Cryptography in the Database: The Last Line of Defense Paperback – Oct 19 2005
No Kindle device required. Download one of the Free Kindle apps to start reading Kindle books on your smartphone, tablet, and computer.
To get the free app, enter your mobile phone number.
From the Inside Flap
Cryptography in the DatabasePrefaceAbout This Book
This book is about using established cryptographic techniques and algorithms to protect information while it is at rest in a database. The emphasis is on designing and building (or selecting and integrating) a cryptosystem to protect against clearly identified threats against the database. Security is assumed to be a top priority. As such, the discussions in this book cover not only encrypting the data, but also attacks against the encrypted data.
If the cryptography is not implemented carefully, attackers can recover data even if it is protected by strong encryption. Many examples of this have been seen in the field of secure communications. For instance, the widely publicized weaknesses in the encrypted wireless protocol WEP have prompted many to move to WPA even at the cost of buying new equipment. Database encryption can suffer from the same sort of weaknesses. Simple, naïve encryption of the data is not enough. My goal is to provide a solid blueprint and execution plan so that a team charged with the task of encrypting sensitive information in a database will be successful.
The cryptosystem presented in this book should be seen as a template that outlines threats against data at rest and provides safeguards against those threats. Problems and pitfalls common to implementing cryptography, such as mode selection and key management, are identified and addressed. The architecture is flexible and should be adaptable to many environments.
For situations where some element of the presented solution simply does not fit, you should find enough information and guidance to pursue variations in the design. Similarly, when you're evaluating database cryptosystems from vendors, you can use the design in this book and the reasons behind the decisions that shaped that design as a sort of baseline.
Even if the proposed system differs markedly from the design in this book, it will still have to map keys to columns and rows and provide a key life cycle. It will still have to store and protect keys, select an appropriate encryption mode, and handle initialization vectors. Most importantly, any solution must adequately reduce the risks outlined in an organization's threat model. You must consider all these details. By working through these issues and presenting a working cryptosystem, my hope is that this book will enable a team to successfully build or buy a database cryptosystem.Who Should Read This Book
The core audience for this book is the technical lead responsible for protecting sensitive information in a database. This person might be an architect, a senior system or security analyst, a database administrator, or a technical project manager. Because success requires that the team implement the cryptographic architecture correctly and securely, the lead must provide guidance throughout the project on secure development practices as well as technology.
This book assumes that the technical lead is a senior application security analyst. Our analyst is part of a team responsible for an application that handles and stores sensitive information in a database. The analyst's job begins with convincing the team, its management, and the customer that encryption is necessary. From there, the analyst contributes to each stage of the project to ensure that the team specifies, designs, and implements the cryptographic solution correctly and securely.
Forprojects that don't have a dedicated security analyst, one of the other roles, such as architect or system analyst, may serve just as well so long as security is explicitly called out as a core responsibility. In some projects, the security analyst role described here might be best split across multiple people. A logical split would be between a security-focused technical lead, such as the architect, and the project manager.Prerequisites
This book assumes that you are familiar with databases and have a passing knowledge of cryptography. A brief refresher is offered on databases, and cryptography is introduced and treated in more depth. Experience with Java or some other programming language is necessary to get the most out of the code examples included at the end of the book. Knowledge of application development methodologies will also help provide context for the discussion of secure development practices.Structure
This book is divided into four major parts. The opening covers database security at a high level, and the second part details a database cryptosystem design. The third part discusses development practices necessary to implement a cryptosystem securely, and the final part provides working code examples of the design.
Part I, "Database Security," opens, unsurprisingly, with Chapter 1, "The Case for Database Security," which looks at why database security is important and what sort of attacks databases face. This discussion culminates in a generalized threat model for database security. The chapter concludes with a brief survey of regulatory requirements to secure data. Then, Chapter 2, "Securing Databases with Cryptography," discusses the kinds of protection that cryptography can provide to a database. This chapter also introduces the idea that the cryptography itself can introduce new risks and sets the groundwork for examining the cryptosystem itself forweaknesses. We can't just assume that encrypted data, even when encrypted with strong algorithms, is secure.
