Slide Set #24: Database security SY306 Web and Databases for Cyber Operations

2 DBMS Security DBMS products provide security facilities They limit certain actions on certain objects to certain users or groups (also called roles) Privilege: Right to perform a particular action on a particular object and is associated with a particular user Principle of least privilege Example? MIDS Database

3 GRANT and REVOKE Command GRANT: grants privileges REVOKE: removes priviledges Privileges: –SELECT –INSERT, DELETE, UPDATE –CREATE, ALTER, DROP

4 GRANT Syntax GRANT privileges ON object TO user [IDENTIFIED BY 'password'] [WITH GRANT OPTION] Example: GRANT ALL ON le.* TO user IDENTIFIED BY ‘userpword’ GRANT Select ON le.products TO user IDENTIFIED BY ‘userpword’

5 REVOKE Syntax REVOKE priv_type ON object FROM user [, user] Example: REVOKE ALL ON le.* FROM user1 REVOKE Insert ON le.products FROM user1, user2

ICE: DB User Security Use MySQL workbench to connect to your database on mope With a partner: 1.Try to select all shipments from your partner’s SHIPMENT table (from Lab10) 1.Select * from mYYYYYY.SHIPMENT 2.Did it work? 2.Ask partner to grant you select privileges on his SHIPMENT table 1.Try again the select statement. Did it work? 3.Ask partner to revoke your privileges on their table 4.Switch roles with your partner, so you can grant/revoke privileges for him/her

7 Changing the Password SET PASSWORD [FOR = PASSWORD('newpass'); Example: SET PASSWORD=PASSWORD(‘newpword’) While logged into DB:

8 Application Security If DBMS security features are inadequate, additional security code could be written in application program Use the DBMS security features first –Native DBMS security features are faster, cheaper, and probably result in higher quality results than developing your own

Application Users Passwords –Enforce Strong password policies –Never store passwords in plain text! –Hash passwords and store it

10 Making your MySQL Database Secure - Server Do not run MySQL (mysqld) as system’s root! –Set up a user just for running the server –Make directories accessible just to this user Run MySQL server behind a firewall

11 Making your MySQL Database Secure - Passwords Make sure all users have strong passwords Connecting from Python: –Have the user and password stored in a file and include this file when needed –Store config.py outside web tree –Store passwords only in.py files (not.inc,.txt, etc.) Do not store application passwords in plain text. Use hashing. Use salt Iterate

12 Making your MySQL Database Secure – User Privileges Use principle of least privilege: –Grant only the privileges actually needed to each user –Grant access only from the host(s) that they will be connecting from

13 Making your MySQL Database Secure – Web Issues Check all data coming from user (SQL Injection Attacks!!) Use parametrized queries