GETIt
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 1/27
Vulnerability
A vulnerability is a weakness or group of weaknesses that can be exploited, causing a
security breach and/or damages to the organization.
Software vulnerabilities are communicated in various ways:
by the vendor in security bulletins (online publications)
through email alerts from the vendor to company points of contact
in hacker forums
by the United States Computer Emergency Readiness Team (US-CERT) and other
government organizations
Information Systems: Vulnerability to Cyberattack
As technology continues to grow, information systems also change and evolve.
Information systems help organizations in different ways—from increasing productivity to
reaching out to customers. There are different information systems to address different
requirements. The different types of information systems are listed in the table below. Can
you distinguish the ones that are more likely to be attacked from the ones that are less
likely to be attacked?
Information System Definition
E-commerce
system
System for buying and selling products or providing
services over the Internet
Learning Resource
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 2/27
Information
System Definition
Knowledge
management
system
Collection of systems that support the creation, storage,
and dissemination of information; the knowledge
management system has a repository of well-structured
information and a collection of tools that may be used to
quickly find answers to posed questions
Enterprise
resource planning
(ERP) system
System that supports and integrates the various
functions within the organization including planning,
manufacturing, sales, marketing, and accounting
Intelligent system System that exhibits intelligence in the sense that it is
able to learn behaviors based on past experiences, to
adapt to changing environments, and to be consistent in its responses
Transaction
processing system
System for managing data transactions of an
organization
Office automation
system
System that helps optimize and automate office
procedures
Customer-
relationship management
(CRM) system
System that manages the company's client interactions,
such as in sales, marketing, and customer service
Collaboration
system
System that supports and coordinates collaborative
activities such as e-mailing, texting, chatting, and
bookmarking
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 3/27
Information
System Definition
Supply chain
management
(SCM) system
System that automatically updates inventory values for
each item and sends reorder information to the suppliers
Functional-area
information system
System for managing different functional areas within an
organization
Data mining and
visualization
system
System that helps derive patterns from data
Management
information system (MIS)
System that provides information needed to effectively
manage an organization
Geographical
information
system (GIS)
System that captures, stores, analyzes, and presents data
related to a location
Executive
information
system
System that provides external and internal information
relevant to meeting the strategic goals of an organization
Decision support
system (DSS)
System that constitutes a set of IS to support the
decision-making process
The following systems are more likely to be attacked:
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 4/27
e-commerce system
ERP
transaction processing system
CRM
SCM
data mining and visualization system
GIS
DSS
The following systems are less likely to be attacked:
knowledge management system
intelligent system
office automation system
collaboration system
functional-area information system
MIS
executive information system
Remember, if a company's network is attacked and penetrated (even via a website), then
all internal information systems may be accessible to the hacker or other type of attacker.
Modern Information Systems
The Challenges of Securing Modern Information Systems
Today's hybrid networks comprise a combination of wired and wireless networks that
connect tens to thousands of computers running several different operating systems. Each
kind of computer, operating system, device, and network has its share of security
vulnerabilities, and securing the network poses several challenges for the IT security team.
You will learn more about these challenges and how to overcome them as you progress
through this program. However, here's a brief overview of potential security issues.
Diverse Systems: As discussed, hybrid networks are flexible in terms of connectivity
and the types of devices they support. For example, many organizational networks
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 5/27
support a variety of computer systems, such as PCs, laptops, and mobile devices.
These systems run different types of operating systems, such as Windows, Linux,
UNIX, MacOS, and mobile operating systems. Some organizations have a virtual
private network (VPN), which enables employees to securely access their intranet
from outside the network.
Organizations are also working on improving the efficiency and availability of IT
resources and a variety of applications through the use of virtual machines. Multiple
virtual machines may run on one physical machine. A virtual Linux machine, for
example, may run on a Windows machine. VMware and Xen are some examples of
virtualization software that can be used to create virtual machines. All computer
systems and operating systems have inherent vulnerabilities that need to be
managed.
Email and Text Messaging: Email and text messaging are popular communication
tools for business and social purposes. You share documents, presentations, and
other types of files with your colleagues, vendors, customers, and friends. This
makes email an attractive tool for cybercriminals, who use it to infect computers
with viruses and Trojans and to run phishing scams.
