Another database compromised in Ireland

Irish recruitment website Recruit Ireland was taken offline on the Feb 8th following the discovery that it's database had been compromised and it is suspected that names and email addresses were stolen for spamming purposes ( Data breach at recruitment site )There are no details yet of how the attach on recruitireland.com took place or when it took place.

On Jan 10, the website of the political party Irish Fine Gael was hacked and 2000 email addresses were stolen from it.

  

Here are few point to consider on the topic of securing the data in your databases:

• Database security is the poor cousin of network security and PC/laptop security. The networks are locked down with firewalls. PCs/laptops have virus scanners, personal firewalls, spyware protection, etc. It's no longer enough to rely on these security measures at the perimeter of the organisation in order to secure the data in the database.  A website that displays / adds / updates data in the database can provide that attacker with a route into the database.
• Remember if one laptop gets stolen you loose all the data on that laptop but if the intruders make it to your database then all your data is compromised. 

So

 

Carry out a security audit on your database(s) to discover:

• Who (people) / what (applications) uses them
• What data they look at / change
• What level of access to data that each user / application has
• What level of access to data that each user / application actually require
• Who are your privileged users (DBAs, system administrators, developers, applications) and how can you monitor what they are doing? 
• Follow a check-list to lock your database down (e.g. change default passwords, close old accounts, etc.)

 
Having your database locked down is not then end of the story. You need to actively maintain it's security and monitor it for suspicious activity.

• Keep database software patches up to date. If you run a 24/7 operation this will require a lot of planning because more than likely some downtime will be required.
• You will need to audit the database activity in order to have an audit trail for forensic analysis if a data breach occurs.
• Protect your audit trail from privileged users.
• Actively monitor database activity to identify any suspicious activity and notify the system administrators in real time. The last thing you want is to discover a data compromise days or weeks after it happened at which stage your customers know about it before you did.
• Audit the activity of privileged users (DBAs / application). Administrators may not like the idea of being monitored but if there is a data breach then they will be suspect. If a clear audit train exists then the administrators can be ruled out quickly.
• Identify unusual changes to the database schemas. This may indicate that an attacker is copying data into a table that they created in order to get it out of the system.
• Consider encrypting your database data files. If the intruder has access to your operating system but not your database then they could steal the database data files and extract the data from them without having logon credentials to the database. It makes it more difficult but this is still possible.
• Encrypt your database backups. If not then an intruder could steal your backup and restore the whole database on their own system.

There are more steps to secure and monitor the database but these ones above are just to get people thinking about what should be done. It will cost time and money to properly secure the data in your databases but this must be compared against the cost of a data compromise - cost of tidy up, fines & reputation damage.