In Database as a Service (DBaaS), cloud users outsource their data management to Cloud Service Providers (CSPs). However, this raises serious security concerns regarding data confidentiality, integrity, availability, and control.
Stakeholders
- Data Owners – who own the data.
- Users – who access/query the data.
- CSPs – who provide and manage DBaaS.
- Third-Party Auditors (TPAs) – who verify data integrity and compliance.
Major Security Threats in DBaaS
1. Data Confidentiality Risks
- Data may be unprotected during transit or storage.
- Lack of encryption or poor key management.
- Insider threats: Superusers can misuse privileges to access sensitive data (e.g., business, medical records).
- External attacks: Spoofing, sniffing, man-in-the-middle, side-channel attacks.
2. Data Integrity Issues
- Unauthorized modification/deletion of records without backup.
- Poor authentication and authorization mechanisms.
- Lack of accounting controls (logs, traceability).
3. Data Availability Challenges
- Resource exhaustion due to incorrect specification of user requirements.
- System failures (hardware/software) causing inconsistent views.
- Failed auditing and monitoring tools or systems.
- Denial-of-Service (DoS) attacks by attackers.
Special Concerns in Cloud DBaaS
🔸 Multi-tenancy & Data Leakage
- Data from multiple users stored on same infrastructure can lead to data recovery risks.
- Attackers may retrieve deleted data unless proper sanitization (scrubbing) is done.
🔸 Data Provenance
- Tracking data origin and flow is difficult.
- Needs metadata analysis which is computationally expensive and time-sensitive.
🔸 Lack of Transparency
- Users are unaware of the physical location of their data.
- Violates data privacy laws in regions like Europe or South America, which restrict cross-border data storage.
🔸 Replication and Consistency
- DBaaS replicates data to improve availability.
- But maintaining consistency across all replicas is challenging.
Security Controls Suggested
- Strong encryption before data transfer.
- Proper authentication, authorization, and accounting (AAA) mechanisms.
- Auditing and monitoring, even when delegated to Third-Party Auditors, should follow strict policies.
- Backups and disaster recovery processes must be regular and reliable.
- Compliance with data residency laws.