Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

A number of texts signify that the most important aspects offered by a DBMS are availability, integrity, and secrecy. As part of a homework assignment I have been tasked with mentioning attacks which would affect each aspect. This is what I have come up with - are they any good?

  • Availability - DDOS attack
  • Secrecy - SQL Injection attack
  • Integrity - Use of trojans to gain access to objects with higher security roles
share|improve this question
2  
Have you asked your instructor? Generally that's the best way to get feedback on your answers to homework questions. – D.W. Jun 8 '12 at 17:09

1 Answer

up vote 7 down vote accepted

These three properties are usually known as the CIA triad: confidentiality, integrity and availability. They are the three main classes of security properties of any system (though not all properties fit within those three classes).

Confidentiality (i.e. secrecy) means that an attacker cannot read data that she is not supposed to be able to access. An SQL injection attack is one way to break confidentiality, if the attacker is able to inject or modify a SELECT statement (for example). An SQL injection attack could also compromise integrity, if the attacker can inject an INSERT or an UPDATE or a DELETE or other statements that modify the database.

Integrity means that the attacker cannot write to the database in unauthorized ways. It covers the addition of extra entries, modification of existing entries, deletion of entries, and anything else that changes the data. Using a trojan could compromise the database, but accessing objects with higher security roles would only be a breach of integrity if you meant a write access: a read access would break confidentiality.

Availability means that the attacker cannot prevent others from using the database. A DDOS attack is indeed a way to break availability.

There are, of course, many other ways to break these properties.

share|improve this answer
1  
That was very useful. Could you mention some other methods to limit availability please? – Johnny Jun 6 '12 at 21:41
If you can lock tables with SQL, you can manage to make everybody wait on the lock. But that requires SQL access. You can also take lots of ressources with crafted query ( either one that fill the DB, or the memory, or the cpu, or the 3 at the same time ). I would also look at someone would could play with permissions ( like removing privileges in mysql, changing owner on postgresql ) – Misc Jun 6 '12 at 21:45
@Johnny In addition to Misc's examples, the attacker could crash the database by passing a command that triggers a bug. – Gilles Jun 6 '12 at 21:59
Thanks for the help guys. Could you mention a method which can be done solely through SQL, like sql injection? – Johnny Jun 6 '12 at 23:07
@Johnny SQL injection is not done solely in SQL. The notion of injection is related to the framework where the SQL is composed. Passing an SQL command that triggers a bug (e.g. in the SQL parser) is done purely in SQL and can break any property. – Gilles Jun 6 '12 at 23:17
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.