{"id":2557,"date":"2014-08-31T14:15:50","date_gmt":"2014-08-31T18:15:50","guid":{"rendered":"http:\/\/sqlity.net\/en\/?p=2557"},"modified":"2014-11-26T17:50:43","modified_gmt":"2014-11-26T22:50:43","slug":"segregation-of-duties","status":"publish","type":"post","link":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/","title":{"rendered":"Common Database Vulnerabilities: Missing Segregation"},"content":{"rendered":"
\n

\nTo segregate means to set apart. Segregation of duties (aka separation of duties) describes the action of defining and separating roles in a company or other group. The goal of segregation is to prevent fraud and manage conflict of interest. Segregation has been used in democratic governments for a long time and is also common in several business types like accounting and banking. For example, in the banking industry, you often find that a larger transaction needs to be initiated by one person and then approved by another person.\n<\/p>\n

\n\"segregation<\/a>\n<\/div>\n

Segregation of Duties in IT<\/h3>\n

\nWhen dealing with sensitive data, many problems can be avoided by setting up a similar segregation of duties. For example, the person who is able to copy and decrypt data in the credit card table should not be the same person that can disable auditing. While following such a strict separation cannot prevent all fraudulent or malicious activities, it can greatly reduce the risk of them being executed by internal personnel. Remember, more than three quarters of all attacks come from or are enabled by internal sources.\n<\/p>\n

\nSeveral regulatory laws like Sarbanes-Oxley do now require segregation of duties, and many external auditors will fail you if you do not have the roles in your organization clearly defined.\n<\/p>\n

The Cost of Separation of Duties <\/h3>\n

\nSmall businesses often do not have the manpower to implement strict separation of duties. At that point the security officer (or the person assuming that role, often the owner) has to balance the risk of not implementing the separation with the cost of hiring additional employees. There might be also ways to spread the different roles effectively amongst the existing work force. For example, if a database audit is set up correctly, it does not require any development skills to review it. Therefore, the role of internal auditor could fall on a person that was originally hired for a different skill set.\n<\/p>\n

Collusion<\/h3>\n

\nSegregation of duties cannot prevent fraud if collusion is in play. In fact, if enough people in an organization collude to execute some form of fraud or other malicious activity, there is probably not a lot that can be done to prevent it. However, collusion requires significantly more criminal energy and is therefore less common than single person fraud.\n<\/p>\n

Roles to Segregate<\/h3>\n

\nThere are many ways to set up segregation, but the following common roles probably should be on your radar: Database Administrator, Server Administrator, Backup Operator and Security Administrator (especially if you are dealing with encryption keys). SQL Server does not always make it simple to set up segregation of duties correctly. For example, there are still many actions that require membership in the sysadmin fixed server role. However, Microsoft is continuously improving the situation and most segregation requirements can be implemented out of the box.\n<\/p>\n

\nThe time to act is now. Review the roles in your company and identify areas in which segregation is appropriate or required. Do not wait until someone misused inappropriate power.\n<\/p>\n

The Most Common Database Problems<\/h3>\n

\nBackup Data Exposure is one of the most commonly encountered database vulnerabilities. In this series of posts, I discuss 10 of them. Below are the ones that are published so far:\n<\/p>\n

\n
\n

Common Database Vulnerabilities: Privilege Abuse<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: SQL Injection<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Unprotected Network<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Inadequate Patch Management<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Backup Data Exposure<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Missing Segregation<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Flawed Key Management<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Weak Audit Trail<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Data Inference<\/a><\/h2>\n
<\/div>\n<\/div>\n
\n

Common Database Vulnerabilities: Defects<\/a><\/h2>\n
<\/div>\n<\/div>\n<\/div>\n\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Segregation of Duties, the separation of power into different roles, plays an important part in designing an effective security strategy for your business. Discover how to apply this concept when it comes to database security.<\/p>\n

