DATABASE SECURITY for Cyber security 3rd year
Description: DATABASE SECURITY for Cyber security 3rd year students 1st Semester - 2025 Module 5-Attacks Wurood Albayati LAYOUTs Database Attacks Countermeasures Application layer attacks SQLi Buffer Overflow Network and Protocol Attacks
Related Topics
Download Presentation
"DATABASE SECURITY for Cyber security 3rd year" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
slide1. DATABASE SECURITY for Cyber security 3rd year students – 1st Semester - 2025 Module 5-Attacks Wurood Albayati<br>
slide2. LAYOUTs Database Attacks & Countermeasures
Application layer attacks
SQLi
Buffer Overflow
Network and Protocol Attacks
Eavesdropping (sniffing)
Denial of Service(DoS)
Insider and physical attacks
Data Exfiltration by Insider
Privilege escalation
Physical Theft or Compromise<br>
slide3. Database Attacks & Countermeasures We can categorize database attacks into three main areas: These attacks exploit flaws in the application code that handles user input before it reaches the database These attacks involve actors who have or gain legitimate access to the environment.. These attacks target the connection or the database's exposed services.<br>
slide4. Attack Vector: SQL Injection (SQLi)
An attacker injects malicious SQL commands into an input field (like a login box) that the application poorly validates, causing the database to execute the attacker's query. This is a primary method for bypassing authentication and extracting data.
Suppose you have a SQL table called Accounts containing user accounts. This table has the following fields: The query will search the database and return the Address field for any row that matches the LastName of Salam Using SQL I can retrieve the address of a specific user with a this query :
SELECT Address FROM Accounts WHERE LastName=“Salam" What happen If I enter : SELECT Address FROM Accounts WHERE LastName=‘ Lara’ OR 1=1 1-Application-Layer Attacks (The Most Common)<br>
slide5. Preventing SQL Injection(Countermeasures) Parameterized Queries (Prepared Statements): This is the most critical defense. It ensures the database engine treats user input strictly as data, not as executable code.
Input Validation: Strict server-side checking to ensure input matches the expected format (e.g., only numbers allowed in a quantity field).
Least Privilege: Ensure the application account only has necessary permissions (SELECT/INSERT). If an SQLi attack occurs, the damage
is contained.<br>
slide6. 2- Attack Vector: Buffer Overflow
Exploiting vulnerabilities in the application or database code that allow an attacker to write more data into a fixed-length memory buffer than it can hold, overwriting adjacent memory and potentially injecting malicious code.
Countermeasures:
1- Secure Development Practices: Use
memory-safe languages and frameworks.
2- Patch Management: Ensure the DBMS
and underlying operating system are
always fully patched, as vendor updates
often address these low-level memory
vulnerabilities 1-Application-Layer Attacks<br>
slide7. 1- Attack Vector: Network Eavesdropping (Sniffing)
An attacker monitors network traffic between the application and the database
to capture credentials or sensitive data being sent in clear text.
Countermeasures:
Encryption in Transit (SSL/TLS): Mandatory use of SSL/TLS encryption for all database connections. Credentials and data must never cross the network unencrypted.
Network Segmentation: Isolate the database server in a secure network zone that is firewalled off from public access and general internal networks 2-Network and Protocol Attacks<br>
slide8. 2-Network and Protocol Attacks 2-Attack Vector: Denial of Service (DoS/DDoS)
Overwhelming the database server with excessive requests or large, resource-intensive
queries, causing it to crash or become unresponsive (exhausting CPU,
RAM, or network capacity).
Countermeasures:
Traffic Filtering: Use firewalls and load balancers to block known malicious IP addresses or limit the connection rate.
Resource Throttling: Configure the database to limit the resources (CPU, session count) any single user or application can consume.
High Availability/Clustering: Use database clustering and replication to distribute the load and ensure service availability even if one node fails<br>
slide9. 3-Insider and Physical Attacks 1-Attack Vector: Data Exfiltration by Insider
An authorized user (e.g., a DBA, analyst, or developer) abuses their privileges to download, copy, or sell large volumes of sensitive data.
Countermeasure
1- Comprehensive Auditing: Log all SELECT statements on highly sensitive tables (PII, financial). Integrate logs into a SIEM system to detect unusual behavior (e.g., a massive data query at 2 AM).
2-Separation of Duties: Ensure the DBA role responsible for system integrity cannot also be the primary user who accesses patient or financial data<br>
slide10. 3-Insider and Physical Attacks 2- Attack Vector: Privilege Escalation
A low-privileged user or an exploited application finds a vulnerability or misconfiguration to gain
super-admin rights (e.g., gaining the sysadmin role)
Countermeasures:
1- Regular Audits: Conduct routine security configuration reviews and Access Reviews (quarterly) to ensure no accounts are accidentally over-privileged.
