By Randy Reiter CEO of Don’t Be Breached
Insider Data Breaches That Occurred in 2019
More than two-thirds of corporations are not prepared to combat Insider Data Breaches as reported on Business Wire November 6, 2019 (per the 2020 Insider Threat Report, produced by Gurucul). Employee insider threat is a major concern for all organizations. Employees often can access a company’s most sensitive database data since they (unlike external hackers) are inside the security perimeter and may have a privileged status to access confidential data in DB2, Informix, MySQL, Oracle, SQL Server, and Sybase databases.
Firewalls, intrusion detection systems and in place security measures that keep external hackers out often do not detect malicious insiders. Remember the Bradley Manning and Edward Snowden data breaches. They bypassed some of the most secure computer systems in the world by being an insider.
Some of the most damaging Insider Data Breaches that occurred in 2019 include:
- Capital One data breach that compromised the personnel data of 100 million customers. Capital One encrypts data as a standard, however since the breach was done by a rogue insider, the insider was able to steal decrypted confidential database data.
- Trend Micro had a rogue employee that sold the confidential data of 68,000 customers to a third party.
- Two Twitter employees leaked proprietary and confidential user data for over 6,000 Twitter users.
- AT&T employees were bribed by a foreign national to plant malware and unlock 2 million phones
How to Protect Confidential Database Data from Insider Threats and Hackers?
Confidential database data includes credit card, tax ID, medical, social media, corporate, manufacturing, law enforcement, defense, homeland security, and public utility data. This data is almost always stored in Cassandra, DB2, Informix, MongoDB, MariaDB, MySQL, Oracle, PostgreSQL, SAP Hana, SQL Server, and Sybase databases. Once inside the security perimeter a Hacker or Rogue Insider can use commonly installed database utilities to steal confidential database data.
Non-intrusive network sniffing can capture and analyze the normal database query and SQL activity from a network tap or proxy server with no impact on the database server. This SQL activity is very predictable. Database servers servicing 10,000 end-users typically process daily 2,000 to 10,000 unique queries or SQL commands that run millions of times a day.
Advanced SQL Behavioral Analysis of Database Query and SQL Activity
Advanced SQL Behavioral Analysis of the database SQL activity can learn what the normal database activity is. Then from a network tap or proxy server, the database query and SQL activity can be non-intrusively monitored in real-time and non-normal SQL activity immediately identified. Non-normal SQL activity from Hackers or Rogue Insiders can be detected in a few mili seconds. The Hacker or Rogue Insider database session can be immediately terminated and the Security Team notified so that confidential database data is not stolen.
Advanced SQL Behavioral Analysis of the query activity can go even further and learn the maximum amount of data queried plus the IP addresses all queries were submitted from for each of the 2,000 to 10,000 unique SQL queries sent to a database. This type of data protection can detect never before observed query activity, queries sent from a never observed IP address and queries sending more data to an IP address than the query has ever sent before. This allows real-time detection of Hackers and Rogue Insiders attempting to steal confidential web site database data. Once detected the security team can be notified within a few milliseconds so that a data breach is prevented.
About the Author
Randy Reiter is the CEO of Don’t Be Breached a SQL Power Tools company. He is the architect of the Database Cyber Security Guard product, a database data breach prevention product for Informix, MariaDB, Microsoft SQL Server, MySQL, Oracle, and Sybase databases. He has a Master’s Degree in Computer Science and has worked extensively over the past 25 years with real-time network sniffing and database security. Randy can be reached online at [email protected], www.DontBeBreached.com, and www.SqlPower.com/Cyber-Attacks.
