fired before all the DROP events, the trigger then triggers before the DROP i.e. the trigger would be able to protect themselves. You need to ensure that they are not possible to reset externally if you are trusting only the system triggers. For eg: Oracle SGA modification.
5.Ensuring not even DBA can read sensitive dataThe DBA should not have access to the sensitive information such as encryption keys or services that can decrypt data. Encryption keys should be securely placed on the database server encrypted. The DBA can have access to the column but the data should not be made usable for decrypting sensitive data. The encryption keys must only be decrypted by some security processes and any information that makes the access to the keys should not be easily available.