You've Been Breached: Now What?

Download the entire Dec. 20, 2010, issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree
for each of the first 5,000 downloads.

No one likes to think about database breaches, but the fact is, they happen. Rather than cross your fingers and hope for the best, create an incident response plan ahead of time. Without a plan, you may destroy critical evidence that could be used to prosecute the offender. You might also overlook just how the incident occurred, leaving you exposed to future breaches.

Log analysis is an essential component of an incident response plan. You'll want to review logs from the compromised machine or machines and from other sources, including network devices and access control systems.

A number of log types--transaction, server access, application server, and OS--can all provide valuable information to retrace what occurred. If your database administrator has enabled transaction logs--and it's a big if--start there because they're a rich source of information.

Your first goal is to understand what data has been extracted, which will help you gauge the current risk to the company. Then examine what else the attacker may have tried to do. As you review logs, look for queries that would match the data known to be exported. If you don't have any evidence to match against, gather up the database administrator, application developer, and anyone else who knows normal application and database activity. Get a conference room, display the logs on a projector, and have them help you look for anomalies such as unusual queries that applications or administrators wouldn't normally make.

Search logs for evidence of SELECT statements and examine the results for those that appear to be out of the norm. This is where having a DBA or application developer on hand will help. They know the applications that access this database server and can pick out suspect queries, such as those that return more records than normal, are formatted differently, or are preceded by erroneous requests. For example, improper SQL statement formats are common when an attacker doesn't know the database structure and is attempting to blindly guess database, table, and row names. In addition to SELECT statements, look for INSERTS, DELETES, DROPS, or command execution queries.

The attacker may also have attempted to insert a database account, edit logs, or execute system commands from within the database, among other tactics.

Multiple Sources

Unfortunately, transaction logs typically aren't enabled on a database because the logging process can hurt performance. But there are other logs that can help an investigation.

After transaction logs (if available), move on to logs from other sources, including the database server, the application server, and the OS. If the server tracks authentication attempts, user actions, or file changes, it may be possible to gather evidence here. The attacker may have compromised the server before going after the database. Or he may have gone through an application--compromising a Web application is by far the most common vector for accessing data. Look for authentication attempts that appear out of place, both successful and failed.

If file-level auditing was enabled by the system admin for the server OS, check if files were created in any unusual directory. This could be evidence of a database dump or copy.

If you know whether the attack was directly against the database or via an application, you may want to bypass system-level logs initially and focus on network and application logs to gain more information faster. You can then return to the system logs later to gather additional data. Review application or server logs for anomalies, similar to how you would look for anomalies in database logs.

For application servers, look for lots of requests from the same IP address and those that came in rapid succession, which may indicate an automated attack against the application. Also look for user authentication errors or exceptions.

Finally, review logs of recent user activity. An attacker may have poked around, run commands, or set off an audit alert that will show up within OS security, network, or host intrusion-detection system, or other system logs. If the database in question uses the OS or a directory service such as Active Directory to authenticate users, then the authentication logs may provide evidence of which accounts have logged in. This can help determine if the data exposed was the result of an external attack or an inside job.

When a database breach comes to light, it's all too easy for IT to panic. A panicked response is likely to be a poor one, so create an incident response plan when you are calm and rational. It's better to have one and not need it than to need one and not have it.

You've Been Breached:

Responding to a Database Compromise
Become an InformationWeek Analytics subscriber: $99 per person per month, multiseat discounts available.

Subscribe and get our full report on surviving a breach. This report includes 13 pages of action-oriented analysis. What you'll find:

Get This And All Our Reports