Technical Report RHUL–MA–2015–3 4 March 2015
Total Page：16
File Type：pdf, Size：1020Kb
The Value of Threat Models in Enterprise Security Testing of Database Systems & Services Timothy D. Williams Technical Report RHUL–MA–2015–3 4 March 2015 Information Security Group Royal Holloway University of London Egham, Surrey, TW20 0EX United Kingdom www.ma.rhul.ac.uk/tech Student Number: 100758891 Name: Timothy D. Williams The Value of Threat Models in Enterprise Security Testing of Database Systems & Services Supervisor: Dr. Lorenzo Cavallaro Submitted as part of the requirements for the award of the MSc in Information Security at Royal Holloway, University of London I declare that this assignment is all my own work and that I have acknowledged all quotations from the published or unpublished works of other people. I declare that I have also read the statements on plagiarism in Section 1 of the Regulations Governing Examination and Assessment Offences and in accordance with it I submit this project report as my own work. Signature: Date: Academic Year 2013/2014 Copyright c 2013/2014 by Timothy D. Williams Abstract The Value of Threat Models in Enterprise Security Testing of Database Systems & Services by Timothy D. Williams Master of Science in Information Security Royal Holloway, University of London 2013/2014 This thesis explores the value of threat models in organisation-wide security testing of databases. Factors that drive security testing are explored. Different types of security testing, different approaches to threat modeling and different database technologies are considered. The importance of metadata management, particularly for newer schema- less databases, is highlighted. An integrated approach to database security testing is proposed which includes white-box, black-box and grey-box techniques. Sequence de- pendencies affecting database security testing are identified. The need for explicit archi- tecture tiers in database security testing is explained. An approach to threat modeling and testing based on zones is proposed. Potential benefits of the proposed approach are described. The main conclusion is that further research is needed, both theoretical and applied, into the best ways for organisations to plan, execute and respond to database security tests. It is possible that a similar threat-based approach could be applied to testing other architecture components. A number of other possible research topics are identified including: threat information exchanges, threat model tool development and penetration test data management. Keywords: database security, threat modeling, security testing, functional testing, penetration testing, enterprise security, governance, compliance, cybersecurity. iii iv Acknowledgements I am very grateful to my family and in particular to my lovely wife Fiona for supporting me as I have had to prioritise MSc study time and work commitments over time that I would normally have enjoyed with them. I would like to thank my mother Diana for checking late drafts for errors. I am fully responsible for any remaining errors. This project would not have taken shape without the guidance and support of my supervisor Dr. Lorenzo Cavallaro to whom I will feel for ever indebted. My background understanding of systems thinking and software quality assurance owes a great deal to the wonderful Dr. Gerald M Weinberg to whom Phil Stubbington virtually introduced me in an online forum in 1999. I am enormously grateful to Jerry (as he likes to be known) for his writings, for his online mentoring over the years and for the privilege in November 2012 of finally meeting him in person. The way in which I think about information risk management problems and security architecture solutions owes much to what I have learned about “defence in depth” since 2005 through working on secure public sector projects. Although these sources may have indirectly influenced my thinking, only the sources listed in the Bibliography have been relied upon and no classified information is disclosed in this thesis. For making me think hard about metadata management issues and improving my understanding of metadata solutions I am very grateful to my former colleague George McGeachie. For raising my understanding of PostgreSQL security I would like to thank Simon Riggs. For introducing me to attack monitoring in 2010 I would like to thank Joerg Weber. For being a dedicated independent security researcher [11] and supportive work colleague I would like to thank Jerome Athias. A special mention is due to Wayne Grundy for his recommendation in 2010 that I read “The Pyramid Principle: logic in writing and thinking” by Barbara Minto [239]. Whenever I was getting stuck it was a great help to re-read and reflect on the helpful advice that this book provides. I would also like to thank