Wireless Networks and Mobile Phones: Many organizational networks today
support wireless connectivity and remote log-ons. Hackers may piggyback on
available unsecured network connections in a densely populated area and send
spam, download files from the internet, and even hack into databases and steal
confidential data. Using mobile phones or smartphones to access information via
wireless technology might pose similar security challenges.
Social Networks: Organizations often use social networks for recruitment and
publicity campaigns. Consequently, many organizations allow employees to access
social networking sites. However, it might not be such a good idea from the
perspective of network security. There have been cases of Facebook and Twitter
accounts being hijacked and usernames and passwords being sold to "underground"
networks. Hackers then use the compromised accounts to run phishing scams.
Safeguarding the network from the vulnerabilities prevalent in social networks is a
new and growing challenge in the field of cybersecurity.
Vulnerabilities of TCP/IP
The TCP/IP suite protocols have inherent vulnerabilities. Hackers exploit these
vulnerabilities to attack networks. Some common types of attacks on TCP/IP include
sniffing, session hijacking, IP address spoofing, and denial of service (DoS).
Each type of attack is explained below.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 6/27
Sniffing: In this type of attack, the attacker uses a packet sniffer such as Wireshark
or Kismet to intercept and analyze the data packets sent between the sender and
receiver. This action occurs without the knowledge of either the sender or the
receiver. Many network applications transmit data packets as clear text; therefore,
attackers may be able to collect sensitive information such as user account names
and passwords using this technique. Sniffing is a data-link layer attack because the
attacker operates at the data-link layer of the network.
Session Hijacking: Session hijacking is an active version of sniffing. In this type of
attack, the attacker intercepts network traffic and obtains the initial sequence
number (ISN) of the communication. The ISN is the sequence number of the first
packet of data being communicated and tells the attacker how many packets are
being transmitted. The attacker also obtains the IP address of the sender from the
packet. The attacker then impersonates the sender and communicates with the
receiver. The attacker may tamper with the data received from the sender before
passing it on to the receiver. For example, an attacker may collect a confidential
document, falsify it, and retransmit it to the receiver, who accepts it at face value.
Session hijacking is a transport layer attack.
IP Address Spoofing: In this type of attack, the attacker sniffs network traffic to
identify the pattern of legitimate IP addresses for that particular network. The
attacker then forges the IP address in the packet headers. If the network uses the IP
address to authenticate the user, the attacker is able to gain access to the network
through the packet with the forged IP address. The attacker can then send malicious
packets to the network. For example, an attacker may introduce a Trojan or
keylogging application to the network after gaining access to it. IP address spoofing
is a network layer attack.
Denial of Service: Using DoS, the attacker can make a critical service or resource
unavailable to legitimate users on the network. For example, an email server can be
rendered useless by the sending of hundreds of email messages with large
attachments. The email server will eventually crash under the load and become
unavailable to legitimate users. Similarly, an attacker can flood a server with TCP
requests and cause it to stop functioning normally. Attackers may also distribute the
attack—by deploying several hundreds or thousands of clients. In this situation, the
attack is referred to as a distributed DoS (DDoS) attack. DoS is a transport layer
attack.
Network Security - Vulnerabilities of LANs, WANs, and MANs
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 7/27
Consider a typical office setup and its information system needs. You might find common
security vulnerabilities such as unattended computers, a centrally located printer, access
to gaming websites, discarded CDs, and data sharing. Read about these common
vulnerabilities below.
Unattended Computers: Leaving computers unattended is the biggest risk to
network security. Easy access to computers and other devices means that the LAN
(local area network) can be compromised. All desktops should be locked when not in
use.
Centrally Located Printer: A centrally located printer is not a major vulnerability as
long as data is not compromised. Do not leave important documents lying around
the printer, and print documents only when needed.
Access to Gaming Websites: This could pose a serious threat to the LAN, as any
material downloaded from the internet can contain viruses or worms. Access to
online games, movies, and songs should be restricted. All files that are downloaded
from the internet should be scanned for malware prior to being downloaded.
Discarded CDs: Employees must ensure that confidential data is deleted before
disposing of data and physically destroying computer media. Controls must be
implemented for safeguarding confidential data.
