{"id":2555,"date":"2014-08-30T17:15:42","date_gmt":"2014-08-30T21:15:42","guid":{"rendered":"http:\/\/sqlity.net\/en\/?p=2555"},"modified":"2014-11-26T17:55:15","modified_gmt":"2014-11-26T22:55:15","slug":"backup-data-exposure","status":"publish","type":"post","link":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/","title":{"rendered":"Common Database Vulnerabilities: Backup Data Exposure"},"content":{"rendered":"
\n

\nA few months back I got a call from a client. The client was worried about a database backup that had gone missing and they wanted me to determine if that was a problem. Well, it was\u2026 But, let me start at the beginning.\n<\/p>\n

\"backup<\/a><\/p>\n

The Nasty Implications of Backup Data Exposure<\/h3>\n

\nYou probably have a sophisticated backup and restore strategy in place. You regularly take backups of your valuable data and you might even ship it offsite.
\nThe benefit of a backup is that it contains a copy of your data. However, the big problem with backups is that they contain a copy of your data.\n<\/p>\n

\nMost of us spend a lot of energy on securing the data in the database, making sure the application and the different roles in the organization are all following the principle of least privilege<\/a>, and no one can get unauthorized access to the precious data.\n<\/p>\n

\nHowever, when it comes to backups, many start to get less concerned. Backups are placed on tape and shipped across the country. Backups end up on employees laptops for development purposes. You might even use an online backup solutions.\n<\/p>\n

\nBut if you are dealing with sensitive data, the backups contain all that same sensitive data and you therefore have to protect them the same way. Anyone that can get a hold of a backup file can just restore the database on one of their own servers, and then go about dissecting the sensitive data within it undisturbed.\n<\/p>\n

Protect your Data and your Backups<\/h3>\n

\nThe client I was talking about before had thought about all this ahead of time and had encrypted the data in the database. Encrypted table data naturally stays encrypted within any backup. Therefore they thought they had dealt with the problem of backup data exposure. But when an employee's laptop with one of the more recent backups was stolen they got worried nonetheless and decided to bring me in to reconfirm that they were indeed in the clear.\n<\/p>\n

\nWhen I looked at the database, a big problem became immediately obvious. The data was encrypted using the ENCRYPTBYPASSPHRASE<\/a> function and in an attempt to make the encryption as transparent to the application as possible, the passphrase was stored within the same database in several places. This step forced access through a controlling T-SQL module and therefore increased access control for the data in question. However, it did not really provide any encryption benefits and certainly no backup data exposure protection.\n<\/p>\n

\nThis example might be an extreme case of encryption key mismanagement<\/a>, but the point I am trying to make is that you not only have to protect the data within your database, but you also have to protect the backups. A strategy designed to protect the data within the database is often not sufficient to protect the data within a backup. The easiest way to protect the data within a backup is to encrypt the entire backup. If you are on SQL 2014 already, that functionality is built in. In earlier versions, you have to find other ways to protect your backups (e.g. with an external tool to do the encryption).\n<\/p>\n

\nThe time to act is now, not after one of your backups has been stolen. Review your entire backup file life cycle and make sure you have no areas of unintentional backup data exposure.\n<\/p>\n

The Most Common Database Problems<\/h3>\n

\nBackup Data Exposure is one of the most commonly encountered database vulnerabilities. In this series of posts, I discuss 10 of them. Below are the ones that are published so far:\n<\/p>\n

\n
\n

Common Database Vulnerabilities: Privilege Abuse<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: SQL Injection<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Unprotected Network<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Inadequate Patch Management<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Backup Data Exposure<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Missing Segregation<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Flawed Key Management<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Weak Audit Trail<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Data Inference<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Defects<\/a><\/h2>\n
<\/div>\n<\/div>\n<\/div>\n\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Backups are a common cause for data breaches. Read on to find out, why strategies designed to protect the sensitive data within your database are often inadequate to provide the same protection within a backup.<\/p>\n

