I recently came across a scenario in an assessment regarding IT security. I am new to this area and my knowledge is limited so I'm not sure if my answer to the scenario is suitable or not. Will really appreciate if someone could help out. So the scenario is:
A small company decided to move their infrastructure to the cloud. During the migration activity, they identified one of the database servers had 4 unknown local Windows users on it. This triggered a technical review and internal investigation.
The issues found were:
- There were 4 local unknown users created on the server.
- There were a total of 30 database-level users on MS SQL database.
- The database server is storing data for 20 web applications.
- Basic findings were that 5 web applications were compromised, where
- 1 site was having command injection issues
- 1 site was having SQL injection issues
- 1 site was having XSS and CSRF issues
- 2 sites were not doing any input validation
- None of the sites was using HTTPS
- Two of the databases were found to have credit card information
The questions are:
Based on this scenario, is this a database, application or system security issue and why?
What are the logs that the company can review during the investigation?
I think this is an application security issue.
Application security defined as "the general practice of adding features or functionality to software to prevent a range of different threats. These include denial of service attacks and other cyberattacks, and data breaches or data theft situations". In relation to the scenario:
web applications are stored within database server which means this makes it easier for an attacker to access the data because they only need to crack the administrator account for one server to have access to everything.
users are created via web applications and stored in the database server, we have yet to identify the privileges of the 4 unknown users. Any one or all of these unknown users could have malicious intentions. They could be identified as individuals with unauthorised access to the company’s network, which means the company may have already been a victim of data breaches or data theft.
issues such as SQL injection, XSS and CSRF are a common type of application security vulnerabilities where attackers can exploit and facilitate cybercrime. As a result attackers could target availability, confidentiality, and or integrity of the company’s data.
credit card information is found within two databases and 5 web applications were found to have no https. This is signs of data breaches and theft.
I suggest the company to look into database and web application logs for signs of an actual exploit, I will also look into security audit logs for any failed authentication attempts and heck the firewall for unusual traffic based off the location.