Project Quant: Database Security - Configure

The next task in the Secure phase is to configure the databases. In the Planning phase we gathered industry standards and best practices, developed internal policies, and defined settings to standardize on. We also established the respective importance of policy violations, so we can filter critical alerts which require from from purely informational notifications. Then, in the Discovery phase, we gathered a list of databases, gained access to those systems, and implemented the rules we want to run (generally in the form of SQL queries), which are the instantiations of policies from the Planning phase. Now we take the results of our scans and figure out how to configure the databases.

Assess

• Variables: Time to review assessment reports per database. You will have multiple databases and perhaps different types, so add up the time for each.
• Time to analyze failures, policy violations, and incorrect settings. Review the scans and identify policy/rule violations. Identify rules that failed to execute vs. actual misconfigured entries.

Prescribe

• Time to gather itemized issues to address. Order according to criticality.
• Time to select remediation options. Issues may be patching or configuration changes, or workaround options may be available. Specify appropriate response to each policy violation.
• Time to allocate resources and create work orders. If workflow or trouble ticket systems are used, record necessary changes.

Fix

• Time to reconfigure database. Make changes to tables and configuration files as prescribed.
• Time to implement changes and reboot database server. Many configuration changes are not effective until the system restarts.

Rescan

• Number of retries. If assessment must be rerun to verify configuration changes, include subsequent scans.
• Variable: Total cost to rescan. This is the setup, scan, and distribution subset of the Assess phase. For failed policies, calculate cost of rescans.

Document

• Time to document changes. Itemize changes to configuration.
• Time to document accepted variances from prescribed configuration. If policies are not appropriate for a particular database or database type, note the exceptions.
• Time to specify configuration, policy, and rule changes. If rules or SQL queries break due to changes, or there is a need to reflect policy changes in rules used, document required changes.

—Adrian Lane