Implementing Database Security and Auditing
This book is about database security and auditing. You will learn many methods and techniques that will be helpful in securing, monitoring and auditing database environments. It covers diverse topics that include all aspects of database security and auditing - including network security for databases, authentication and authorization issues, links and replication, database Trojans, etc. You will also learn of vulnerabilities and attacks that exist within various database environments or that have been used to attack databases (and that have since been fixed). These will often be explained to an “internals level. There are many sections which outline the “anatomy of an attack – before delving into the details of how to combat such an attack. Equally important, you will learn about the database auditing landscape – both from a business and regulatory requirements perspective as well as from a technical implementation perspective.
* Useful to the database administrator and/or security administrator - regardless of the precise database vendor (or vendors) that you are using within your organization.
* Has a large number of examples - examples that pertain to Oracle, SQL Server, DB2, Sybase and even MySQL..
* Many of the techniques you will see in this book will never be described in a manual or a book that is devoted to a certain database product.
* Addressing complex issues must take into account more than just the database and focusing on capabilities that are provided only by the database vendor is not always enough. This book offers a broader view of the database environment - which is not dependent on the database platform - a view that is important to ensure good database security.
2 Database Security within the General Security Landscape and a Defense in Depth Strategy
3 The Database as a Networked Server
4 Authentication and Password Security
5 Application Security
6 Using Granular Access Control
7 Using the Database To Do Too Much
8 Securing database to database communications
Other editions - View all
Implementing Database Security and Auditing: A Guide for DBAs, Information ...
No preview available - 2005
access control activity allow application security application server application user architecture audit trail auditing system authentication baseline buffer overflow chapter client command communications configuration connection create database environment database security database server DB2 UDB default defined encryption ensure errors event example exec master..sp_trace_setevent TraceID execute external failed logins firewalls function granted or revoked hacker HIPAA IDSs implement installed IP address issues Java layer look machine mapping ment Microsoft mod_plsql monitor MySQL named pipe netlib OLE DB operating system options Oracle packet patch PL/SQL port Privilege granted protocol query replication request requirements schema security and auditing SELECT shown in Figure specific SQL injection SQL Server SQL*Plus stored procedures string Sybase TCP/IP techniques tion Transact-SQL Trojans update username and password vendors Web services Windows
Page 21 - CERT Coordination Center (CERT/CC) is a center of Internet security expertise located at the Software Engineering Institute, a federally funded research and development center operated by Carnegie Mellon University.