The third database vulnerability of our Top 10 list database vulnerabilities and misconfigurations is excessive privileges assigned directly to users or indirectly through user groups.
There are two very important concepts that apply to information systems security controls: separation of duties and the principle of least privileges.
Separation of duties manages conflicts of interest and implements an appropriate level of checks and balances on an individual’s activities to ensure they do not have toxic privilege combinations.
The principle of least privileges requires that users have the least amount of privileges required to perform their specific tasks – only they the data they need and nothing more.
The process of collecting and untangling the web of all rights that a user has can become a daunting task. Privileges aren’t typically just assigned directly to the users they also inherit privileges from groups or roles they belong to.
There are several important rights, privileges and common groups to look out for when reviewing user and group rights, as well as group membership. For example: Oracle databases have a PUBLIC role that has high privileges although it does not require them.
Follow these steps in order to avoid extensive user and group privileges:
- Map Job Functions to Privileges on IT assets
- Never Assign Privileges Directly to Guest Accounts or Public
- Untangle The Web of User Entitlements
- Implement Compensating Controls for What You Can’t Fix
Vulnerability 3 of 10