19.12.2012 Views

IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection Manual - The Information Warfare Site

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Threats Catalogue Deliberate Acts Remarks<br />

____________________________________________________________________ .........................................<br />

T 2.39 Complexity of a DBMS<br />

<strong>The</strong> selection and use of standard database systems requires careful planning,<br />

installation and configuration of the database management system (DBMS),<br />

thus ensuring trouble-free operation. <strong>The</strong> following examples are intended to<br />

elucidate the large variety of potential threats involved here.<br />

Selection of an unsuitable standard database system:<br />

- <strong>The</strong> selected DBMS cannot be executed in the designated runtime<br />

environment. This might be due to the fact that the DBMS is only<br />

compatible with a particular operating system or that the hardware used<br />

does not fulfil the minimum requirements.<br />

- <strong>The</strong> selected DBMS constitutes a security risk because the security<br />

mechanisms provided by the manufacturer are not sufficient for ensuring<br />

the required availability, integrity and confidentiality of the data.<br />

Incorrect installation or configuration of the standard database system:<br />

- Further threats might be posed if the security measures recommended by<br />

the manufacturer are ignored or incorrectly implemented.<br />

Example: <strong>The</strong> log files of a database system were not mirrored, or the<br />

mirrored log files were not stored to another hard disk. A head crash causes<br />

inevitable destruction of the database.<br />

- <strong>The</strong> physical distribution of the data is not sufficient (if the DBMS<br />

provides for physical distribution).<br />

Example: Inside an Oracle database the files per tablespace are limited. If<br />

all the data is being managed in the system tablespace, files can no longer<br />

be added once this maximum number has been attained. As the system<br />

tablespace also holds the data dictionary, this problem can only be solved<br />

through a complete reinstallation of the database.<br />

- Parameters that are set incorrectly can prevent access to certain data.<br />

Example: Incorrect country settings in a database software program can<br />

prevent certain country-specific special characters from being displayed.<br />

Poor database concept:<br />

- Missing database relations between individual tables can impair the<br />

consistency of data and the integrity of the database.<br />

- If application-specific data is not stored on separate physical media, the<br />

failure of a single hard disk can lead to the failure of all applications.<br />

- If no database triggers or stored procedures are used, inconsistencies might<br />

arise in the data if an application, itself, does not take this into account..<br />

- <strong>The</strong> poor concept regarding the use of database triggers and stored<br />

procedures can impair the integrity of data and result in uncontrolled<br />

manipulations.<br />

____________________________________________________________________ .........................................<br />

<strong>IT</strong>-<strong>Baseline</strong> <strong>Protection</strong> <strong>Manual</strong>: Oktober 2000

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!