2- Database Hardening: Disable unnecessary default accounts,
stored procedures, and services that could be exploited to elevate privileges<br>
slide11. 1-Attack Vector: Physical Theft or Compromise
An attacker steals a physical database backup tape, a hard drive, or gains unauthorized physical access to the server room
Countermeasurre
1-Encryption at Rest (TDE): Mandatory use of Transparent Data Encryption (TDE) to encrypt the entire database file. If the physical drive is stolen, the data remains scrambled
2-Secure Backup Storage: Encrypt all backup files and store them securely, often in an immutable off-site or cold storage location 3-Insider and Physical Attacks<br>
slide12. The most effective strategy against these attacks is to create a Defense-in-Depth system that combines secure application development, strong access control, and continuous monitoring and auditing<br>
slide2. LAYOUTs Database Attacks & Countermeasures
Application layer attacks
SQLi
Buffer Overflow
Network and Protocol Attacks
Eavesdropping (sniffing)
Denial of Service(DoS)
Insider and physical attacks
Data Exfiltration by Insider
Privilege escalation
Physical Theft or Compromise<br>
slide3. Database Attacks & Countermeasures We can categorize database attacks into three main areas: These attacks exploit flaws in the application code that handles user input before it reaches the database These attacks involve actors who have or gain legitimate access to the environment.. These attacks target the connection or the database's exposed services.<br>
slide4. Attack Vector: SQL Injection (SQLi)
An attacker injects malicious SQL commands into an input field (like a login box) that the application poorly validates, causing the database to execute the attacker's query. This is a primary method for bypassing authentication and extracting data.
Suppose you have a SQL table called Accounts containing user accounts. This table has the following fields: The query will search the database and return the Address field for any row that matches the LastName of Salam Using SQL I can retrieve the address of a specific user with a this query :
SELECT Address FROM Accounts WHERE LastName=“Salam" What happen If I enter : SELECT Address FROM Accounts WHERE LastName=‘ Lara’ OR 1=1 1-Application-Layer Attacks (The Most Common)<br>
slide5. Preventing SQL Injection(Countermeasures) Parameterized Queries (Prepared Statements): This is the most critical defense. It ensures the database engine treats user input strictly as data, not as executable code.
Input Validation: Strict server-side checking to ensure input matches the expected format (e.g., only numbers allowed in a quantity field).
Least Privilege: Ensure the application account only has necessary permissions (SELECT/INSERT). If an SQLi attack occurs, the damage
is contained.<br>
slide6. 2- Attack Vector: Buffer Overflow
Exploiting vulnerabilities in the application or database code that allow an attacker to write more data into a fixed-length memory buffer than it can hold, overwriting adjacent memory and potentially injecting malicious code.
Countermeasures:
1- Secure Development Practices: Use
memory-safe languages and frameworks.
2- Patch Management: Ensure the DBMS
and underlying operating system are
always fully patched, as vendor updates
often address these low-level memory
vulnerabilities 1-Application-Layer Attacks<br>
slide7. 1- Attack Vector: Network Eavesdropping (Sniffing)
An attacker monitors network traffic between the application and the database
to capture credentials or sensitive data being sent in clear text.
Countermeasures:
Encryption in Transit (SSL/TLS): Mandatory use of SSL/TLS encryption for all database connections. Credentials and data must never cross the network unencrypted.
Network Segmentation: Isolate the database server in a secure network zone that is firewalled off from public access and general internal networks 2-Network and Protocol Attacks<br>
slide8. 2-Network and Protocol Attacks 2-Attack Vector: Denial of Service (DoS/DDoS)
Overwhelming the database server with excessive requests or large, resource-intensive
queries, causing it to crash or become unresponsive (exhausting CPU,
RAM, or network capacity).
Countermeasures:
Traffic Filtering: Use firewalls and load balancers to block known malicious IP addresses or limit the connection rate.
Resource Throttling: Configure the database to limit the resources (CPU, session count) any single user or application can consume.
High Availability/Clustering: Use database clustering and replication to distribute the load and ensure service availability even if one node fails<br>
slide9. 3-Insider and Physical Attacks 1-Attack Vector: Data Exfiltration by Insider
An authorized user (e.g., a DBA, analyst, or developer) abuses their privileges to download, copy, or sell large volumes of sensitive data.
Countermeasure
1- Comprehensive Auditing: Log all SELECT statements on highly sensitive tables (PII, financial). Integrate logs into a SIEM system to detect unusual behavior (e.g., a massive data query at 2 AM).
2-Separation of Duties: Ensure the DBA role responsible for system integrity cannot also be the primary user who accesses patient or financial data<br>
slide10. 3-Insider and Physical Attacks 2- Attack Vector: Privilege Escalation
A low-privileged user or an exploited application finds a vulnerability or misconfiguration to gain
super-admin rights (e.g., gaining the sysadmin role)
Countermeasures:
1- Regular Audits: Conduct routine security configuration reviews and Access Reviews (quarterly) to ensure no accounts are accidentally over-privileged.
2- Database Hardening: Disable unnecessary default accounts,
stored procedures, and services that could be exploited to elevate privileges<br>
slide11. 1-Attack Vector: Physical Theft or Compromise
An attacker steals a physical database backup tape, a hard drive, or gains unauthorized physical access to the server room
Countermeasurre
1-Encryption at Rest (TDE): Mandatory use of Transparent Data Encryption (TDE) to encrypt the entire database file. If the physical drive is stolen, the data remains scrambled
2-Secure Backup Storage: Encrypt all backup files and store them securely, often in an immutable off-site or cold storage location 3-Insider and Physical Attacks<br>
slide12. The most effective strategy against these attacks is to create a Defense-in-Depth system that combines secure application development, strong access control, and continuous monitoring and auditing<br>