[more…]<\/a><\/p>\n","protected":false},"author":3,"featured_media":2558,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[222,5,34,27],"tags":[231,58,232,15],"class_list":["post-2557","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-common-database-vulnerabilities","category-general","category-security","category-series","tag-roles","tag-security-management","tag-segregation-of-duties","tag-sql-server"],"acf":[],"yoast_head":"\nCommon Database Vulnerabilities: Missing Segregation - sqlity.net<\/title>\n<meta name=\"description\" content=\"Segregation of Duties, the separation of power into different roles, plays an important part in designing an effective security strategy for your business.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Common Database Vulnerabilities: Missing Segregation - sqlity.net\" \/>\n<meta property=\"og:description\" content=\"Segregation of Duties, the separation of power into different roles, plays an important part in designing an effective security strategy for your business.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/\" \/>\n<meta property=\"og:site_name\" content=\"sqlity.net\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/sqlity.net\" \/>\n<meta property=\"article:published_time\" content=\"2014-08-31T18:15:50+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2014-11-26T22:50:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/segregation-of-duties.png\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Sebastian Meine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@sqlity\" \/>\n<meta name=\"twitter:site\" content=\"@sqlity\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sebastian Meine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/\"},\"author\":{\"name\":\"Sebastian Meine\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#\\\/schema\\\/person\\\/bcffd8c572bc2f1bd10fdba80135e53c\"},\"headline\":\"Common Database Vulnerabilities: Missing Segregation\",\"datePublished\":\"2014-08-31T18:15:50+00:00\",\"dateModified\":\"2014-11-26T22:50:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/\"},\"wordCount\":568,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sqlity.net\\\/wp-content\\\/uploads\\\/2014\\\/08\\\/segregation-of-duties.png\",\"keywords\":[\"roles\",\"security management\",\"segregation of duties\",\"SQL Server\"],\"articleSection\":[\"Common Database Vulnerabilities\",\"General\",\"Security\",\"Series\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/\",\"url\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/\",\"name\":\"Common Database Vulnerabilities: Missing Segregation - sqlity.net\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sqlity.net\\\/wp-content\\\/uploads\\\/2014\\\/08\\\/segregation-of-duties.png\",\"datePublished\":\"2014-08-31T18:15:50+00:00\",\"dateModified\":\"2014-11-26T22:50:43+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#\\\/schema\\\/person\\\/bcffd8c572bc2f1bd10fdba80135e53c\"},\"description\":\"Segregation of Duties, the separation of power into different roles, plays an important part in designing an effective security strategy for your business.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/#primaryimage\",\"url\":\"https:\\\/\\\/sqlity.net\\\/wp-content\\\/uploads\\\/2014\\\/08\\\/segregation-of-duties.png\",\"contentUrl\":\"https:\\\/\\\/sqlity.net\\\/wp-content\\\/uploads\\\/2014\\\/08\\\/segregation-of-duties.png\",\"width\":960,\"height\":600,\"caption\":\"segregation of duties\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2557\\\/segregation-of-duties\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sqlity.net\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Common Database Vulnerabilities: Missing Segregation\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/sqlity.net\\\/en\\\/\",\"name\":\"sqlity.net\",\"description\":\"Quality for SQL\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/sqlity.net\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#\\\/schema\\\/person\\\/bcffd8c572bc2f1bd10fdba80135e53c\",\"name\":\"Sebastian Meine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g\",\"caption\":\"Sebastian Meine\"},\"sameAs\":[\"http:\\\/\\\/sqlity.net\",\"https:\\\/\\\/x.com\\\/sqlity\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Common Database Vulnerabilities: Missing Segregation - sqlity.net","description":"Segregation of Duties, the separation of power into different roles, plays an important part in designing an effective security strategy for your business.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/","og_locale":"en_US","og_type":"article","og_title":"Common Database Vulnerabilities: Missing Segregation - sqlity.net","og_description":"Segregation of Duties, the separation of power into different roles, plays an important part in designing an effective security strategy for your business.","og_url":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/","og_site_name":"sqlity.net","article_publisher":"https:\/\/www.facebook.com\/sqlity.net","article_published_time":"2014-08-31T18:15:50+00:00","article_modified_time":"2014-11-26T22:50:43+00:00","og_image":[{"width":960,"height":600,"url":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/segregation-of-duties.png","type":"image\/png"}],"author":"Sebastian Meine","twitter_card":"summary_large_image","twitter_creator":"@sqlity","twitter_site":"@sqlity","twitter_misc":{"Written by":"Sebastian Meine","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/#article","isPartOf":{"@id":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/"},"author":{"name":"Sebastian Meine","@id":"https:\/\/sqlity.net\/en\/#\/schema\/person\/bcffd8c572bc2f1bd10fdba80135e53c"},"headline":"Common Database Vulnerabilities: Missing Segregation","datePublished":"2014-08-31T18:15:50+00:00","dateModified":"2014-11-26T22:50:43+00:00","mainEntityOfPage":{"@id":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/"},"wordCount":568,"commentCount":0,"image":{"@id":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/#primaryimage"},"thumbnailUrl":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/segregation-of-duties.png","keywords":["roles","security management","segregation of duties","SQL Server"],"articleSection":["Common Database Vulnerabilities","General","Security","Series"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/","url":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/","name":"Common Database Vulnerabilities: Missing Segregation - sqlity.net","isPartOf":{"@id":"https:\/\/sqlity.net\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/#primaryimage"},"image":{"@id":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/#primaryimage"},"thumbnailUrl":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/segregation-of-duties.png","datePublished":"2014-08-31T18:15:50+00:00","dateModified":"2014-11-26T22:50:43+00:00","author":{"@id":"https:\/\/sqlity.net\/en\/#\/schema\/person\/bcffd8c572bc2f1bd10fdba80135e53c"},"description":"Segregation of Duties, the separation of power into different roles, plays an important part in designing an effective security strategy for your business.","breadcrumb":{"@id":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/#primaryimage","url":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/segregation-of-duties.png","contentUrl":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/segregation-of-duties.png","width":960,"height":600,"caption":"segregation of duties"},{"@type":"BreadcrumbList","@id":"https:\/\/sqlity.net\/en\/2557\/segregation-of-duties\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sqlity.net\/en\/"},{"@type":"ListItem","position":2,"name":"Common Database Vulnerabilities: Missing Segregation"}]},{"@type":"WebSite","@id":"https:\/\/sqlity.net\/en\/#website","url":"https:\/\/sqlity.net\/en\/","name":"sqlity.net","description":"Quality for SQL","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sqlity.net\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/sqlity.net\/en\/#\/schema\/person\/bcffd8c572bc2f1bd10fdba80135e53c","name":"Sebastian Meine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g","caption":"Sebastian Meine"},"sameAs":["http:\/\/sqlity.net","https:\/\/x.com\/sqlity"]}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/segregation-of-duties.png","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2wXuw-Ff","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/posts\/2557","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/comments?post=2557"}],"version-history":[{"count":0,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/posts\/2557\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/media\/2558"}],"wp:attachment":[{"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/media?parent=2557"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/categories?post=2557"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/tags?post=2557"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}