Hacking and Securing DB2 Databases (HSDD)

This is an intermediate level database course, designed for those who wish to get up and running on developing well defended Oracle databases and applications. This course may be customized to suit your team’s unique objectives.

In addition to teaching basic skills, this course digs deep into sound processes and practices that apply to the entire software-development lifecycle. Perhaps just as significantly, you will learn about current, real examples that illustrate the potential consequences of not following these best practices.

Data, databases, and related resources are at the heart of most IT infrastructures. These assets can have high value from a business, regulatory, and liability perspective. They must be protected accordingly. In this course, you will repeatedly attack and then defend various assets associated with a fully-functional database. This approach illustrates the mechanics of how to secure databases in the most practical of terms.

• DBAs and developers who need to produce secure database applications and manage secure databases

• Familiarity with DB2 databases is required and real world experience is highly recommended
• Ideally, you should have approximately 6 months to a year of database working knowledge

Working in a dynamic learning environment, you will learn to:

• Perform a comprehensive set of checks and procedures against DB2 databases and home directories
• Understand the rationale for the measures being taken to secure the DB2 databases as well as home directories
• Understand the consequences for not properly handling untrusted data such as denial of service, cross-site scripting, and injections
• Be able to test databases with various attack techniques to determine the existence of and effectiveness of layered defenses
• Prevent and defend the many potential vulnerabilities associated with untrusted data
• Understand the concepts and terminology behind supporting, designing, and deploying secure databases
• Appreciate the magnitude of the problems associated with data security and the potential risks associated with those problems
• Understand the currently accepted best practices for supporting the many security needs of databases.
• Understand the vulnerabilities associated with authentication and authorization within the context of databases and database applications
• Be able to detect, attack, and implement defenses for authentication and authorization functionality
• Understand the dangers and mechanisms behind Cross-Site Scripting (XSS) and Injection attacks
• Be able to detect, attack, and implement defenses against XSS and Injection attacks
• Understand the concepts and terminology behind defensive, secure, coding
• Understand the use of Threat Modeling as a tool in identifying software vulnerabilities based on realistic threats against meaningful assets
• Perform both static reviews and dynamic database testing to uncover vulnerabilities
• Design and develop strong, robust authentication and authorization implementations
• Understand the fundamentals of Digital Signatures as well as how it can be used as part of the defensive infrastructure for data
• Understand the fundamentals of Encryption as well as how it can be used as part of the defensive infrastructure for data

This class is “technology-centric”, designed to train you in essential secure database skills, coupling the most current, effective techniques with the soundest industry practices.

The course provides a solid foundation in basic terminology and concepts, extended and built upon throughout the engagement. You will examine various recognized attacks against data and databases. Processes and best practices are discussed and illustrated through both discussions and group activities.

Fast Lane realizes the need for comprehensive DB2 security training to protect companies’ most critical information assets. In this course, you are lead through the process of auditing and securing DB2 by defining the risks to data, using auditing techniques for detecting unauthorized access attempts, using DB2 access controls and user management functions and developing reliable backup and restore processes and techniques to secure the DB2 database, as well as applications.

Throughout the course you will be exposed to the database as seen through the eyes of an attacker, including public and unreleased techniques that are used to compromise the integrity of the database or escalate a user's privileges. In this fashion, the student gains a better understanding of how an attacker sees a database as a target and how we can configure the database to be resistant to known and unknown attacks.