Home > Training > DSDS

Database Security with the DISA STIGS (DSDS)

Course Description Schedule Course Outline
 

Who should attend

Database Security with the DISA STIGs is an intense database security training course essential for DBAs, QA, Testing, and other personnel who need to deliver secure database applications and manage secure databases within the DoD. In addition to teaching basic skills, this course digs deep into sound processes and practices that apply to the entire software development lifecycle. Perhaps just as significantly, students learn about current, real examples that illustrate the potential consequences of not following these best practices.

Data, databases, and related resources are at the heart of the DoD’s IT infrastructures. They must be protected accordingly. In this course, students repeatedly attack and then defend various assets associated with a fully-functional database. This approach illustrates the mechanics of how to secure databases in the most practical of terms.

Prerequisites

This is an intermediate-level database course, designed for those who wish to get up and running on developing well defended database applications. This course may be customized to suit your team’s unique objectives.

Familiarity with databases is required and real world experience is highly recommended. Ideally, students should have approximately 6 months to a year of database working knowledge.

Course Objectives

Students who attend Database Security (STIG) will leave the course armed with the skills required to recognize actual and potential database vulnerabilities, implement defenses for those vulnerabilities, and test those defenses for sufficiency.

This course quickly introduces students to the most common security vulnerabilities faced by databases today. Each vulnerability is examined from a database perspective through a process of describing the threat and attack mechanisms, recognizing associated vulnerabilities, and, finally, designing, implementing, and testing effective defenses. Multiple practical demonstrations reinforce these concepts with real vulnerabilities and attacks. Students are then challenged to design and implement the layered defenses they will need in defending their own databases.

Working in a dynamic learning environment attendees will learn to:

  • Understand the consequences for not properly handling untrusted data such as denial of service, cross-site scripting, and injections
  • Be able to review and test databases to determine the existence of and effectiveness of layered defenses and required checks
  • Prevent and defend the many potential vulnerabilities associated with untrusted data
  • Understand the concepts and terminology behind supporting, designing, and deploying secure databases
  • Appreciate the magnitude of the problems associated with data security and the potential risks associated with those problems
  • Understand the currently accepted best practices for supporting the many security needs of databases.
  • Understand the vulnerabilities associated with authentication and authorization within the context of databases and database applications
  • Understand the dangers and mechanisms behind Cross-Site Scripting (XSS) and Injection attacks
  • Perform both static reviews and dynamic database testing to uncover vulnerabilities
  • Design and develop strong, robust authentication and authorization implementations
  • Understand the fundamentals of Encryption as well as how it can be used as part of the defensive infrastructure for data

This class is “technology-centric”, designed to train attendees in essential secure database skills, coupling the most current, effective techniques with the soundest industry practices.

The course provides a solid foundation in basic terminology and concepts, extended and built upon throughout the engagement. Students will examine various recognized attacks against data and databases. Processes and best practices are discussed and illustrated through both discussions and group activities.

Comments

What’s included?

DISA’s Database STIG, in conjunction with both generic and product-specific checklists, provides a comprehensive listing of requirements and needs for improving and maintaining the security of Database Management Systems within the Department of Defense. This course fills in the context, background, and best practices for fulfilling those requirements and needs. As with all of our courses, we maintain tight synchronization between the latest DISA releases and our materials. The close ties between this STIG and the Applications Security and Development STIG are reflected in the coverage of application issues within the context of this course.

Our robust course materials include much more than a simple slideshow presentation handout. Student materials include a comprehensive hard-copy course manual, complete with detailed course notes, code samples, diagrams and current reference materials, all directly related to the course at hand, indexed for ease of use. Step-by-step lab instructions and project descriptions are clearly illustrated and commented for maximum learning.

Detailed Course Outline

Session: Foundation

Misconceptions

  • Thriving Industry of Identify Theft
  • Dishonor Roll of Data Breaches
  • TJX: Anatomy of a Disaster
  • Heartland: What? Again?