Data Sharing: Remote log-ons allow access to applications and data on the other
computers in the network. Remote access to computers on the network must be
restricted and password-protected. The LAN connects networks, servers,
workstations, printers, and storage devices and allows users to share functionalities
and resources. Therefore, it is important that the confidentiality and integrity of the
information is maintained. This can be achieved with the implementation of policies
and procedures and the creation of awareness among employees. WANs (wide area
networks) and MANs (metropolitan area networks), which are combinations of LANs,
are exposed to the same vulnerabilities as LANs.
Network Security - Vulnerabilities of WLANs
Like their wired LAN counterparts, WLANs (wireless LANs) are prone to security
vulnerabilities. In fact, a WLAN is more susceptible to attacks because it includes both the
organization's internal network and the general public network segments. An open WLAN,
which does not require users to authenticate themselves with a user name and password,
is a security issue and a breach waiting to happen. WLANs are also susceptible to attacks
such as:
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 8/27
Traffic Analysis: Traffic analysis helps determine the load on a wireless network. This
type of analysis gathers information about the frequency and timing of network
packets in transit. The attacker can identify the websites being visited and read
messages that are sent on the network. The attacker can then alter the message in
transit or send the message to multiple users.
Eavesdropping: Sometimes referred to as sniffing, eavesdropping involves capturing
packets and reading the data content to find sensitive information. There are two
types of eavesdropping: passive and active. In passive eavesdropping, the attacker
can use the information gathered to attack the network. In active eavesdropping,
the attacker not only monitors the wireless sessions but also tries to determine the
contents of the message. For example, if a user is trying to contact a bank, the
attacker can trick the user into believing that user is communicating with the bank.
Brute-Force Attacks Against Access Point SSIDs: An access point uses a single
password for all wireless clients. In a brute-force attack, the attacker methodically
tests combinations of passwords to gain entry to the access points.
Renegade Access Points: Sometimes, employers may be unaware that their
employees have deployed wireless capabilities on the company's network. This may
lead to unauthorized attacks. In addition, attackers may also set up rogue access
points to gain access to the network via the WLAN.
Masquerading Attacks: In a masquerading attack, an illegitimate user poses as a
legitimate user to gain access to confidential information.
Threats Originating From Cyberspace
Corporate websites and portals, extranets for vendors, and e-commerce sites are just a
few tools with which organizations harness the benefits of the internet.
With the rise in cybercrime, it is critical for organizations with an internet presence to
build a robust security infrastructure to safeguard their IT resources from threats.
Contrary to popular belief, not all threats originate from the outside. Threats can and do
originate from within the organization itself—in such cases, the internet is a useful tool for
the attack.
Below, read about an external and an internal threat to Cypher X, a fictional company.
Cypher X: Security Lapses?
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 9/27
Andy Parker is a systems administrator at Cypher X, a computer hardware manufacturing
company. The company’s headquarters and research and development center are located
in Austin, Texas. Cypher X has several manufacturing plants, sales offices, and suppliers
located in the United States, Brazil, Germany, South Korea, and Malaysia.
Today, Andy Parker is visiting a sales office in Dallas. During his visit, he observes some
lapses that could lead to IT security incidents.
Incident A
Andy Parker notices an unlocked workstation with a yellow sticky note on the monitor.
The note says,
Out for lunch, Back by 1:30 p.m. Call me @ 555-455-8865 in case of emergency
Sonya
Andy: Oh, Sonya’s out for lunch. I’ll come back after I’ve met with the others. Hmm,
Sonya’s forgotten to lock her desktop. She’s also left some files open. Anyone could
access this information. Actually, anyone could access the company’s network using
her computer, leaving her ID as the only trail. I must remember to warn her about
this.
Incident B
Andy Parker then notices an employee playing games on a website.
Andy: Ah, there’s John, the new hardware engineer. Is he playing soccer on a
website? I don’t believe this! I wonder if everyone has unrestricted access to the
internet and gaming sites. Andy decides to talk to John.
Andy: Hi John, how are you?
John: Hey! Okay so far, but I will be better as soon as I win this game!
Andy: Ah, soccer! So, does everyone have access to gaming websites?
John: Well, I know everyone in the IT department has unrestricted internet access.
Don’t know about other departments, though. Oh yes, I’ve seen Sam from the
finance department playing games online a couple of times. So, maybe a select few
users do have unrestricted access.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 10/27
Andy: Hmm, I see. Unrestricted access to the internet can result in computers being
infected by viruses or malware, you know—especially from gaming websites.