Part II, "A Cryptographic Infrastructure," details the design of a cryptographic infrastructure. Chapter 3, "An Overview of Cryptographic Infrastructure," provides an overview of the cryptosystem and presents the fundamentals of key management and how keys are assigned to data for encryption. Chapter 4, "Cryptographic Engines and Algorithms," covers algorithms and engines. An engine is the component that actually carries out the cryptographic operations. Different types of engines are discussed. There are several ways to apply the cryptographic algorithm used in this book (which is AES), and the discussion of modes at the conclusion of this chapter explores these as well as considers the vulnerabilities that improper use of a mode can introduce. Chapter 5, "Keys: Vaults, Manifests, and Managers," covers the components that store and manage keys, and Chapter 6, "Cryptographic Providers and Consumers," describes how an application interacts with the cryptosystem.
At first, Part III, "The Cryptographic Project," may seem somewhat out of place because it focuses on secure development practices. If you're an expert on developing secure applications, these six chapters may be review. However, experience has shown (not to mention the plethora of successfully attacked applications gracing the weekly news) that secure application development expertise is far from common. A database cryptosystem is a primary element of an organization's security infrastructure. Other applications will depend on thecryptosystem's security, so every effort must be made to ensure that the implementation is as secure as possible. Vulnerabilities in the database cryptosystem put data throughout the organization at risk. The seriousness of this situation earned the topic this prominent placement.
The discussion of secure development practices begins with an overview of managing a cryptographic project in Chapter 7, "Managing the Cryptographic Project." Chapter 8, "Requirements Hardening," covers specifying security and cryptographic requirements and includes a discussion of data classification. Securing the design itself is the subject of Chapter 9, "Design Hardening," which consists of guidelines, threat modeling, and the application of security patterns. General guidelines for secure programming (what most people think of as development) are covered in Chapter 10, "Secure Development." The last two chapters of this part, Chapters 11, "Testing," and 12, "Deployment, Defense, and Decommissioning," cover testing and the three Dsdeployment, defense, and decommissioning.
Part IV, "Example Code," consists of code examples and explanations. Each component discussed in Part II is represented, along with nearly all the core functionality. This code lets you explore and experiment with the functioning of a live database cryptosystem. Hopefully these concrete examples will help remove any ambiguities introduced by the more theoretical exposition in the earlier parts of the book and will prepare you to implement or evaluate a production cryptosystem. The final chapter, Chapter 21, "The System at Work," shows the example system at work.It illustrates everything from setting up key-encrypting keys to searching for encrypted data.© Copyright Pearson Education. All rights reserved.
From the Back Cover
Protect Your Enterprise Data with Rock-Solid Database Encryption
If hackers compromise your critical information, the results can be catastrophic. You're under unprecedented pressurefrom your customers, your partners, your stockholders, and now, the governmentto keep your data secure. But what if hackers evade your sophisticated security mechanisms? When all else fails, you have one last powerful line of defense: database cryptography. In this book, a leading crypto expert at Symantec demonstrates exactly how to use encryption with your own enterprise databases and applications.
Kevin Kenan presents a start-to-finish blueprint and execution plan for designing and buildingor selecting and integratinga complete database cryptosystem. Kenan systematically shows how to eliminate weaknesses, overcome pitfalls, and defend against attacks that can compromise data even if it's been protected by strong encryption.
This book's 3,000 lines of downloadable code examples let you explore every component of a live database cryptosystem, including key vaults and managers, manifests, engines, and providers.
This book's coverage includes
Understanding your legal obligations to protect data
Constructing a realistic database security threat model and ensuring that you address critical threats
Designing robust database cryptographic infrastructure around today's most effective security patterns
Hardening your database security requirements
Classifying the sensitivity of your data
Writing database applications that interact securely with your cryptosystem
Avoiding the common vulnerabilities that compromise database applications
Managing cryptographic projects in your enterprise database environment
Testing, deploying, defending, and decommissioning secure database applications
Cryptography in the Database is an indispensable resource for every professional who must protect enterprise data: database architects, administrators, and developers; system and security analysts; and many others.
