A Review of Database Security Concepts, Risks, and Problems

2.1. Thilina [7]

This review has focused on the utilization of virtual resources in storing data for database users. It also includes information on the strategies used to address database security problems, as well as database attack and privacy risk mitigation measures. Organizations may store data and information in databases using an innovative business model that requires no initial investment. It also includes information on database security needs and assets. This review paper covers database security breaching risks, malware activities on such data, and how to address or mitigate those issues, as well as Oracle security database implementation.

2.2. Sharma [8]

This article discusses the security of relational database protection and security frameworks as an example of how internet application security for explicit database authorization may be designed and implemented. Because Relational Database securities are the most popular target for attackers, protection associations and substance are regarded as significant company resources that must be meticulously protected. This research was conducted to identify the problems and risks associated with relational database security, as well as the requirements for relational database set security and how Database Relations are used at different levels to provide security.

2.3. Albalawi [9]

They propose an intelligent system for hiding sensitive data when statistical searches are combined. To begin with, the framework is helpful for defining sensitive information in order for the Admin to make decisions and establish regulations. Second, in the event of rule discrimination based on attribute-orientation, the framework investigates the connection between sensitive and other characteristics, allowing for the selection of attributes that may be used to drive private data.

2.4. Juma and Makupi [10]

In their view, databases are the heart of Information Systems (IS), therefore it is critical to maintain database quality to ensure IS quality. Recently, determining what constitutes a good database model or architecture has proven to be difficult. As a result, they measured certain characteristics and aspects in a database implementation in their discussion. A measure of evaluation is created using the many elements and qualities inherent in a database.

2.5. Odirichukwu and Asagba [11]

They believe that the number of businesses putting their data online is growing every day, enabling people to engage with and manipulate data all around the world. More information on the internet.

As the number of websites on the internet grows, so does the number of database security risks.

Ensuring security in developed applications, owing to a combination of factors a lack of security incentives, a tight timeline, and a web deficit Training on application security testing a review of the literature is presented in this article on twenty database security risks that affect web applications. Control actions that might be taken to prevent this attacks were investigated to raise awareness about online security the general population, as well as application developers. The work expresses an opinion that developers should make every effort to incorporate all of the required features while developing apps, take security precautions. Involvement is also important. All developers should get security testing training. The task at hand despite ensuring sufficient security, the author finds that Admin should develop a method of maintaining a continuous backup of their database apps available online.

2.6. Paul and Aithal [3]

This article discusses the fundamentals of databases, such as their meaning, features, and roles, with an emphasis on various database security issues. Furthermore, this article emphasizes the fundamentals of security management, as well as relevant technologies. As a result, various aspects of database security have been briefly discussed in this article.

2.7. Mousa et al. [12]

According to the authors of this study, assaulters would rather attack the database because of the data sensitivity and value.

Databases compromised in many different ways. The database should be secured against different forms of attacks and threats. Most of the assaults identified in this study can be solved. Some of the assaults are real and some are not. In this article, they discuss various types of assaults.

2.8. Singh and Rai [13]

They concluded that databases are the foundation of modern applications. For businesses, they are the primary storage option. As a result, database attacks are on the rise, but crucially threatening. They give the intruder (InT) access to sensitive information. This study discusses a variety of database assaults. This study also includes a review of relevant database security strategies as well as potential study in the field of database protection. This study will result in a more concrete approach to the database security issue.

2.9. Tabrizchi and Rafsanjani [14]

The goal of this project is to examine the many components of cloud computing as well as the current security and privacy issues that these systems confront. Furthermore, this work introduces a new classification system for recent security solutions in this field. This study also addressed outstanding problems and suggested future approaches, as well as introducing different kinds of security risks that are affecting cloud computing services. This article will concentrate on and investigate the security issues that cloud organizations, such as cloud service providers, data owners, and cloud users, confront.

4.1. First Threat- Excessive Privilege Abuse

As soon as database access privileges given to users that go beyond what is required by their procedure, those privileges can be exploited for malicious purposes. A university Admin with the ability to alter student contact details can also use unnecessary database updating privileges to change grades, which is built-in.

Since Admin cannot identify and replace granularly, databases get admission to privilege management processes for each user, and a user eventually ends up with unnecessary privileges. Consequently, user(s) are given ordinary nonpayment access to privileges that go beyond the requirements of certain tasks [16].

Prevented by: Query-Level Access Control – Excessive Privilege Abuse Prevention

Accessing the question-level for regulation can be the solution of disproportionate rights. A process known as question-degree gets admission to control limits database rights to the bare minimum of SQL operations (select, update, and so on) and facts. The granularity of accessible data manipulations should develop outside the table to include the table rows and columns. A granular query-stage mechanism of accessible control could permit the previously mentioned college Admin updating the contact records while raising certain alarm if trying to change grades. Accessible control of query-stage can be valuable for detecting malicious workers who misuse their privileges but also for detecting unnecessary privilege abuse, in general, as well as for preventing the maximum assaults identified.