Incident C
Next, Andy Parker sees another employee working with shared folders on a network.
Andy: There’s Alan. He seems to be busy looking at some data over the network. Let
me chat with him for a bit.
Andy: Hey Alan, how are you today?
Alan: Great, Andy. Good to see you again.
Andy: Thanks. So, looks like you’re having a busy day.
Alan: No, not really. I’m just updating the project tracker on my boss’s laptop. I was
working late last night from home to meet a deadline.
Andy: He’s shared his files?
Alan: Yeah.
Andy: And how do you transfer files to your home computer?
Alan: I mostly use the office email system. Access to thumb drives is restricted.
Andy: I see. Must be difficult to transfer big files, huh?
Alan: Oh, we have a secure FTP site in place to exchange large-size files.
Andy: That’s good. Ah, there’s Sonya. Let me catch her before she gets busy. I’ll see
you later, Alan.
External Threat
Last year, there was an increase in targeted attacks on large companies. CypherX was the
target of one such attack.
The attackers gathered information about CypherX from its corporate website. They
also visited social networking websites to gather information about specific
employees.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 11/27
Those employees later received carefully worded phishing email messages
containing the Hydraq Trojan, which installed itself on the employees' machines by
exploiting vulnerabilities in a commonly used web browser.
The Trojan—like all Trojans, a malicious program that appears to be legitimate—
installed a keystroke logger on each machine, which enabled the attackers to gain
remote access to the infected computers.
Eventually, the attackers were able to gain access to CypherX's LAN. Fortunately,
Cypher X's intrusion detection system (IDS) alerted the IT team in time.
Internal Threat
Cypher X also faced a couple of internal threats, one of which is described below.
Sam Moore, a CypherX accountant, was transferred to Torrington, Connecticut.
Although small, the Torrington office handles sensitive and confidential data related
to CypherX's research and development efforts. Upset at being "banished" to a small
town, Sam decided to get back at CypherX by selling some of this data.
Sam got in touch with a friend who works for CypherX's competitor. They made a
deal.
Sam uploaded design documents for the new range of laptops CypherX was
developing to an online storage site on the internet. In return, the payment for the
designs was transferred electronically to Sam's bank account.
A few weeks later, CypherX's competitor released a series of advertisements about
its new range of laptops that looked suspiciously similar to CypherX's own!
Internal Threats
Most network intrusion detection systems, firewalls, and proxy servers are configured to
keep intruders out of an organization's IT systems. What happens if the intruder is already
inside the network, for example, working as an employee or a contractor?
The 2010 CyberSecurity Watch survey found that 51 percent of respondents who
experienced a cybersecurity incident were victims of an insider attack. Insider attacks very
often involve confidential data, intellectual property, or trade secrets. Consequently, they
are more damaging and costly than external attacks (CSO et al., 2010).
Cypher X's Andy Parker and his team recently conducted a security vulnerability test and
have broken down the vulnerabilities into categories.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 12/27
Weak/
Missin
g
Passw ords
Summary of finding: Despite the detailed password policy, 11
percent of the security vulnerabilities across the various offices stem
from weak passwords among the employees and contractors.
Why the finding matters: Passwords that contain only letters or numbers are easy to uncover via password-cracking tools that use
brute force; these tools try every possible combination of keystrokes
until the right combination is found.
Recommendation: Enforce the password policy electronically.
Operat
ing System
or
Applic
ation
Summary of finding: Overall, 22 percent of the security
vulnerabilities come from the use of software with open vulnerabilities that can be exploited. Special alert: none of the
computers located in the Buenos Aires, Argentina, office had the
latest Windows security patches installed.
Why the finding matters: When operating systems and software
applications such as browsers have known vulnerabilities that
hackers can exploit, hackers use these holes to breach networks and
individual computers.
Recommendation: Install the latest security updates on all machines.
Automate this process if possible.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 13/27
Human Factors
Summary of finding: The latest employee satisfaction survey found that:
5 percent of security vulnerabilities stem from a lack of
awareness among employees of the confidentiality clause in
their contract
12 percent stem from a lack of awareness of information
security policies among employees
15 percent stem from employee unhappiness with the working
conditions at Cypher X
12 percent stem from the receipt of warnings for unacceptable
behavior
Why the finding matters: Employees who are unfamiliar with security
policies or confidentiality clauses are soft targets for phishing and social engineering scams and may unknowingly reveal sensitive
information to outsiders. Disgruntled employees are more likely to
misuse or sell information for personal gain.
