McAfee Database Security

Transkript

1 McAfee Database Security Franz Huell Enterprise Technology Specialist, EMEA Select GETDATE () select SYSDATE select CURDATE () select CURRENT DATE:

2 McAfee Database Security Rundumschutz für die Datenbank: Wie kann ich meine wichtigen Datenbanken erfolgreich absichern DOAG Regionaltreffen 19-mar

3 Copyright 2015 McAfee, Inc. The McAfee logo is a trademark or registered trademark of McAfee, Inc. in the United States and other countries. Other names and brands may be claimed as the property of others. Copyright 2015 Intel Corporation. All rights reserved. Intel, the Intel logo are trademarks of Intel Corporation in the U.S. and/or other countries. Other names and brands may be claimed as the property of others. 3

4 Rätsel 1 date function select CURRENT DATE select CURDATE() select SYSDATE select GETDATE() select CURRENT_DATE Database DB2 MySQL ORACLE SQL SERVER / SYBASE TERADATA 4

5 Rätsel 2 5

6 6

7 Vorstellung McAfee und Datenbank Sicherheit McAfee und Intel Franz Hüll Enterprise Technology Specialist Database Security 7

8 Die ANGREIFER sind MITTEN unter uns 10

9 Sicherheit in Silos Nur ein integriertes Sicherheitskonzept bietet den nötigen Schutz Sicherheitslage Gesamtkosten Point Products Schichtweiser Ansatz Verfehlt ein Produkt schützt das nächste Integriertes Sicherheitskonzept Reaktiv ZEIT Optimiert 11

10 Der Bedarf für Kontext & Integration Nachträgliche proprietäre Integration erzeug Abhängigkeiten und Fehlerquellen Identity Management Mail Gateway Web Gateway App & Change Control Database Security Network Firewall IPS Anti-Malware Encryption Vulnerability Management SECURITY MANAGEMENT Access Control HIPS Data Protection Mobile Security Virtualization Threat Analysis 12

11 Data Exchange Layer Sicherheitskomponenten agieren als Eins und nicht mehr in Silos Web Gateway Database Security Identity Management IPS Data Protection App & Change Control Network Firewall Mail Gateway Vulnerability Management Web Gateway IPS Database Security Encryption Anti-Malware Identity Management App & Change Control SECURITY MANAGEMENT Network Firewall Anti-Malware Vulnerability Management Access Control Mail Gateway Mobile Security HIPS Virtualization Access Control Data Protection Mobile Security HIPS Virtualization Threat Analysis Data Exchange Layer 13

12 Sensor Database Security Database Activity Monitoring (DAM) Virtual Patching for Databases (VPT) Vulnerability Manager for Databases (VMD) Monitoring Technology Scan Technology Database Database Databases 15

13 Sensor Datacenter Security Suite for Databases (standalone / none epo) Datacenter Security Suite for Databases (epolicy Orchestrator / epo) Database Activity Monitoring (DAM) Virtual Patching for Databases (VPT) Vulnerability Manager for Databases (VMD) Vulnerability Manager for Databases (VMD) Database Activity Monitoring (DAM) Virtual Patching for Databases (VPT) Monitoring Technology Scan Technology Scan Technology Monitoring Technology Database Database Databases Sensor McAfee Agent 17

14 Sicherheits Überprüfung der Datenbanken Durchführung verschiedener Security Scans Suche nach sensiblen Daten Schutz der Applikationsdaten Audit hochprivilegierter Nutzer Absicherung sensibler Datenbankoperationen und daten Trennung von Zuständigkeiten Compliance und firmeninterne Security Policies Erfahrungen aus konkreten Projekten Installation und Testen 18

15 McAfee Vulnerability Manager for Databases Data at Rest What s in the scan? 19

16 McAfee Vulnerability Manager for Databases Scan Library including more than Single tests 20

17 McAfee Vulnerability Manager for Databases Centralized Management Integration into SIEM tools Communication with Database Activity Monitoring Reporting and Alerting based on Severity and Criticality 21

18 McAfee Vulnerability Manager for Databases Database Scans: Scanning for... General Auditing settings Backdoor Detection DB Configuration checks Patchlevel Scan for Vulnerabilities Custom checks 22

19 McAfee Vulnerability Manager for Databases Database Scans: Scanning for... Vulnerabililty & Patch List of Vulnerabilities Patch & Version level Missing patches 23

20 McAfee Vulnerability Manager for Databases Database Scans: Scanning for... Passwords Default Password Passwords from Dictionary Default 170,000 Bigger 1.7 Million Customizable No account locked 24

21 McAfee Vulnerability Manager for Databases Database Scans: Scanning for... Benchmarking CIS PCI-DSS STIG Customer Security Policy Custom 25

22 McAfee Vulnerability Manager for Databases Database Scans: Scanning for... Data Discovery Payment Data Discovery Encryption Discovery Address Data Discovery Password Discovery Custom checks... 26

23 McAfee Vulnerability Manager for DB: Enterprise Deployment Cloud DB ESM Network Connectivity to Databases (SQL-Connect) McAfee Database Security Server / McAfee Policy Orchestrator (epo) DB DB DB DB DB DB DB DB DB DB DB 27

24 Supported Platforms 28

25 Sicherheits Überprüfung der Datenbanken Durchführung verschiedener Security Scans Suche nach sensiblen Daten Schutz der Applikationsdaten Audit hochprivilegierter Nutzer Absicherung sensibler Datenbankoperationen und daten Trennung von Zuständigkeiten Compliance und firmeninterne Security Policies Erfahrungen aus konkreten Projekten Installation und Testen 30

26 31

27 Data in Use Whats in the parcel? 32

28 Why? Quickest deployment Software based Audit and Security without performance penalty Encrypted networks Virtualization, cloud 34

29 3rd Generation Execution Plan we see the objects 35

30 Datenbank Check network 'select * from cr' 'e' 'ditc' chr(63+3-1) translate traffic ('XY','YX','dr') SQL Statement 'select * from creditcard' 'select * from cr' 'e' 'ditcard' 'select * from cr' 'e' 'ditc' chr(65) 'rd' 'select * from cr' 'e' 'ditc' chr(63+3-1) 'rd' 'select * from cr' 'e' 'ditc' chr(63+3-1) translate ('XY','YX','dr') Network based Solution?? Memory Based Solution 36

31 Datenbank Check network 'create view tempview as select * from traffic tempsyn' 'select * from tempview' SQL Statement 'select * from creditcard' 'create synonym tempsyn for cr' 'e' 'ditc' chr(63+3-1) translate ('XY','YX','dr') 'select * from tempsyn' 'create view tempview as select * from tempsyn' 'select * from tempview' Network based Solution Memory Based Solution 37

32 McAfee Database Activity Monitoring Execution Plan Synonym View Table Netzwerkverschlüsselung 38

33 Listener Bequeath 1 From the network 2 From the host 3 From within the database (Intra-DB) DB ADMINS SYS ADMINS PROGRAMMERS Local Connection DBMS Stored Proc. SAP Network Connection Shared Memory Data Trigger View intra-db threats 39

34 McAfee Database Activity Monitoring: Enterprise Deployment Cloud DB ESM Network McAfee Database Security Server DB DB DB DB DB DB DB DB DB DB DB 40

35 No Downtime 42

36 Rules Generic Groups Groups relevant to all applications and databases. weekday or time Application specific groups Groups specified per application. <app>_db_admins or user or account Recommended Rules Specify custom rules to create and protect customer databases. Restrict <app> sensitive table access 43

37 Session Context Sensor Session ID User (DB Account) Executing User OS User CMD Type (SQL Command) Log On Time Instance (DB Name) Application (also module name) IP Addresse Host Name (computer name) 45

38 Security Connected LDAP Server LDAP Vulnerability Manager for Databases Database Activity Monitoring Database Activity Monitoring McAfee ESM ESM Datenbank ORCL Custom Scan Who Has DBA Role? user not in LDAP_Group and user in DBA_role_Group Applikation / Tool Connect Black_DBA Connect Blue_DBA 46

39 Why a virtual patch? 47

40 Virtual Patching for Databases High priority: Productivity 1st NO Downtime NO (few) Patches NO Upgrade Verfügbarkeit der Datenbank 24 x 7 Old database versions, no support by the vendor Applications & Patching? 48

41 Virtual Patching = Compensating Control 49

42 Real Patching 50

43 Virtual Patching (vpatch) Non intrusive NO change of any Libraries Executables Binaries Just driven by Rules (>500) Monitors access (statements) to the Database 51

44 Virtual Patching Days or Weeks Days or Weeks Hours or Days Report Analyze Patch Install Weeks or Months Months or Years Weeks or Months or NEVER McAfee vs. DB-Vendor 52

45 More information 1. McAfee Vulnerability Manager for Databases 2. McAfee Database Activity Monitoring 3. McAfee Virtual Patching for Databases 53

46 Supported Platforms 54

47 Sicherheits Überprüfung der Datenbanken Durchführung verschiedener Security Scans Suche nach sensiblen Daten Schutz der Applikationsdaten Audit hochprivilegierter Nutzer Absicherung sensibler Datenbankoperationen und daten Trennung von Zuständigkeiten Compliance und firmeninterne Security Policies Erfahrungen aus konkreten Projekten Installation und Testen 55

48 Demo 56

49 Franz Huell Enterprise Technology Specialist, EMEA Database & Datacenter Security McAfee. Part of Intel Security. Office: Mobile: Mail: 57