Implementation of the database software applications include a certain level of question-diploma management (triggers, row-stage protection, so on so forth), but the directed design of those “built-in” features make them unreasonable for anything but the built-in integrated deployments, the process of manual determination of the question-level access control policy for all database customers. The rows, columns, and operations take much time, to make matters worse, as user functions change over time, we should update query policies to represent the changes! Maximum database Admin will struggle to define a useful question policy for a few customers at a single time, let alone a smaller group of users over time. Consequently, most organizations provide unlimited rights of access to users with special collection of the paintings for a wider range of users. Automated gears are necessary for real-time question-degree access management to become a reality [16].

4.2. Second Threat - Authentic Privilege Abuse

Users to perform unauthorized tasks can use valid database privileges. Consider a hypothetical villain healthcare worker who has access to patient details through an application as the custom web. Internet application architecture usually limits users from accessing the medical history of a single patient. It is not possible to display several facts at the same time; meanwhile, electronic copies are not permitted. The villain worker, on the other hand, can get around those obstacles using a different client, such as MS-Excel connecting the database. The worker can also retrieve and buy all patient records using MS-Excel and the correct login credentials.

Personal copies of medical record files are unlikely to adhere to any healthcare record security policies of organization’s patient. We have to be aware of two risks.

Prevented by: Legitimate Privilege Abuse Prevention

Database access management is the solution for legitimate privilege misuse that applies to queries but also to the context nearby database access. One can probably identify users abusing legitimate database access rights by enforcing a policy of patron packages, place, and time.

4.3. Third Threat - Privilege Elevation

Attackers of database platform software to adjust a regular user access privileges to those of an Admin can also use vulnerabilities. Stored procedures integration, built-in capabilities, implementations of protocols, and square statements may all be vulnerable. For instance, a financial institution software developer may consider taking advantage of a prone feature acquiring database administrative privilege.

The villain developer can disable audit mechanisms; build fictitious versions, transfer funds, and more administrative privileges [13].

Prevented By: Privilege Elevation Preventive – Institution Prevention Systems (IPS) and Query Level Access Control (QLAC)

Combination usage of traditional IPS and QLAC to manipulate, privilege elevate exploitation can be avoided (see excessive privileges above). IPS examines database site users for patterns that may lead to identified weaknesses. Once a characteristic identified as a prone, for instance, IPS most probably blocks the entire access to the prone method or, if likely, blocks the most successful processes with embedded attacks.

4.4. Fourth Threat - Platform Vulnerabilities

Unauthorized entry, data corruption, or service denial can result from flaws in underlying working frameworks (Windows 2000, UNIX, and so on so forth) and extra services installed on a database server. For instance, the blaster computer virus exploited a weakness in Windows 2000 causing a situation of Denial of Service (DoS) [13]. With the advancement of technology, security has improved as well, and as a result, many vulnerabilities have been solved in later versions of Windows or other platforms.

Prevented By: Avoiding Assaults, Updating the Software, and Preventing InTs

Protecting database property requires a mixture of protection programs and the IPS network security. Over-time, provisions of updates by the seller mitigated vulnerabilities discovered in the database platform. Unfortunately, businesses provide and enforce software upgrades regularly. Databases are not covered during the replacement periods. Furthermore, compatibility problems can often prevent software upgrades from happening. IPS must be introduced to address these problems. As mentioned before, IPS examines database visitors and detects assaults aiming recognized defenselessness.

4.5. Fifth Threat - SQL Injection

In certain cases, SQL injection assault, the perpetrator introduction (or “injection”) unauthorized database reports into an inclined SQL channel. Saved approaches and web utility enter parameters are typical instances of oriented record channels. Then these injected reports sent to the database, where they are completed. Using SQL injections permits attackers may acquire unlimited access to all the database [13].

Prevented By: SQL Injection Prevention

IPS query-level gets proper access to governing (see disproportionate Privilege Abuse), and event correlation is three strategies that can be mixed to effectively fight rectangular SQL injection such as:

IPS can detect SQL injection strings or save strategies that are vulnerable to attacks. However, we believe that IPS is unreliable because square inoculation threads are disposed to incorrect positivity. Those managers of protection who exclusively consider IPS application are inundated by viable warnings of SQL injection. Nevertheless, considering the correlation of the SQL inoculation mark along any other breach, including enquiry-stage get-in-to-manipulate violation, it is possible to manipulate the violation, and a real assault can be pinpointed with extreme precision. During normal business operations, SQL inoculation mark as well as any infringement does not probably occur similarly in the submission.

4.6. Sixth Threat - Weak Audit Trail

The inspiration behind the implementation of any database must involve the automated documentation of all sensitive and/or irregular database transactions. In several ways, a shaky database audit policy poses a serious threat to the company.

Prevented by: Preventing Weak Audit

The majority of the vulnerabilities associated with local audit equipment are resolved by high-quality network-based audit home equipment.