© Copyright Pearson Education. All rights reserved.See all Product Description
Most Helpful Customer Reviews on Amazon.com (beta)
The code examples are MySQL and Java 1.4.2 and really helped me understand just what needs to happen. The majority of the book is platform agnostic, so if you run a different platform it will still be valuable.
The book is well written, well edited, well laid out, what you expect to see from Addison-Wesley and Symantec Press.
The only thing that drove me crazy about the book is on page 163, the author recommends HSMs ( Hardware Security Model) for storing the keys to the kingdom, yup, yup, I agree, we all agree. And then he goes on to say, Java 1.4.2 does not support this -- ouch! However, his code examples are a nice work around using AES on the local engine which is good'nuff.
Got sensitive data? Then get this book!
As a result, I enjoyed the part I on database security with motivations, attacks against databases, threat models and a primer on securing databases with cryptography. If you are "doing security" read part I, if you are implementing database encryption or record hashing - read the rest of the book.
Dr Anton Chuvakin, GCIA, GCIH, GCFA is a recognized security expert and book author. A frequent conference speaker, he also participates in various security industry initiatives and standard organizations. He is an author of a book "Security Warrior" and a contributor to "Know Your Enemy II", "Information Security Management Handbook" and the upcoming "Hacker's Challenge 3". He also published numerous papers on a broad range of security subjects. In his spare time he maintains his security portal [...] and a blog at [...]
The book is divided into four major parts: Database Security, A Crpytographic Infrastructure, The Cryptographic project, and Example Code. I however would calssify the book into two major parts. The first part is reading and understanding some fundamentals that are very important. Throughout this first part, there are many graphical presentations to help the reader understand, in a graphical way, what the author is discussing. This is most visible in the third chapter entitled An overview of Cryptographic Infrastructure.
The second part of the book is actual code written in Java, and designed for plain SQL, the author does confirm that all examples work in MYSQL. The examples give common scenarios such as consumer input. Consumer input requires first name, last name, credit card information, the verification code and other fields. This example discusses and demonstrates a best practice model around that code.
Given the two parts above, this book is solid, and I would have recommended it. However, the author went a step further, and included information on security surrounding the database, penetration testing and methodologies for databases, architecture and design best practices, and so many other important points. This makes this book valuable to anyone working with databases.
The section breakdown is as follows:
* Database Security - Common Attacks Against Databases; Laws and Regulations; and Cryptography
* Cryptographic Infrastructure - Introduction to Keys, and Their Management; Engines and Algorithms; and Vaults, Manifests and Managers
* The Cryptographic Project - Outlines the Security Culture; Hardening, Classifications, and Policies; Securing Design; Securing Development; and Testing
* Example Code - Key Vaults; Manifest; Key Managers; Engines; Receipts and the Provider; The Consumer; Exceptions; and the System at Work.
Overall this book is geared to medium level technicians for best practices and coding examples. Although anyone working with databases in general could find something useful in this book, even if its design, architecture and implementation best practices.
Here, you still have to defend against network attacks, possibly by using the above tools. But now there is the chance that your users or sysadmins might have nefarious intent. So the book shows how to design a system such that various columns in a SQL table can be encrypted. Different keys could be used for different columns, though a given key might apply over several columns if you wish.
The book uses a symmetric key cryptosystem. It downplays a PKI system. Those are slower. Plus their forte might be for distributed systems. Here, the scenario is more likely to be a central data centre.
There are several excellent system diagrams that nicely describe the data flow, and the various software (and perhaps hardware) players that make up the system. In essence, there needs to be an entire key management system along with a cryptographic engine. The former handles requests for a key by generating one and an alias for the key. Plus it stashes away the keys, preferably in a separate computer. There is even the necessity for a key to encrypt the keys!
