returns single number, ~10,000, doesn't expose any individual information, but we can do more… Inference Attack Example : Find count of UWEC students that: Have a local address in Eau Claire Have a GPA of between 3.1 and 3.2 Are majoring in computer science SELECT FROM StudentDB WHERE cond1 AND cond2 AND cond3 AND … Getting down to fewer and fewer students as we add filter conditions. If count gets down to 1, you know an individual exists with those characteristics. May even be able to gain private information. Find average hourly pay rate for UWEC students that have the above characteristics. Inference Attack Prevention Techniques: Return an approximate number of rows (e.g. between A and B) Limit the number of filtering conditions on a query. Return ranges for values, especially for sensitive fields (e.g. salary falls between X and Y) Difficult to balance functionality and security with such data. Database Issue - Correlation Attack Data in database may be anonymous. However, it may able to be correlated with another set of data which is not anonymous. Anonymity can thus be removed. Example: Statistical analysis of public but anonymized Netflix date set using internet movies database (imdb.com) data. By comparing rankings and timestamps from Netflix data, authors identified a subset of individuals through correlated data from IMDB. Secure Application Development Access to Oracle Database of environment through applications. Need to consider security of applications using database as well as security of data in database itself. SQL Injection
returns single number, ~10,000, doesn't expose any individual information, but we can do more… Inference Attack Example : Find count of UWEC students that: Have a local address in Eau Claire Have a GPA of between 3.1 and 3.2 Are majoring in computer science SELECT FROM StudentDB WHERE cond1 AND cond2 AND cond3 AND … Getting down to fewer and fewer students as we add filter conditions. If count gets down to 1, you know an individual exists with those characteristics. May even be able to gain private information. Find average hourly pay rate for UWEC students that have the above characteristics. Inference Attack Prevention Techniques: Return an approximate number of rows (e.g. between A and B) Limit the number of filtering conditions on a query. Return ranges for values, especially for sensitive fields (e.g. salary falls between X and Y) Difficult to balance functionality and security with such data. Database Issue - Correlation Attack Data in database may be anonymous. However, it may able to be correlated with another set of data which is not anonymous. Anonymity can thus be removed. Example: Statistical analysis of public but anonymized Netflix date set using internet movies database (imdb.com) data. By comparing rankings and timestamps from Netflix data, authors identified a subset of individuals through correlated data from IMDB. Secure Application Development Access to Oracle Database of environment through applications. Need to consider security of applications using database as well as security of data in database itself. SQL Injection
database_security_issues.docx