4.7. Seven Threat - DoS

Another common form of cyber-attack is the DoS in which demonstrative consumers are denied access to network applications or data. Common techniques may be used to establish DoS conditions, in which many of them can be linked to the mentioned vulnerabilities.

DoS can be motivated by different factors. Ransom scams are often associated with DoS attacks linked to computer, in which a remote attacker constantly crashes computers before depositing money into a global bank account by the victim. A bug infection instead maybe blamed for DoS. Regardless of availability, the seriousness of the threat for most companies maybe posed by DoS [17].

Prevented By: DoS Preventive

DoS preventive necessitates several layers of protection. Protections at the network, software, and database levels are all critical. This study focuses on database-specific security. Recommendation focuses on link charge manipulations, query access control, IPS, and reaction timing controls the database-specific contexts.

4.8. Eighth Threat - Weak Authentication

By stealing or otherwise obtaining login credentials, attackers can predict the identity of legitimate database customers using vulnerable authentication schemes. To acquire credentials, an attacker can use various number of methods available [18].

Prevented By: Preventing Authentication Attacks

1- Strong authentication

It is crucial to use the most advanced realistic authentication technologies and rules. Where possible, two-factor (tokens, certificates, biometrics, etc.) authentication is preferred. Unfortunately, cost and ease of use, frequently furnish authentication impracticality. These situations necessitate the implementation of strict username and password policies (least possible duration, gender selection, as well as obscurity).

2- Directory integration

However, incorporation of strong authentication mechanisms with business enterprises catalogs the substructure for scalability and simplicity of use. The directory structure, among others, allows the user to consider using a particular login detail for numerous database and program. However, it increases the usefulness of double-factor authentication system. Moreover, it is easier for consumers remembering alternative passphrases on a regular basis.

4.9. Ninth Threat - Backup Data Exposure

Database backup in certain cases, storage media is completely unregulated. As a result, stealing backup disks and hard drives have been the focus of many high-profile security breaches.

Prevented by: Preventing Backup Data Exposure

Both backups of databases require encryption application. Indeed, certain carriers stated that the potential products of DBMS not necessarily support the unencrypted backup’s usage. However, online produce of database statistics encryption advised frequently. Nevertheless, key management issues of presentation and cryptographic are frequently impractical, and granular privilege controls described above are in general considered as a weak substitute.

5.1. Access Controller

Is the most basic service, which any DBMS can offer? It has safeguarded data from unauthorized reads and writes. All contact to the database and objects of other systems must adhere to the policies defined by access control. Errors may be serious enough to cause issues in a company’s operations. Admission rights controlling can aid mitigating dangers, which have a direct effect on the database protecting the main server. The access control is able to prevent the deletion or changing of a table made by accident. The access control can rollback, and prevent the deletion of particular files. access control systems consist of:

5.2. Inference Strategy

Data protection at a particular level is critical. It is used once the processing of specific data in the form of facts should stop at a maximum level of protection. It helps the determination of how to keep knowledge from being posted. The inference control aims to prevent information from being revealed indirectly. Unauthorized data disclosure can ocur in one of three ways:

5.3. Identification or Authentication of the User

It is better to know your users as a basic security requirement. After you’ve classified people, you’ll need to determine what privileges and access permissions they have, as well as verifying their data that must use.

Until a user is allowed to construct a database, they should be authenticated in several ways. User identification and authentication are a part of database authentication, the OS or network service can perform an external authentication process. To establish user authentication Secure Sockets Layer (SSL), business parts, and middle-tier server authentication, also known as proxy authentication, can all be used. it is the most basic prerequisite for ensuring protection when considering the identification process which identifies a collection of people who are permitted to access the data. To ensure confidentiality, the authentication of identity initiates preventing unauthorized users from modifying sensitive data. Attackers make use of various methods such as bypass authentication, default password, privilege escalation, brute-force password guessing, and rainbow attack when attempting to breach a user identity and authentication [16].

5.4. Audit and Accountability

Database/non-database users audit and monitor a configured database behavior. Accountability refers to the method of keeping track of user activities on a device. To ensure the physical integrity of the data, auditing checks and accountability are required which necessitates a specific database access carried out with auditing and maintaining the resiliency of the data. If users’ authentication accesses a resource successfully, the system will track all successful and unsuccessful attempts, and attempted accesses and their statuses will show in the audit trail files [16].

5.5. Encryption

It is a method of translating information into cipher or code that only those who have access to the cipher text key can make it ready. Encrypted data is the referral to cipher or encoded text. In a database, there are two states for data security. Data is in two statuses: at rest and in motion – data stored in a database, on a backup disk, or a hard drive. Once transiting through the network, it necessitates the use of various encryption solutions. Any of the problems of data at rest can be solved by encrypting it. Utilize solutions such as SSL/Transport Layer Security for Data in Transit [16].

In the second method any organization may make advantage of a using new technology tool that has a significant effect on database security such as: