A security threat is defined as something that threatens the confidentiality, integrity, and availability indicated in "1.2 Security Requirements" in respect to information assets. This includes technical threats such as accessing a database, but does not include physical destruction.
Threats are considered to be a combination of type of user who is the source of the threat, information assets that need to be protected, techniques, and unauthorized actions. For example, a threat might be a general user exploiting a database vulnerability to obtain database management information, and then tampering with that information.
When considering security measures, it is firstly necessary to clarify what kind of threats there are. A list of possible threats is shown in the table below. Refer to "Types of user" and "Information assets" for details on the definition of each type of user and information assets that should be protected.
Possible threats
Type of user | Information asset | Technique | Unauthorized action |
|---|---|---|---|
General user Internal user System manager System developer System administrator System operator | Database management information | Eavesdropping of packets | Unauthorized acquisition (viewing) of information Unauthorized tampering or destruction (updating) of information |
Dictionary attack of passwords | |||
Unauthorized acquisition of IDs/passwords through social engineering | |||
Unauthorized acquisition of information through misuse of settings | |||
Unauthorized acquisition of information through exploiting a database vulnerability | |||
Acquisition by an unauthorized route | |||
General user Internal user | General database information | Acquisition by a normal route | Misuse of information that can be acquired normally (taking data outside of the company) |
SQL issued with the aim of obstructing a job | Obstructing a job (resource depletion) | ||
General user Internal user | General database information | Eavesdropping of packets | Unauthorized tampering or destruction (updating) of information |
Dictionary attack of passwords | |||
Unauthorized acquisition of IDs/passwords through social engineering | |||
Unauthorized acquisition of information through exploiting configuration errors | |||
Unauthorized acquisition of information through exploiting a database vulnerability | |||
Acquisition by an unauthorized route | |||
System manager System developer System administrator System operator | General database information | Eavesdropping of packets | Unauthorized acquisition (viewing) of information Unauthorized tampering or destruction (updating) of information |
Dictionary attack of passwords | |||
Unauthorized acquisition of IDs/passwords through social engineering | |||
Unauthorized acquisition of information through exploiting configuration errors | |||
Unauthorized acquisition of information through exploiting a database vulnerability | |||
Acquisition by an unauthorized route | |||
System developer | Database management information | Creation of a backdoor | Unauthorized acquisition (viewing) of information Unauthorized tampering or destruction (updating) of information |
General database information | |||
System manager System administrator | Database management information | Unauthorized acquisition of information by creating an unauthorized database administrator account | Unauthorized acquisition (viewing) of information Unauthorized tampering or destruction (updating) of information |
General database information | |||
System manager System operator | Database management information | Unauthorized acquisition of information by tampering with database-related files (definition file, physical file, and so on) | Unauthorized acquisition (viewing) of information Unauthorized tampering or destruction (updating) of information |
General database information | |||
Database administrator | Database management information | Misuse of information (taking information outside of the company) after obtaining it through the normal route | Misuse of information that can be acquired normally (taking information outside of the company) |
Unauthorized use of IDs/passwords from the management information | Tampering with or destroying information that can be acquired | ||
Unauthorized acquisition of information by tampering with management information | |||
SQL issued with the aim of obstructing a job | Obstructing a job (resource depletion) | ||
General database information | Eavesdropping of packets | Unauthorized acquisition (viewing) of information Unauthorized tampering or destruction (updating) of information | |
Misuse of information (taking information outside of the company) after obtaining it through an unauthorized route | |||
Database operator | Database management information | Eavesdropping of packets | Unauthorized acquisition (viewing) of information Unauthorized tampering or destruction (updating) of information |
Dictionary attack of passwords | |||
Unauthorized acquisition of IDs/passwords through social engineering | |||
Unauthorized acquisition of information by exploiting configuration errors | |||
Unauthorized acquisition of information through exploiting a database vulnerability | |||
Acquisition by an unauthorized route | |||
General database information | Acquisition by a normal route | Misuse of information that can be acquired normally (taking data outside of the company) | |
SQL issued with the aim of obstructing a job | Obstructing a job (resource depletion) |
Types of user
In database security, the persons involved with databases and their roles are defined below.
Type of user | Role |
|---|---|
System manager | Manages developers, administrators, and operators |
System developer | Builds the network around the database server Builds the database server |
System administrator | Operates devices of the surrounding database network Operates the database server |
System operator | Operates the surrounding database network |
Database administrator | Builds the database system Operates the database system |
Database operator | Performs business operations |
Internal user | End user inside the company |
General user | End user outside the company |
Information assets
In database security, it is necessary to protect the information assets to be stored on the database server.
Such assets are defined below.
Database configuration information (system catalog, user ID/password, and so on)
Database logs (such as access logs)
Job data
Applications
