DATABASE SECURITY for Cyber security 3rd year

Attack Vector: SQL Injection (SQLi)
An attacker injects malicious SQL commands into an input field (like a login box) that the application poorly validates, causing the database to execute the attacker's query. This is a primary method for bypassing authentication and extracting data.
Suppose you have a SQL table called Accounts containing user accounts. This table has the following fields: The query will search the database and return the Address field for any row that matches the LastName of Salam Using SQL I can retrieve the address of a specific user with a this query :

SELECT Address FROM Accounts WHERE LastName=“Salam" What happen If I enter : SELECT Address FROM Accounts WHERE LastName=‘ Lara’ OR 1=1 1-Application-Layer Attacks (The Most Common)<br>

Preventing SQL Injection(Countermeasures) Parameterized Queries (Prepared Statements): This is the most critical defense. It ensures the database engine treats user input strictly as data, not as executable code.
Input Validation: Strict server-side checking to ensure input matches the expected format (e.g., only numbers allowed in a quantity field).
Least Privilege: Ensure the application account only has necessary permissions (SELECT/INSERT). If an SQLi attack occurs, the damage
is contained.<br>

2- Attack Vector: Buffer Overflow
Exploiting vulnerabilities in the application or database code that allow an attacker to write more data into a fixed-length memory buffer than it can hold, overwriting adjacent memory and potentially injecting malicious code.

Countermeasures:
1- Secure Development Practices: Use
memory-safe languages and frameworks.
2- Patch Management: Ensure the DBMS
and underlying operating system are
always fully patched, as vendor updates
often address these low-level memory
vulnerabilities 1-Application-Layer Attacks<br>

1- Attack Vector: Network Eavesdropping (Sniffing)
An attacker monitors network traffic between the application and the database
to capture credentials or sensitive data being sent in clear text.
Countermeasures:
Encryption in Transit (SSL/TLS): Mandatory use of SSL/TLS encryption for all database connections. Credentials and data must never cross the network unencrypted.
Network Segmentation: Isolate the database server in a secure network zone that is firewalled off from public access and general internal networks 2-Network and Protocol Attacks<br>

2-Network and Protocol Attacks 2-Attack Vector: Denial of Service (DoS/DDoS)
Overwhelming the database server with excessive requests or large, resource-intensive
queries, causing it to crash or become unresponsive (exhausting CPU,
RAM, or network capacity).
Countermeasures:
Traffic Filtering: Use firewalls and load balancers to block known malicious IP addresses or limit the connection rate.
Resource Throttling: Configure the database to limit the resources (CPU, session count) any single user or application can consume.
High Availability/Clustering: Use database clustering and replication to distribute the load and ensure service availability even if one node fails<br>

3-Insider and Physical Attacks 1-Attack Vector: Data Exfiltration by Insider
An authorized user (e.g., a DBA, analyst, or developer) abuses their privileges to download, copy, or sell large volumes of sensitive data.
Countermeasure
1- Comprehensive Auditing: Log all SELECT statements on highly sensitive tables (PII, financial). Integrate logs into a SIEM system to detect unusual behavior (e.g., a massive data query at 2 AM).
2-Separation of Duties: Ensure the DBA role responsible for system integrity cannot also be the primary user who accesses patient or financial data<br>

3-Insider and Physical Attacks 2- Attack Vector: Privilege Escalation
A low-privileged user or an exploited application finds a vulnerability or misconfiguration to gain
super-admin rights (e.g., gaining the sysadmin role)
Countermeasures:
1- Regular Audits: Conduct routine security configuration reviews and Access Reviews (quarterly) to ensure no accounts are accidentally over-privileged.
2- Database Hardening: Disable unnecessary default accounts,
stored procedures, and services that could be exploited to elevate privileges<br>

1-Attack Vector: Physical Theft or Compromise
An attacker steals a physical database backup tape, a hard drive, or gains unauthorized physical access to the server room
Countermeasurre
1-Encryption at Rest (TDE): Mandatory use of Transparent Data Encryption (TDE) to encrypt the entire database file. If the physical drive is stolen, the data remains scrambled
2-Secure Backup Storage: Encrypt all backup files and store them securely, often in an immutable off-site or cold storage location 3-Insider and Physical Attacks<br>

The most effective strategy against these attacks is to create a Defense-in-Depth system that combines secure application development, strong access control, and continuous monitoring and auditing<br>