Data Management

DATA MANAGEMENT

Challlenges with Data

Security

When multiple organizations share resources there is a risk of data misuse. So, to avoid risk it is necessary to

secure data repositories and also the data that involves storage, transit or process. Protection of data is the most important challenges in cloud computing. To enhance the security in cloud computing, it is important to provide authentication, authorization and access control for data stored in cloud. 

Locality

In cloud computing, the data is distributed over the number of regions and to find the location of data is difficult.

When the data is moved to different geographic locations the laws governing on that data can also change. So there is an issue of compliance and data privacy laws in cloud computing. Customers should know their data location and it is to be intimated by the service provider.

Integrity

The system should maintain security such that data can be only modified by the authorized person. In cloud based environment, data integrity must be maintained correctly to avoid the data lost. In general every transactions in cloud computing should follow ACID Properties to preserver data integrity. Most of the web services face lot of problems with the transaction management frequently as it uses HTTP services. HTTP service does not support transaction or guarantee delivery. It can be handled by implementing transaction management in the API itself.

Access

Data access mainly refers to the data security policies. In an organization, the employees will be given access to the section of data based on their company security policies. The same data cannot be accessed by the other employee working in the same organization. Various encryption techniques and key management mechanisms are used to ensure that data are shared only with the valid users. The key is distributed only to the authorized parties using various key distribution mechanisms. To secure the data from the unauthorized users the data security policies must be strictly followed. Since access is given through the internet for all cloud users, it is necessary to provide privileged user access. User can use data encryption and protection mechanisms to avoid security risk.

Confidentiality

Data is stored on remote servers by the cloud users and content such as data, videos etc.., can be stored with the single or multi cloud providers. When data is stored in the remote server, data confidentiality is one of the important requirements. To maintain confidentiality data understanding and its classification, users should be aware of which data is stored in cloud and its accessibility

Breaches

Data Breaches is another important security issue to be concentrated in cloud. Since large data from various users are stored in the cloud, there is a possibility of malicious user entering the cloud such that the entire cloud environment is prone to a high value attack. A breach can occur due to various accidental transmission issues or due to insider attack.

Segregation

One the major characteristics of cloud computing is multi-tenancy. Since multi-tenancy allows to store data by multiple users on cloud servers there is a possibility of data intrusion. By injecting a client code or by using any application, data can be intruded. So there is a necessity to store data separately from the remaining customer’s data. Vulnerabilities with data segregation can be detected or found out using the tests such as SQL injection aws, Data validation and nsecure storage.

Storage

The data stored in virtual machines have many issues one such issue is reliability of data storage. Virtual machines needs to be stored in a physical infrastructure which may cause security risk.

 Data Center Operation

In case of data transfer bottlenecks and disaster, organizations using cloud computing applications needs to protect the user’s data without any loss. If data is not managed properly, then there is an issue of data storage and data access. In case of disaster, the cloud providers are responsible for the loss of data.

Solutions to Data Security Challenges

Encryption is suggested as a better solution to secure information. Before storing data in cloud server it is better  to encrypt data. Data Owner can give permission to particular group member such that data can be easily accessed by them. Heterogeneous data centric security is to be used to provide data access control.

A data security model comprises of authentication, data encryption and data integrity, data recovery, user protection has to be designed to improve the data security over cloud. To ensure privacy and data security data protection can be used as a service. To avoid access of data from other users, applying encryption on data that makes data totally unusable and normal encryption can complicate availability.

Before uploading data into the cloud the users are suggested to verify whether the data is stored on backup drives and the keywords in files remain unchanged. Calculate the hash of the file before uploading to cloud servers will ensure that the data is not altered. This hash calculation can be used for data integrity but it is very difficult to maintain it.

RSA based data integrity check can be provided by combining identity based cryptography and RSA Signature. SaaS ensures that there must be clear boundaries both at the physical level and application level to segregate data from different users.

Distributed access control architecture can be used for access management in cloud computing. To identify unauthorized users, using of credential or attributed based policies are better. Permission as a service can be used to tell the user that which part of data can be accessed. Fine grained access control mechanism enables the owner to delegate most of computation intensive tasks to cloud servers without disclosing the data contents. A data driven framework can be designed for secure data processing and sharing between cloud users.

