Attacks on businesses computing infrastructure are becoming more sophisticated and potentially more damaging. Threats have escalated as IT organizations are increasingly being asked to provide more services. Security officers are fighting these threats on a daily basis, but their efforts are limited to the effectiveness of various ‘gates’ that are in place. These gates are of little use when the attacker has successfully gained access to the machine as the “root” user. This is because there is no easy way to enable the “root” user to manage the computing environment without also giving them unfettered access to the business data that is stored within that environment – like critical data stored in a database or a file server.
Information theft is defined as any access of sensitive information that is not performed in accordance with the methods provided by the application service and by organizational policies. This form of information theft is typically accomplished by technically capable attackers such as a malicious or compromised “root” user who knows how to get around access controls or exploit existing holes in operating system and application software.
An outside attacker can gain “root” user privileges via advanced persistent threat (APT) or by exploiting holes in the application software, e.g. buffer overflow or via spear phishing. Irrespective of how the attack is launched the motivation remains the same – gain access to the system as the “root” user. Once the attacker assumes “root” privileges then they can launch all types of attacks to gain access to the sensitive information stored in a database server or a file server as discussed below.
A malicious “root” user is an insider who has access, privilege, skill, motivation and knowledge of the process. They can access information directly at the operating system layer. This advanced knowledge about the application and system provides the ability to cover their tracks easily.
From a security perspective there is no difference between a compromised or a malicious “root” user. Below are the main ways that the “root” user privilege can be abused to gain access to the sensitive information.
Privilege Escalation Attack:
A malicious/compromised “root” user can escalate their privileges or assume identity of another user who has been granted access to the sensitive information. This is a very simple type of data theft.
Application Server Attack:
A malicious or compromised “root” user can modify the application server executables or operating system shared libraries thereby compromising the integrity of the server and gain access to data that the server generates and attempts to control. This method can be used to bypass data-at-rest encryption but requires advanced skill set.
Data Tampering Attack:
Data tampering is generally launched by sophisticated attackers who have an endgame in mind e.g. to either disrupt the normal operation of the organization, or tamper specific data sets to compromise other computing systems which may be used for payroll, accounts payable, or storing trade secrets or intellectual property. This type of an attack is very hard to trace. Attackers can use data tampering to manipulate encrypted data sets.
Do not trust the “root” user with your data. This obviously is hard to implement. However, a good data security solution must find a way to protect data against attacks launched by a malicious or compromised “root” user. Server General provides a solution by implementing advanced access control mechanisms that go above and beyond the POSIX based access controls. Both solutions, Server General TDE and Server General KMS, are designed not to trust the “root” user and therefore deny access to the protected data sets.
Use Cases for Server General Solutions
When you encrypt your ePHI using embedded transparent data encryption (TDE) functionality of your MySQL server then you have to ensure the safety of your encryption key that was used to encrypt patient information. Moreover, you will have to rotate your data encryption keys periodically to comply with good security practices. Server General KMS for MySQL can help you manage your MySQL master key in a manner that will make it easy for you to comply with the HIPAA/HITECH Act.
Payment Card Industry Data Security Standard (PCI/DSS)
Businesses rely on Server General KMS for MySQL to meet the PCI DSS mandates when their in-scope data is stored in a MySQL database server and is encrypted using MySQL’s transparent data encryption (TDE) functionality. We have years of experience helping tier-1 customers go through their PCI audits and have designed our solution in a manner that makes it easy to comply with the PCI DSS mandates.
General Data Protection Regulation (GDPR)
The European Union’s General Data Protection Regulation (GDPR) will become effective as of May 25, 2018. Just like California’s SB 1386 data breach notification legislation, GDPR stipulates that any entity that handles EU citizen’s data must provide notification of a successful breach. The law requires the entity to prove that it had put all the right measures in place to protect personal information. Many businesses use the embedded encryption functionality of their MySQL database to protect the sensitive information. Server General KMS for MySQL can help such businesses to manage their MySQL master encryption keys in a secure and compliant manner.
Get Started with Sever General on the CenturyLink Marketplace
If you are a current CenturyLink Cloud customer and you are ready to get started with Server General Data Security Solutions, visit the Server General page on the CenturyLink Marketplace. If you are ready to get started but are not yet a CenturyLink Cloud customer, no problem. Sign-up for a free trial today. Designed for your business needs today and tomorrow, the CenturyLink Cloud is reliable, secure, robust, and global.
We’re a different kind of cloud provider – let us show you why.