members of the Information Security Group at Royal Holloway, and in particular Dr. Chez Ciechanowicz and Emma Mosley, for their support and understanding during the difficult period following my father’s death at the start of January 2014. v I dedicate this work to the memory of my father Anthony David Williams. I consider myself blessed that along with strong faith, wise words and happy memories Dad passed on his optimistic outlook, enquiring mind and interests in practical details. vi Contents 1 Introduction1 1.1 Audience..................................2 1.2 Motivation.................................3 1.3 Goals....................................6 1.4 Scope....................................6 1.5 Approach..................................7 1.6 Structure..................................8 1.7 Summary Findings............................. 12 I Enterprise Context 15 2 Enterprise Information Governance 17 2.1 Corporate Governance........................... 18 2.2 General Legal Obligations......................... 19 2.3 Specific Legal Requirements........................ 21 2.4 Summary.................................. 22 3 Good Practices 23 3.1 Enterprise Risk Management........................ 23 3.2 Business Analysis.............................. 24 3.3 Data Management............................. 25 3.4 Architecture Frameworks.......................... 25 3.5 IT Service Management.......................... 26 3.6 Cyber Security Frameworks........................ 27 3.7 Lifecycle Models.............................. 28 3.8 Summary.................................. 31 4 Metadata Management 33 4.1 Prerequisites for Database Security.................... 33 4.2 Value of Metadata............................. 34 vii 4.3 Metadata History............................. 35 4.4 Metadata Classification.......................... 35 4.5 Metadata Security............................. 38 4.6 Summary.................................. 38 5 Security Testing 41 5.1 Security Testing Overview......................... 42 5.2 Software Quality Assurance........................ 42 5.3 Security Test Planning........................... 44 5.4 Timing of Security Testing......................... 44 5.5 Security Testing Techniques........................ 45 5.6 Security Testing Methodologies...................... 47 5.7 Security Testing Challenges & Opportunities............... 48 5.8 Summary.................................. 51 6 Threat Modeling 53 6.1 What is Theat Modeling?......................... 53 6.2 Why is Threat Modeling Valuable?.................... 54 6.3 When are Threat Models needed?..................... 55 6.4 Threat Modeling Approaches....................... 55 6.5 Summary.................................. 61 II Database Security Testing 63 7 Database Security Management Review 65 7.1 Overview of Database Security Management............... 65 7.2 Core Database Services.......................... 67 7.3 Database Service Management...................... 69 7.4 Limits of Database Security Management................. 71 7.5 Summary.................................. 72 8 Database Security Technical Review 73 8.1 Traditional Technical Database Security.................. 74 8.2 Database Technology Trends....................... 74 8.3 New Database Security Limitations.................... 75 8.4 Worked Examples of Database Security Attacks.............. 76 8.5 Database Security Test Alignment..................... 78 8.6 Summary.................................. 79 9 Database Security Testing Framework 81 9.1 The Need for Database Security Threat Models.............. 81 9.2 Framework Development Decisions.................... 82 9.3 Framework Description........................... 85 9.4 Framework Rationale............................ 86 9.5 Principles.................................. 90 9.6 Summary.................................. 92 viii III Potential Improvements 93 10 Evaluation 95 11 Conclusions 97 12 Future Directions 99 IV Appendices 103 A. Typographic Information 105 B. Bibliographic Information 107 C. Glossary of Terms 109 D. Enterprise Risk Management 115 E. Software Testing Standards 117 F. NIST Cyber Security Framework 119 Bibliography 120 ix x List of Figures 1.1 Database Security Testing Concept....................1 1.2 Information Security Management process................3 2.1 Corporate Governance Summary...................... 18 3.1 ISO/IEC 9126 Software Quality Attributes................ 25 3.2 ITIL Service Catalogue........................... 27 4.1 Data Value Chain............................. 34 6.1 Threats, Requirements, Mitigations Interplay............... 58 6.2 Vulnerabilities of Countermeasures.................... 59 7.1 DAMA Data Security Management processes............... 70 8.1 NoSQL Data Models............................ 75 xi xii List of Tables 1.1