SYBILL  ATTACK

Most networks, like a peer-to-peer network, rely on assumptions of identity, where each computer represents one identity. A Sybil attack happens when an insecure computer is hijacked to claim multiple identities. Problems arise when a reputation system (such as a file-sharing reputation on a torrent network) is tricked into thinking that an attacking computer has a disproportionally large influence. Similarly, an attacker with many identities can use them to act maliciously, by either stealing information or disrupting communication. It is important to recognize a Sybil attack and note its danger in order to protect yourself from being a target.

Sybil attacks have appeared in many scenarios, with wide implications for security, safety and trust. For example, an internet poll can be rigged using multiple IP addresses to submit a large number of votes. Some companies have also used Sybil attacks to gain better ratings on Google Page Rank. Reputation systems like eBay's have also been victims of this type of attack.

Targets

● Reputation system

○ eBay: create fake accounts to give positive feedback to a seller

 ● Internet polls

○ use multiple IP addresses to get more votes

● Google Page-Rank

○ create multiple sites that link to a target site to increase its rank.

DNS ATTACK

A DNS attack is an exploit in which an attacker takes advantage of vulnerabilities in the domain name system (DNS).

In order to understand how DNS attacks work, it is important to first understand how the domain name system works. DNS is a protocol that translates a user-friendly domain name, like WhatIs.com, into the computer-friendly IP address 206.19.49.154.

When an end user types the people-friendly domain name WhatIs.com into a client’s browser, a program in the client’s operating system called a DNS resolver looks up WhatIs.com’s numerical IP address. First, the DNS resolver checks its own local cache to see if it already has the IP address for WhatIs.com. If it doesn’t have the address, the resolver then queries a DNS server to see if it knows the correct IP address for WhatIs.com. DNS servers are recursive, which simply means that they can query each other to either find another DNS server that knows the correct IP address or find the authoritative DNS server that stores the canonical mapping of the WhatIs.com domain name to its IP address. As soon as the resolver locates the IP address, it returns the IP address to the requesting program and caches the address for future use.

DNS Poisoning and Spoofing

DNS poisoning can ultimately route users to the wrong website. For example, a user may enter “msn.com” into a web browser, but a page chosen by the attacker loads instead.

Since users are typing in the correct domain name, they may not realize that the website they are visiting is fake.

This creates a perfect opportunity for attackers to use phishing techniques to mine information – be it log in credentials or credit card information – from unsuspecting victims.

Types of DNS attacks include:

Zero day attack – the attacker exploits a previously unknown vulnerability in the DNS protocol stack or DNS server software.

Cache poisoning – the attacker corrupts a DSN server by replacing a legitimate IP address in the server’s cache with that of another, rogue address in order to redirect traffic to a malicious website, collect information or initiate another attack. Cache poisoning may also be referred to as DNS poisoning.

Denial of Service – an attack in which a malicious bot sends send more traffic to a targeted IP address than the programmers who planned its data buffers anticipated someone might send. The target becomes unable to resolve legitimate requests.

Distributed Denial of Service - the attacker uses a botnet to generate massive amounts of resolution requests to a targeted IP address.

What is DOS?

A denial of service attack, often referred to as a “DOS” attack, is a method of stopping a website or service from running. The outcome of this may be causing a website to stop displaying content, or preventing a system that operates on the Internet from working properly. DOS attacks can range in duration and may target more than one site or system at a time. It becomes a distributed DOS, referred to as “DDOS”, when the attack comes from multiple computers (or vectors) instead of one, as is the case in DOS.

A server, or anything connected to the Internet, works by passing data to and from multiple devices in a network, known as nodes. However, each node can only handle a certain amount of traffic – the amount of data being passed between nodes. This happens millions of times a second on the Internet1 but when traffic gets busy, data rates slow down.

A good example of this is ‘Black Friday’ or ‘Cyber Monday’, where millions of people attempt to buy gifts online but can be greeted with error messages rather than the webpage they expect to see. This is because the amount of traffic is too great for the host to handle and so it simply can’t serve each user. There needs to be a two-way communication in order for the customer to be able to interact with the website, but the host has stopped responding because its resources are being completely used up by others.

How does it work?

When a user clicks to load a webpage, a ‘three-way handshake’ begins between the user and the server hosting the webpage, much like making a phone call. A user ‘calls up’ the webpage to initiate a conversation; the webpage answers (“hello?”) and the user responds (“hello, it’s…[name]...”), after that the two participants can converse freely, knowing that each party is active. The diagram shows this handshake between computer and server annotated with their associated flag (SYN and ACK, standing for synchronise and acknowledge). The flags are what is actually communicated by the devices. This process is happening millions of times a day for more popular sites and so the servers that host those sites are designed to handle lots of traffic. A small independent company’s website however, might be hosted on a server that can’t handle as much traffic.

