Information security of corporate databases.

Abstract

Every day, companies all over the world collect and generate a large amount of data. Now information is digital and is stored in automated digital databases, the use of which allows for processing large amounts of data that previously were difficult to process. Protecting corporate databases and the information within them is essential for economic security. It includes their physical protection, productivity assurance and monitoring, data protection from destruction or damage, access control, and recording of new databases appearing in the infrastructure. However, since users of different types and levels of access (internal users, system administrators, contractors, partners, and M2M communications) have access to databases, they can abuse their access rights in several ways. These may be an abuse of excessive, objectively necessary, or non-used rights. As a rule, an inefficiently controlled process of granting access rights creates excessive access rights which in turn may cause new information security risks. Security measures include implementing an access management process, granting minimally necessary access rights, and implementing a mechanism to control and block the given access rights. This article discusses such threats to databases as SQL Injections and NoSQL injection attacks, insufficient detailing of events in databases, backup leaks, vulnerabilities and configurations, DDoS attacks, and methods to counter these threats. The most effective way to protect databases is to implement specialized software and hardware complexes such as Imperva DBS and Imperva WAF developed for database protection. The use of Imperva DBS will help to solve all the key tasks of database protection and provide complete visibility and control over their usage in the enterprise infrastructure.