Kenan also explains a "honeycomb". You may have heard of a honeypot, which is a dedicated computer or maybe an email account, that is used to attract crackers and spam. Well, a honeycomb could be a table in the database used for a similar purpose. Or even some rows in a given table. If these are accessed, software alarms go off, because no normal usage of the database should do so. Nifty idea.
Code examples for a simple system implementation are given in Java. Though if you are considering this book, you are likely no tyro in whatever language you use. The Java code is straightforward enough to be understandable and recoded.
I think the book delivered a best-practice approach, but I didn't find it as useful as I'd hoped despite learning a lot both theoretically and practically.
There are a number of caveats I wish I'd known about this book, in rough order of importance:
1) If you aren't using HSM hardware to store the keys, this book's practical usefulness appears to decline a fair bit, a point the author seems to acknowledge. Your key information ends up stored in databases or systems which themselves can be compromised. There's a lot of machinery to encrypt the keys and replace them over time, but fundamentally you are just raising barriers with this approach, not really securing anything (as far as I can tell). It seemed like a lot of implementation complexity for a mild amount of obscurity, as far as I was concerned (since the book is published!) If, say, you have a webserver connecting to a database and your webserver is compromised, and the attacker can get to your database, the encryption here will slow, but not stop them. If only the database or its backup is compromised though, his stuff is great; it'd be hard to recover the data. But that's not the threat model I think most web-facing database companies are concerned about; there the webserver gets compromised first. In a webserver+database-noHSM model, I'm not sure all the obscurity his system provides is worth the implementation complexity-- a simpler alternative approach that provides most of the benefits would have been helpful.
2) The book's approach does not describe/give-code-for any practices or infrastructure in which one might store (or migrate) some information (e.g. credit cards) offline in an attempt to secure it, placing the information online only temporarily (e.g. when doing recurring billing, sending email blasts with personal information, etc).
3) The book does not cover any asymmetric encryption techniques, dismissing them early on since they "aren't necessary for solving the problems in which we're interested". Maybe I'm missing something, but it would seem to me that if the usage/data-retrieval model for one's application allowed use of offline private keys (or a password to unencrypt an private key) entered at the time of data retrieval, data in the database could be stored write-only by an application (using a public key stored in a database) and delivered read-only only-to-an-authorized-user without ever storing the key information necessary for read-able retrieval in any online database. (This assumes the information never needs to be read by the application without the user present.)
4) The Java code is fairly helpful but, as the author notes, it's a prototype and you will need to add alerting and exception handling for any production system.
All this doesn't make the book "bad"; it's a very good primer on symmetrically encrypting information in a database and managing the entire security process surrounding that. I concur with the other good reviews here; it probably is a 4-5 star book for most people. But I found myself just hoping for something simpler (given the assumption of no HSM) and/or more secure (when facing different usage constraints) than what I was left with.
Look for similar items by category
- Books > Computers & Technology > Databases
- Books > Computers & Technology > History & Culture > Privacy
- Books > Computers & Technology > Internet & Social Media
- Books > Computers & Technology > Networking & Cloud Computing > Internet, Groupware, & Telecommunications
- Books > Computers & Technology > Networking & Cloud Computing > Network Security
- Books > Computers & Technology > Networking & Cloud Computing > Networks, Protocols & APIs
- Books > Computers & Technology > Programming > Algorithms > Cryptography
- Books > Computers & Technology > Security & Encryption > Cryptography
- Books > Computers & Technology > Security & Encryption > Privacy & Online Safety
- Books > Computers & Technology > Software > Databases
- Books > Computers & Technology > Web Development > Security & Encryption > Encryption
- Books > Qualifying Textbooks - Fall 2007 > Computers & Internet
- Books > Textbooks > Computer Science & Information Systems > Database Storage & Design
- Books > Textbooks > Computer Science & Information Systems > Networking