Recommendation: Conduct regular training and awareness programs
about IT security. Conduct a thorough background check of
prospective candidates. Conduct regular audits of computer and
network activity to identify potential issues.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 14/27
Other Summary of finding: Finally, the survey found that 23 percent of the vulnerabilities exist because of the susceptibility of computers to
attack due to miscellaneous factors such as unlocked workstations,
shared local folders with full access granted to all users, and copies
of pirated games, music, and movie clips.
Why the finding matters: Unlocked workstations and shared folders
on the network are easy targets for attackers who want to gain access to the network. Pirated content can contain malware that can
infect the entire network. In addition, downloading and storing
pirated content is a crime in many countries.
Recommendation: Update the IT security policy and the acceptable
use policy for shared folders. Mandate password-protected
screensavers on all computers. Configure the firewall to block websites that allow users to download pirated content and peer-to-
peer file-sharing sites. Educate employees on piracy.
Sources of External Intrusions
Internet-based intrusions are not limited to hackers alone. Nor are attacks restricted to
individuals and organizations. The internet allows malicious groups such as terrorist
organizations, enemy nation-states, and organized crime groups to carry out attacks. The
main sources of internet-based intrusions include:
Hackers: Hackers are the original cybercriminals. Hackers gain unauthorized access
to individual computers or networks to steal information such as passwords, credit
card and bank account numbers, and anything else they can get. Hackers may use
the stolen information themselves—to empty a bank account, for example—or barter
it on an underground network.
Industrial Espionage: Cybercriminals have found innovative ways to elicit trade
secrets from unsuspecting employees. A virus might masquerade as an email
attachment from your colleagues or as a link on your organization's internal website
about a new HR policy. Clicking the attachment or link installs a virus on the
computer, which then spreads across the network, grabs whatever information it
can, and sends it back to the attacker's computer.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 15/27
Organized Crime Groups: Criminals and organized crime groups use the internet to
launder money. In some cases, they hire candidates who respond to ads for work-
from-home opportunities and then use them as "money mules"—people who,
knowingly or unknowingly, transfer stolen funds from one country to another.
Employees: Employees, both current and former, might use the internet to smuggle
information in and out of the organization. In general, insider attacks are more
damaging and take longer to detect than intrusions by external hackers.
Terrorist Organizations: Terrorist organizations have already been using the internet
to organize real-world attacks, recruit followers, and raise money. However,
governments also fear that terrorist organizations might launch online attacks
against critical infrastructures.
Enemy Nation-States: Some countries are suspected to have launched cyberattacks
on enemy nations. Recent examples of attacks include an attack on Estonian
government computers by Russian government hackers, and cyberattacks on the US
Department of Defense and the White House originating from Russia and China.
Database Security Vulnerabilities
Database Security Pillars
A comprehensive database security strategy is based on three pillars.
Pillar 1: A strong foundation with authentication, authorization, and access control,
discovery and classification, and patch management
Pillar 2: Preventive measures with encryption, data masking, and change
management
Pillar 3: Intrusion detection with auditing, monitoring, and vulnerability assessment
Database Access Control
Security settings can provide restricted access to data as needed based on a database
schema. A database schema can be designed to allow or deny users access to tables and
views or to execute system privileges. A three-level database schema incorporating a
security approach has proven effective by establishing permissions based on user roles
(Oracle, n.d.).
Database Schema Administration
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 16/27
When users do not need to access the database or only need to access specific
applications, a shared three-level schema can limit the damage that can be done. A three-
level schema includes the description of data at the physical, conceptual, and external
layer.
Ownership-Based Administration
The owner of the table can apply security settings to grant or deny access to data by
implementing a three-level schema security mode, one that establishes permissions at a
granular level.
Access Control Administration
The owner of the database is provided the capability of granting and revoking privileges
by applying access rules.
Database access control has proven to be an effective security strategy. Any of the
traditional access control methods can be further improved by placing more granular
controls in place. Limiting access by role, schema, table—or by column, row or field within
a table—can minimize the likelihood that data will be compromised.
