Database forensics

Database forensics

• 1.
  Denys A. Flores 20Jan 2016
• 2.
  They happen aroundthe world and sometimes security officers are not aware of them after a few weeks/months One of the impacts of data breaches is the disclosure/access to unauthorised/critical information The number of Data Breach Investigations increased 54% in between 2012 and 2013 Insiders and outsiders are a constant threat for information security
• 3.
  In 2015, 69%of big companies and 38% of small business faced external attacks ◦ Protocol-level vulnerabilities (SSL Heartbleed) ◦ Kernel Vulnerabilities (bypass ASLR and DEP) ◦ Application Bugs (heap/stack overflows/legacy code) ◦ Third-party plug-ins ◦ Web-based attacks (SQL injection/DoS) ◦ Malware (Trojans/RATs/Rogueware)
• 4.
  The major sourceof costly data breaches Financially motivated or intentional/malicious system damage ◦ IP Spoofing ◦ Sniffing/Scanning ◦ Credential Misuse ◦ Unauthorised Information Disclosure (Negligence or Intentional)
• 5.
  Weak information securitypolicy Lack of role segregation Compliance is not Security: ◦ Auditing is more focused on complex standard compliance than detecting information security issues and attack vectors CSIRTs perform very little analysis of incidents and apply weak recovery techniques (wipe/reinstall) CSIRTs skills are sometimes limited Malicious employees evade detection and hide activity – they become either attackers or accomplices
• 6.
  Encryption ◦ End-to-end encryptiondo not solve the problem of credential misuse. ◦ It has a lot of impact in infrastructure performance. ◦ It’s not the same encrypting a hard drive than a database Security Architecture ◦ Incident management technologies do not consider data management and classification ◦ Companies think that security tools are the silver bullet for all security problems ◦ Device misconfiguration Cloud Services ◦ Effective outsourced security management ◦ Effective outsourced data/information management ◦ Effective physical/logical access control to database servers
• 7.
  As a databasestores information, information security principles apply. Information Security: ◦ A set of human and technical measures and procedures to protect information security properties: Confidentiality Integrity Availability Possession or Control Authenticity Authentication Non-repudiation Provenance Authorisation Utility AccountabilityAccountabilityAccountabilityAccountability
• 8.
  AccountabilityAccountabilityAccountabilityAccountability ◦ Security characteristicto track activities of identification, authorisation and access to ensure that an actor with access to resources behaves in accordance with security, business and ethics rules (non-repudiation) ◦ It considers the fact that a fully secure system does not exist, so in case of a security event (e.g. data breach), this must be associated to the attacker by using accurate and reliable digital evidence (provenance) ◦ Requires proper monitoring and logging of actions to ensure the proper storage, use and maintenance of databases ◦ It is related to auditing and forensics purposes
• 9.
  AuditingAuditingAuditingAuditing ◦ Methodological andrecurring examination and review of activities over a period of time. ◦ Ensures compliance with laws, policies and other regulations by using accurate records of who did what and when. ◦ Relies on authentication and authorisation controls.
• 10.
  ForensicsForensicsForensicsForensics ◦ Methodological identification,preservation, acquisition and examination of digital evidence to report and reflect on a security event that may have legal implications. ◦ Is a vital process for incident response to analyse an event in a timely manner, and if possible, identify the parties involved. ◦ Relies on evidence provenance.
• 11.
  The main researchfocus in database security has been external threats (outsiders) There is an emerging concern related to intentional unauthorised attempts to access or destroy data, along with malicious actions performed by authorised users (insiders) Insiders are a great threat and the main cause of database tampering and fraud – this is our research interest
• 12.
  Very little researchin the field of databases in comparison to cloud forensics Two research areas ◦ Reactive Approach ◦ Proactive Approach
• 13.
  Reactive Approach: ◦ Aftera security event (e.g. data breach) has occurred ◦ Reconstruct or recover an original state of the database ◦ Rely on traditional digital forensics analysis (imaging and data carving) which are not fully compatible with the complexity of databases, and may not ensure evidence integrity and its admissibility in legal proceedings ◦ Not effective for incident response (limited time and resources) ◦ Ad-hoc practices depending on the DBMS (MSSQL/Oracle)
• 14.
  Proactive Approach ◦ Formalisethe forensic analysis of databases ◦ Resilience/Readiness: Ensure accountability (auditing and forensics) Deploy security configurations and controls to detect/prevent/deter security incidents on databases caused by insiders (fraud/misuse) Enable CSIRTs to investigate security incidents on databases caused by insiders (fraud/misuse) in a timely manner
• 15.
  Proactive Approach ◦ Provenance Researchfield mostly developed in provenance-aware software applications A property of accountability to trace activities back to their source regarding time, location Ensure chain of custody by ensuring provenance of evidence during its recording and storage Consider different evidence sources, not just the database
• 16.
  Proactive Database ForensicsArchitecture ◦ Ensure integrity of evidence (non-repudiation and provenance) before, during and after a security event ◦ If evidence integrity is ensured then evidence is admissible because the systems that generated it are reliable (trustworthiness) ◦ Audit requirements Generate reliable evidence by logging and monitoring user action on the database + ◦ Forensics requirements Investigate incidents by identifying, preserving, acquiring and evaluating/analysing evidence to finally report and reflect on the events
• 17.
  Database misuse/fraud ismostly performed by insiders, however in the field of database forensics, this problem has drawn very little attention Reactive approaches for database forensics are more developed, but not fully admissible for forensic purposes Proactive approaches for database forensics are emergent research trends, more flexible for incident response and with higher likelihood of admissibility in legal proceedings
• 18.
  Proactive approaches mustbe formalised methodologically and practically A proactive database forensics architecture should be considered to gather evidence from different sources (network, servers, database) This architecture must consider aspects of both, forensics and auditing activities to ensure evidence integrity