[more…]<\/a><\/p>\n","protected":false},"author":3,"featured_media":2556,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[69,222,5,34,27],"tags":[70,229,74,230,31,38,15],"class_list":["post-2555","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-backup","category-common-database-vulnerabilities","category-general","category-security","category-series","tag-backup-2","tag-backup-data-exposure","tag-backup-strategy","tag-data-exposure","tag-encryption","tag-security-2","tag-sql-server"],"acf":[],"yoast_head":"\nCommon Database Vulnerabilities: Backup Data Exposure - sqlity.net<\/title>\n<meta name=\"description\" content=\"Backups are a common cause for breaches. Discover why strategies designed to protect your database are often not adequate to prevent backup data exposure.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Common Database Vulnerabilities: Backup Data Exposure - sqlity.net\" \/>\n<meta property=\"og:description\" content=\"Backups are a common cause for breaches. Discover why strategies designed to protect your database are often not adequate to prevent backup data exposure.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/\" \/>\n<meta property=\"og:site_name\" content=\"sqlity.net\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/sqlity.net\" \/>\n<meta property=\"article:published_time\" content=\"2014-08-30T21:15:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2014-11-26T22:55:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/backup-data-exposure.png\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Sebastian Meine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@sqlity\" \/>\n<meta name=\"twitter:site\" content=\"@sqlity\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sebastian Meine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/\"},\"author\":{\"name\":\"Sebastian Meine\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#\\\/schema\\\/person\\\/bcffd8c572bc2f1bd10fdba80135e53c\"},\"headline\":\"Common Database Vulnerabilities: Backup Data Exposure\",\"datePublished\":\"2014-08-30T21:15:42+00:00\",\"dateModified\":\"2014-11-26T22:55:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/\"},\"wordCount\":630,\"commentCount\":1,\"image\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sqlity.net\\\/wp-content\\\/uploads\\\/2014\\\/08\\\/backup-data-exposure.png\",\"keywords\":[\"backup\",\"backup data exposure\",\"backup strategy\",\"data exposure\",\"Encryption\",\"security\",\"SQL Server\"],\"articleSection\":[\"Backup\",\"Common Database Vulnerabilities\",\"General\",\"Security\",\"Series\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/\",\"url\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/\",\"name\":\"Common Database Vulnerabilities: Backup Data Exposure - sqlity.net\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sqlity.net\\\/wp-content\\\/uploads\\\/2014\\\/08\\\/backup-data-exposure.png\",\"datePublished\":\"2014-08-30T21:15:42+00:00\",\"dateModified\":\"2014-11-26T22:55:15+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#\\\/schema\\\/person\\\/bcffd8c572bc2f1bd10fdba80135e53c\"},\"description\":\"Backups are a common cause for breaches. Discover why strategies designed to protect your database are often not adequate to prevent backup data exposure.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/#primaryimage\",\"url\":\"https:\\\/\\\/sqlity.net\\\/wp-content\\\/uploads\\\/2014\\\/08\\\/backup-data-exposure.png\",\"contentUrl\":\"https:\\\/\\\/sqlity.net\\\/wp-content\\\/uploads\\\/2014\\\/08\\\/backup-data-exposure.png\",\"width\":960,\"height\":600,\"caption\":\"backup data exposure\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2555\\\/backup-data-exposure\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sqlity.net\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Common Database Vulnerabilities: Backup Data Exposure\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/sqlity.net\\\/en\\\/\",\"name\":\"sqlity.net\",\"description\":\"Quality for SQL\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/sqlity.net\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#\\\/schema\\\/person\\\/bcffd8c572bc2f1bd10fdba80135e53c\",\"name\":\"Sebastian Meine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g\",\"caption\":\"Sebastian Meine\"},\"sameAs\":[\"http:\\\/\\\/sqlity.net\",\"https:\\\/\\\/x.com\\\/sqlity\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Common Database Vulnerabilities: Backup Data Exposure - sqlity.net","description":"Backups are a common cause for breaches. Discover why strategies designed to protect your database are often not adequate to prevent backup data exposure.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/","og_locale":"en_US","og_type":"article","og_title":"Common Database Vulnerabilities: Backup Data Exposure - sqlity.net","og_description":"Backups are a common cause for breaches. Discover why strategies designed to protect your database are often not adequate to prevent backup data exposure.","og_url":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/","og_site_name":"sqlity.net","article_publisher":"https:\/\/www.facebook.com\/sqlity.net","article_published_time":"2014-08-30T21:15:42+00:00","article_modified_time":"2014-11-26T22:55:15+00:00","og_image":[{"width":960,"height":600,"url":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/backup-data-exposure.png","type":"image\/png"}],"author":"Sebastian Meine","twitter_card":"summary_large_image","twitter_creator":"@sqlity","twitter_site":"@sqlity","twitter_misc":{"Written by":"Sebastian Meine","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/#article","isPartOf":{"@id":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/"},"author":{"name":"Sebastian Meine","@id":"https:\/\/sqlity.net\/en\/#\/schema\/person\/bcffd8c572bc2f1bd10fdba80135e53c"},"headline":"Common Database Vulnerabilities: Backup Data Exposure","datePublished":"2014-08-30T21:15:42+00:00","dateModified":"2014-11-26T22:55:15+00:00","mainEntityOfPage":{"@id":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/"},"wordCount":630,"commentCount":1,"image":{"@id":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/#primaryimage"},"thumbnailUrl":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/backup-data-exposure.png","keywords":["backup","backup data exposure","backup strategy","data exposure","Encryption","security","SQL Server"],"articleSection":["Backup","Common Database Vulnerabilities","General","Security","Series"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/","url":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/","name":"Common Database Vulnerabilities: Backup Data Exposure - sqlity.net","isPartOf":{"@id":"https:\/\/sqlity.net\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/#primaryimage"},"image":{"@id":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/#primaryimage"},"thumbnailUrl":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/backup-data-exposure.png","datePublished":"2014-08-30T21:15:42+00:00","dateModified":"2014-11-26T22:55:15+00:00","author":{"@id":"https:\/\/sqlity.net\/en\/#\/schema\/person\/bcffd8c572bc2f1bd10fdba80135e53c"},"description":"Backups are a common cause for breaches. Discover why strategies designed to protect your database are often not adequate to prevent backup data exposure.","breadcrumb":{"@id":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/#primaryimage","url":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/backup-data-exposure.png","contentUrl":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/backup-data-exposure.png","width":960,"height":600,"caption":"backup data exposure"},{"@type":"BreadcrumbList","@id":"https:\/\/sqlity.net\/en\/2555\/backup-data-exposure\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sqlity.net\/en\/"},{"@type":"ListItem","position":2,"name":"Common Database Vulnerabilities: Backup Data Exposure"}]},{"@type":"WebSite","@id":"https:\/\/sqlity.net\/en\/#website","url":"https:\/\/sqlity.net\/en\/","name":"sqlity.net","description":"Quality for SQL","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sqlity.net\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/sqlity.net\/en\/#\/schema\/person\/bcffd8c572bc2f1bd10fdba80135e53c","name":"Sebastian Meine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g","caption":"Sebastian Meine"},"sameAs":["http:\/\/sqlity.net","https:\/\/x.com\/sqlity"]}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/backup-data-exposure.png","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2wXuw-Fd","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/posts\/2555","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/comments?post=2555"}],"version-history":[{"count":0,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/posts\/2555\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/media\/2556"}],"wp:attachment":[{"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/media?parent=2555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/categories?post=2555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/tags?post=2555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}