Inference
An inference attack involves gaining unauthorized access to restricted data through the
combination of database manipulation, logic application, and statistical analysis (Goodrich
& Tamassia, 2011; Hylkema, 2009).
Inference Basics
Step 1
Administrator and subordinate query a classified database.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 17/27
Step 2
Administrator receives the information, but the subordinate is denied.
Step 3
Subordinate queries two unclassified databases.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 18/27
Step 4
Subordinate receives the information from the unclassified databases.
Example of Inference
Step 1
In this example, a corporate database with personnel records is accessible in a sanitized
form to employees. Employee details contained in the database are restricted to
administrators. Names and salary information are strictly confidential, and subordinates
are denied access to this information (Shieh & Juang, n.d.)
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 19/27
Step 2
The company, attempting to improve retention among its employees, publicized their
years of service and publicly posts congratulatory messages to its internal website when
an employee completes the first year of employment and every five years thereafter. An
internal report shows the average salary for each department based on service time.
Company reports also show only one person was hired in any department in a given year.
Even though subordinates cannot access another employee's salary, aggregate values are
accessible. The average salary of employees based on years with the company can be
accessed from the database.
Step 3
Jesse wants to access information about Roy's salary. He knows Roy is the only HR
assistant manager with five years of service.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 20/27
Step 4
If Jesse creates a query requesting the average salary of HR managers with five years of
service, he can derive Roy's salary. This technique is an example of inference.
Inference Countermeasures
Step 1
Inference deterrence, as part of standard database design best practice, can prevent
security breaches. When determining how to prevent inference attacks, it is essential to
consider what method is best suited for a particular situation.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 21/27
Step 2
There are multiple approaches to protect against an inference attack, including
suppression, generalization, and random data perturbation (RDP).
Suppression
Suppression aims to remove or suppress information that could be used in an inference
attack and would not be suitable for the current example. Alternatively, the company
could either refrain from commemorating employment milestones or not publish the
salary information.
Generalization
Generalization makes values less specific or general, thus making it more difficult to
reliably make inferences. Generalization would be a more acceptable method to mitigate
inference attacks for the present situation. It could be used to provide less specific details,
such as the fact that an assistant HR administrator with the company for zero to five years
makes an average of $50,000 to $58,000.
RDP
Random data perturbation, or noise addition, alters values subtly, while ensuring that the
overall average of values remains accurate. RDP would not be suitable for the current
example because it would not instill trust or confidence in employees if celebrating
employment milestones at the wrong time or listing inaccurate salaries for years of service
(Goodrich & Tamassia, 2011; Hylkema, 2009).
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 22/27
Step 3
Consider a database containing personnel information, including the names, years of
service, and salaries of employees. In this example, the employee's name, years of service,
and salary information data is available to a subordinate role, but the association of names
and salaries is restricted to a supervisor role, such as administrator.
Step 4
In this example, the employee’s name, years of service, and salary information data is
available to a subordinate role, but the association of names and salaries is restricted to a
supervisor role, such as administrator.
Step 5
By incorporating separation of duties as an integral aspect of database design, multiple
tables can be created to restrict the level of access based on a user's assigned role.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 23/27
Here, the subordinate is restricted to the Employee table and Salary table, but the
Employee-Salary table is only available to the administrator role.
Step 6
If a new attribute, such as employee join date, is added to the Salaries table, the database
is susceptible to inference attack. An employee's join date is an easily observable or
discoverable attribute.
Step 7
A user assigned a subordinate role could infer another employee's salary by the inclusion
of start date data. Recall that the company posts congratulatory messages to its internal
website when an employee completes the first year of employment and every five years
thereafter. This will compromise the relationship between employee and salary. Therefore,
the employee join date should be restricted and instead included in the Employees table.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 24/27
Database Encryption
Encryption is critically important to maintain the integrity of the database content, as well
as confidentiality. Encryption ensures data security in transit and data security at rest, and
end-to-end encryption can prevent data breaches from internal attacks. With data
encryption, controls at the source of the data are maintained at a central point (Baccam,
2009).
What Is Database Encryption?
There are multiple levels of encryption that can be applied within the database hierarchy.
This extends from encrypting the entire database down to the attribute level, record level,
or even more granular down to an individual field (Lane, 2009b).
database-level encryption
record-level encryption
attribute-level encryption
individual field-level encryption
How Are Databases Encrypted?