Security Concepts

  • Terminology and Players
  • Assets, Threats, and Attacks
  • OWASP
  • CWE/SANS Top 25 Programming Errors

DISA’s Security Technical Implementation Guides (STIGS)

  • Purpose
  • Process
  • Areas Covered
  • Checklists
  • Scripts (SRRs)
  • Resources

Security Concerns Common to all DBMSs

  • Authentication
  • Authorization
  • Confidentiality
  • Integrity
  • Auditing
  • Replication, Federation, and Clustering
  • Backup and Recovery
  • OS, Application, and Network Components

Defensive Principles

  • Security Is A Lifecycle Issue
  • Minimize Attack Surface
  • Manage Resources
  • Application States
  • Compartmentalize
  • Defense In Depth - Layered Defense
  • Consider All Application States
  • Not Trusting The Untrusted
  • Security Defect Mitigation
  • Leverage Experience

Reality

  • Recent, Relevant Incidents
  • Find Security Defects In DBMSs
Session: Top Database Security Vulnerabilities

Unvalidated Input

  • Sources of Untrusted Input
  • Trust Boundaries
  • Designing and Implementing Defenses

Broken Authentication

  • Quality of Passwords
  • Protection of Passwords
  • Hashing Passwords
  • Protecting Authentication Assets
  • System Account Management
  • User Account Management

Broken Access Control

  • Gaining Elevated Privileges
  • Compartmentalization Based on Level of Privilege
  • Special Privileges Provided by Database and Systems
  • Protecting Special Roles

Cross Site Scripting (XSS/CSRF) Flaws

  • What and How
  • Role of Databases in Enabling XSS
  • Designing and Implementing Defenses

Injection Flaws

  • What and How
  • SQL, PL/SQL, XML, and Others
  • Stored Procedures
  • Buffer Overflows
  • Designing and Implementing Defenses

Error Handling and Information Leakage

  • What and How
  • Four Dimensions of Error Response
  • Proper Error Handling Design

Insecure Handling

  • Data at Rest
  • Data in Motion
  • Encryption
  • Compartmentalization Based on Level of Privilege
  • Backups and Archives
  • Connection Strings and High Value Server-Side Credentials
  • Designing and Implementing Defenses

Insecure Management of Configuration

  • Initial Installation
  • Patch Management
  • Server Hardening
  • Operating System Hardening
  • Connection Hardening
  • Replication Hardening
  • Best Practices

Direct Object Access

  • What and How
  • Role of Databases in Enabling Access
  • High Risk Practices to Avoid
Session: STIG Database Security Requirements

Identification and Authentication

  • Group and Individual
  • Key Management Practices
  • Token and Certificates Practices

Enclave/Computing Environment

  • Auditing Mechanics and Best Practices
  • Data Changes and Controls
  • Encryption
  • Privilege Management
  • Additional Controls and Practices

Enclave Boundary Defenses

Continuity of Service

  • Defending Backup/Restoration Assets
  • Data and Software Backups
  • Trusted Recovery

Vulnerability and Incident Management

Session: Secure Software Development (SSD)

SSD Process Overview

Asset, Boundary, and Vulnerability Identification

Process, Design, and Code Reviews

Applying Processes and Practices

Software and Data Baselines

Testing as Lifecycle Process

Testing Planning and Documentation

Testing Tools And Processes

  • Principles
  • Reviews
  • Testing
  • Tools

Static and Dynamic Analysis

Testing Practices

  • Authentication Testing
  • Data Validation Testing
  • Denial Of Service Testing
Session: Database Checklists

Checklist Overview, Conventions, and Best Practices

Generic Database Checks and Procedures

SQL Server Checks and Procedures (Optional)

  • Installation Checks
  • Database Checks

Oracle Checks and Procedures (Optional)

  • Database Automated Checks
  • Database Interview Checks
  • Database Manual Checks
  • Database Verify Checks
  • Home Automated Checks
  • Home Interview Checks
  • Home Manual Checks
  • Home Verify Checks

Practical Application of the Checklists

Classroom training

Duration: 3 days

Online training
 
Live chat by BoldChat