Google Hacking: What is a Google Hack?

Google hacking, sometimes, referred to as Google dorking, is an information gathering technique used by an attacker leveraging advanced Google searching techniques. Google hacking search queries can be used to identify security vulnerabilities in web applications, gather information for arbitrary or individual targets, discover error messages disclosing sensitive information, discover files containing credentials and other sensitive data.

The advanced search string crafted by an attacker could be searching for the vulnerable version of a web application, or a specific file-type (.pwd, .sql...) in order to further restrict the search. The search can also be restricted to pages on a specific site, or it can search for specific information across all websites, giving a list of sites that contain the information.

For instance, the following search query will list SQL files (filetype:sql) available that have been indexed by Google on websites where directory listing is enabled (intitle:"index of").

intitle:"index of" filetype:sql

Similarly, the following search query will list publicly accessible phpMyAdmin installations.

"phpMyAdmin" "running on" inurl:"main.php"

WHAT IS SQL INJECTION

SQL injection, also known as SQLI, is a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed. This information may include any number of items, including sensitive company data, user lists or private customer details.

The impact SQL injection can have on a business is far reaching. A successful attack may result in the unauthorized viewing of user lists, the deletion of entire tables and, in certain cases, the attacker gaining administrative rights to a database, all of which are highly detrimental to a business.

When calculating the potential cost of a SQLI, it’s important to consider the loss of customer trust should personal information such as phone numbers, addresses and credit card details be stolen.

While this vector can be used to attack any SQL database, websites are the most frequent targets.

WHAT ARE SQL QUERIES

SQL is a standardized language used to access and manipulate databases to build customizable data views for each user. SQL queries are used to execute commands, such as data retrieval, updates and record removal. Different SQL elements implement these tasks, e.g., queries using the SELECT statement to retrieve data, based on user-provided parameters.

A typical eStore’s SQL database query may look like the following:

SELECT ItemName, ItemDescription

FROM Item

WHERE ItemNumber = ItemNumber

From this, the web application builds a string query that is sent to the database as a single SQL statement:

sql_query= "

SELECT ItemName, ItemDescription

FROM Item

WHERE ItemNumber = " & Request.QueryString("ItemID")

A user-provided input http://www.estore.com/items/items.asp?itemid=999 can then generates the following SQL query:

SELECT ItemName, ItemDescription

FROM Item

WHERE ItemNumber = 999

As you can gather from the syntax, this query provides the name and description for item number 999.

SQL INJECTION EXAMPLE

An attacker wishing to execute SQL injection manipulates a standard SQL query to exploit non-validated input vulnerabilities in a database. There are many ways that this attack vector can be executed, several of which will be shown here to provide you with a general idea about how SQLI works.

For example, the above-mentioned input, which pulls information for a specific product, can be altered to read http://www.estore.com/items/items.asp?itemid=999 or 1=1.

As a result, the corresponding SQL query looks like this:

SELECT ItemName, ItemDescription

FROM Items

WHERE ItemNumber = 999 OR 1=1

And since the statement 1 = 1 is always true, the query returns all of the product names and descriptions in the database, even those thay you may not be eligible to access.

Attackers are also able to take advantage of incorrectly filtered characters to alter SQL commands, including using a semicolon to separate two fields.

For example, this input http://www.estore.com/items/iteams.asp?itemid=999; DROP TABLE Userswould generate the following SQL query:

SELECT ItemName, ItemDescription

FROM Items

WHERE ItemNumber = 999; DROP TABLE USERS

As a result, the entire user database could be deleted.

Another way SQL queries can be manipulated is with a UNION SELECT statement. This combines two unrelated SELECT queries to retrieve data from different database tables.

For example, the input http://www.estore.com/items/items.asp?itemid=999 UNION SELECT user-name, password FROM USERS produces the following SQL query:

SELECT ItemName, ItemDescription

FROM Items

WHERE ItemID = '999' UNION SELECT Username, Password FROM Users;

Using the UNION SELECT statement, this query combines the request for item 999’s name and description with another that pulls names and passwords for every user in the database.

Database-as-a-Service

Database-as-a-Service (DBaaS) is a service that is managed by a cloud operator (public or private) that supports applications, without the application team assuming responsibility for traditional database administration functions. With a DBaaS, the application developers should not need to be database experts, nor should they have to hire a database administrator (DBA) to maintain the database