The various ways in which databases can be encrypted are listed below.
Encrypt the entire database.
Encrypt each individual item in the database.
Encrypt each record in the database as a block.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 25/27
Encryption of the entire database, known as transparent or external data encryption
(TDE), is provided by native encryption functions within the database engine. TDE is
invisible to applications and users that use that data and, therefore, is known as a
"transparent" database encryption. Also, changes to application logic of TDE are not
needed.
Encryption of specific columns, tables, or even data elements within the database is
known as user or data encryption. It is referred to as a "user" encryption as objects being
encrypted are owned and managed on a per-user basis (Lane, 2009a).
Table-Level Encryption
Table-level encryption is where the contents of a table or group of tables are encrypted as
one element. This protects the data within the table, and is an option when more than one
column in the table contains sensitive information. While it does not offer fine-grained
access control to specific elements, it is a more efficient option than column encryption
when multiple columns contain sensitive data, and requires fewer application and query
modification (Lane, 2009b).
Row-Level Encryption
Row-level encryption is where a single row in a table is encrypted, and field- or cell-level
encryption is where individual data elements within a database table are encrypted. They
offer fine-grained control over data access, but can result in management and
performance challenges. There might be one key used for all elements or a key for each
row. The performance challenges can be a limitation when selecting or modifying multiple
rows (Lane, 2009b).
Column-Level Encryption
Column-level encryption applies to all data in a single column in a table. This column is
encrypted using a single key that supports one or more users. New queries to examine or
modify encrypted columns must have the correct database privileges but also must
provide credentials to access the encryption/decryption key. That can be as simple as
passing a different user ID and password to the key manager, or as complicated as a full
cryptographic certificate exchange. By asking the database to encrypt all data in a column,
you focus on specific data to protect.
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 26/27
Column-level encryption is popular with PCI-DSS compliance because it restricts access to
a small group, but the downside is that the column is encrypted as a whole, so every
modification requires the whole column to be reencrypted and certified. This option is
common in relational database platforms but has the poorest performance (Lane, 2009b).
References
Baccam, T. (2009). Making database security an IT security priority.
http://www.sans.org/reading_room/analysts_program/Oracle_Nov09.pdf
CSO, US Secret Service, Software Engineering Institute CERT Program at Carnegie Mellon
University, and Deloitte. (2010). CyberSecurity watch survey. CSO website.
Goodrich, M. T., & Tamassia, R. (2011). Introduction to computer security. Pearson
Education.
Hylkema, M. (2009). A survey of database inference attack prevention methods.
http://met-research.bu.edu/met-
ert/Internal%20Documentation/Inference%20Research/Michael_Hylkema_Resea
rch_Paper.pd
Lane, A. (2009a, June 4). Introduction to database encryption – the reboot! [Blog post].
Available under the Creative Commons Attribution-NonCommercial-ShareAlike
3.0 United States (https://creativecommons.org/licenses/by-nc-
sa/3.0/us/legalcode) license. https://securosis.com/tag/database+encryption
Lane, A. (2009b, May 14). Database encryption: Option 2, enforcing separation of duties
[Blog post]. Available under the Creative Commons Attribution-NonCommercial-
ShareAlike 3.0 United States (https://creativecommons.org/licenses/by-nc-
sa/3.0/us/legalcode) license. https://securosis.com/blog/database-encryption-
option-2-enforcing-separation-of-duties
Oracle. (n.d.). Introducing database security for application developers.
http://docs.oracle.com/cd/B12037_01/network.101/b10773/apdvntro.htm
Oracle. (n.d.). Security, roles, and privileges. http://ss64.com/ora/syntax-secure.html
Shieh, S-P., Lin, C-T., & Juang, Y-S. (n.d.). Controlling inference and information flows in
secure databases.
http://dsns.csie.nctu.edu.tw/ssp/Meeting/37.Controlling%20Inference%20and%2
0Information%20Flows%20in%20Secure%20Databases.pdf
1/17/23, 8:10 AM Vulnerability
https://leocontent.umgc.edu/content/scor/uncurated/cst/2215-cst610/learning-resource-list/vulnerability.html?ou=722269 27/27
© 2023 University of Maryland Global Campus
All links to external sites were verified at the time of publication. UMGC is not responsible for the validity or integrity
of information located at external sites.