Prevent important data and information disclosure citizens special construction work, the need to implement a set of core data assets by the technology to prevent the reinforcement work hard measures within outward through. Technical measures to prevent hard core thrust is active defense, defense dynamic, precise protection, overall prevention and control. Its main roles include:
A, real-time monitoring, timely detection and data theft ***
B, and to prevent illegal cache data store on the Internet
C, and resolutely prevent leakage through a third party
D, timely detection and blocking external ***
E, to prevent data leakage and loss caused ******
This article from the design principles and design protection in both directions for expansion introduces data security technology to prevent hard measures.
Design Principles
01, the overall principle of prevention and control
Data security should be designed around the actual production business applications based on security needs, according to the national level of protection, protection policies governing the grading standards and technical requirements, the completion of information security protection system of defense in depth. In the construction process, follow the unified planning, unified standards, unified management, appropriate protection, protection, strengthen management principles.
02, active protection principles
Full database protection work should be actively carried out, and not out of the question afterthought. By access technology in the database front-end tools, so that all database requests are passed through the protective tool back-end database, and then protect the database to accept only trusted applications access requests initiated by non-authorized personnel can not access, is reduced *** surface; and impersonate users, business people sponsored ***, unauthorized, unauthorized, illegal access to sensitive data, such as excessive access to be blocked, and effectively block *** behavior for database vulnerability through dedicated security technology . Thereby preventing information leakage problem caused by ******.
03, dynamic adjustment principle
The core data security issues are not static, it will change with the related management organizational structure, organizational strategy, information systems and operational processes of change, so the core and sensitive data, must keep track of changes in business information systems, timely adjustment of safety Safeguard.
04, accurate protection principles
Taking into account the different security risks and the importance of different types of network database system faced, network architecture, software and hardware deployment location, precise response to database security design. The same risk of security systems and equipment should be classified in the same security domain, consistent security controls to achieve centralized protection. For different types of data stored in different business systems, it is necessary to correct the core of sensitive data by the associated dynamic adjustment to ensure that sensitive data can reach the core security on the roots.
05, focus on protection principles
Unified management is to build information security protection, the protection of defense in depth grading system, proactive security the most basic requirements, access to resources and users within the scope of a unified database system in order, in accordance with the access control policy to be implemented for database access behavior unified response by the analysis and audit techniques. Achieve global unified management, strict monitoring, response and timely protection principles.
06, the principle of defense in depth
Defense in depth principle is the core idea of information systems security, and information security defense system design, implementation, should be established defense in depth system, establish inspection warning to the entire database system, active defense, the bottom line of the defense, after tracing, every level the need for different systems, the implementation of the corresponding information security policy and security mechanisms, to ensure that every visitor to a database access system components are multi-level security protection system in order to achieve adequate defense system, the database system will suffer ** * minimize the risk, to ensure the system safe and reliable.
Security Design
Object security system focused on core data in the database system, by analyzing the source of access, access to the object, access path, usage scenarios provide different security measures according to different data.
First, check the warning
1, strengthen the immune
Through real-time check of the database vulnerabilities , implement monitoring of database security situation, including relevant security configuration, connection status, user change the situation, permission to change the situation, the code change conditions and other security all aspects of assessment; establish a secure baseline, implement security changes status reporting and analysis. Monitoring database security, database security to prevent deterioration: establishing a secure baseline for the database, the database periodically scanning, reporting and analysis of the changing security situation occurred.
Check out the database for security vulnerabilities, provide a detailed report on database vulnerabilities detailed vulnerability remediation recommendations to ensure that each recommendation efficient and reliable, will not cause the restoration of normal function is not available, the database system can not be started, such as failure to help administrators more quickly and efficiently bug fixes.
2, classification and grading
数据资产梳理是数据库安全的基础，通过对数据资产的梳理，可以确定敏感数据在系统内部的分布、确定敏感数据是如何被访问的、确定当前的账号和授权的状况。通过静态梳理和动态梳理技术有效地解决组织对资产安全状况摸底及资产管理工作；改善以往传统方式下企业资产管理和梳理的工作模式，提高工作效率，保证了资产梳理工作质量。根据用户数据价值和特征，梳理出用户的核心数据资产并对其分类分级，在此基础之上针对数据的安全管理才能确定更加精细的措施。能做到对风险预估和异常行为评测，很大程度上避免了核心数据遭破坏或泄露的安全事件。
二、主动防御
1、对内审批
传统的数据库往往采用账户名+密码的单因子方式进行登录，在真实环境中运维使用者包含了开发、测试、运维、外包等人员，如果仅仅通过简单的授权方式进行防护，不但账号密码容易泄露，且有可能识别导致无法真实识别用户身份，导致权限滥用，一旦出现违规事件无法及时定责，追责，数据库面临着***、盗用的破坏和泄密问题，严重危害到数据的安全性。如何解决数据库访问在使用过程中的安全问题，并进行统一身份认证管理，是当前亟待解决的问题。
数据库安全运维通过身份识别、角色划分、身份授权、运维审批和访问控制等技术，实现对运维操作的事前审批、事中管控和事后稽核，规避内部人员导致的数据泄露风险。
2、对外防御
用户网络中存在种类繁多的应用系统，其中不乏有需要对公众开放的系统，而WEB服务器被暴露在网络之中，***者对WEB服务器进行网段扫描很容易得到后台数据的IP和开放端口。对这样的隐患进行数据库级别访问控制、***防御，会有效的保护后台数据库不暴露在复杂的网络环境中，构建类似内网的安全防护状态。数据库安全防护系统，通过网络可信接入、应用身份识别、抵御SQL注入、虚拟补丁、阻断漏洞***、用户权限细粒度管理等手段，有效防止***者通过WEB应用，用“SQL注入”***的方法从后台数据库服务器尝试进行“刷库”，通过SQL注入防护可以从根本上帮助管理员防止SQL注入的发生。
三、底线防守
1、核心数据加密
通过独立的密文权限控制体系，限制DBA、服务外包人员、开发人员对敏感数据的访问权限，使其只能维护数据而无法访问敏感数据，从而远离泄密的危险；同时仅将敏感数据的访问能力开放给合法的使用人和必要的数据库维护人员，并对这些敏感数据的访问，开启审计进行详细记录。
2、敏感信息混淆
通过对数据库中的敏感数据进行识别，统计出敏感数据并进行管理，提供灵活的策略和脱敏方案配置，高效可并行的脱敏能力，帮助快速实施敏感数据脱敏处理，同时保证数据的有效性和可用性，使脱敏后的数据能够安全的应用于测试、开发、分析，和第三方使用环境中。
四、事后追查
业务人员的数据库操作基本是合法的，但是也不能排除被利用或被***的情况，通过数据库审计精确记录关键业务操作和关联具体业务操作人员，为事后追溯定责提供准确依据，同时对数据库运维操作和非法批量导出行为进行告警。建议采用应用关联审计实现对业务用户的100%准确关联，在出现问题的时候能够实现准确的追责和定责。
To prevent leakage of important data and information of citizens is a work system, requires a combination of technical means of investigation and security risks, security risks for the information, follow the national standards for design, respectively, to provide a safe design and implementation of technical and management levels. The use of technology or product solutions reinforcement measures for the investigation and the risk of vulnerabilities targeted repair to enhance the core assets data protection.