Welcome!

Recurring Revenue Authors: Zakia Bouachraoui, Carmen Gonzalez, Yeshim Deniz, Elizabeth White, Pat Romanski

Blog Feed Post

Guard Your Data Services Carefully

A common thing to do these days is to create data access web services directly on top of your databases to open up access to that data to other services and applications, essentially creating a data services layer for your SOA. I've even recommended such an approach before. While conceptually this may be a good idea, this also presents an increased security risk.

To be widely usable (or reusable), these data services tend to need to support a general querying interface. A lot of EII products will in fact let you create data services that will take XQuery to query the data source. This is in effect analogous to widely opening up a SQL interface into your database. There's a reason why direct connections to databases are not made widely available--either someone can issue malicious queries to the database or some inept developer can create some massive query that will bring the database to its knees.

Besides not widely opening up direct database connections, RDBMSes also have pretty fine-grained access control so that you can specify what users have what kind of access to specific tables and columns. The data services in your SOA will also need such fine-grained access control policies. In this case, they will be specifying access control on the specific operations and XML elements and attributes. The key is to be able to specify and enforce the policies down to the specific elements and attributes.

Ideally, this would be done through a tight integration between the service's policy enforcement point and the XQuery processor (assuming you're supporting XQuery on your data service) so that if your XQuery references attributes and elements you don't have access to, the query wouldn't even be processed. I don't know of any products that do this, but there are some other ways to do it.

Assuming the source of your data service is an RDBMS, you could set up an access control policy internal to the RDBMS that maps to the access control policy of the data service so that once the XQuery is translated to SQL and executed in the RDBMS you let the RDBMS's security mechanisms enforce the access control.

If maintaining two sets of mapped access control policies like this sounds like a pain in the ass, the other approach is to have a post processing step where you can strip out data from the XML using XSLT for the parts that the client does not have access to. With this approach, you need to make sure that you've designed the XML schema such that once you've stripped out those parts you still have a valid XML document. Also this approach may not be the most efficient--bringing back all the data as XML and then applying XSLT to filter stuff out. It would be much more efficient to do that in the RDBMS.

And then lastly, similar to how direct access to databases are not made widely available, you're going to have to be more restrictive about who you grant access to your data services. This will also prevent any Joe Schmoe developer in your enterprise from issuing some crazy XQuery that will bring down your data service and the database behind it. Such restrictiveness may be in direct conflict with one of your reasons for creating data services in the first place, but it's probably a necessary compromise.

Read the original blog entry...

More Stories By Tieu Luu

Tieu Luu works at SuprTEK where he helps the U.S. government create and implement strategies and architectures that apply innovative technologies and approaches in IT. You can read more of Tieu’s writing at his blog at http://tieuluu.com/blog.

IoT & Smart Cities Stories
At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throug...
History of how we got here. What IoT devices are most vulnerable? This presentation will demonstrate where hacks are most successful, through hardware, software, firmware or the radio connected to the network. The hacking of IoT devices and systems explained in 6 basic steps. On the other side, protecting devices continue to be a challenging effort. Product vendors/developers and customers are all responsible for improving IoT device security. The top 10 vulnerabilities will be presented a...
At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throug...
Every organization is facing their own Digital Transformation as they attempt to stay ahead of the competition, or worse, just keep up. Each new opportunity, whether embracing machine learning, IoT, or a cloud migration, seems to bring new development, deployment, and management models. The results are more diverse and federated computing models than any time in our history.
At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throug...
Atmosera delivers modern cloud services that maximize the advantages of cloud-based infrastructures. Offering private, hybrid, and public cloud solutions, Atmosera works closely with customers to engineer, deploy, and operate cloud architectures with advanced services that deliver strategic business outcomes. Atmosera's expertise simplifies the process of cloud transformation and our 20+ years of experience managing complex IT environments provides our customers with the confidence and trust tha...
Where many organizations get into trouble, however, is that they try to have a broad and deep knowledge in each of these areas. This is a huge blow to an organization's productivity. By automating or outsourcing some of these pieces, such as databases, infrastructure, and networks, your team can instead focus on development, testing, and deployment. Further, organizations that focus their attention on these areas can eventually move to a test-driven development structure that condenses several l...
The graph represents a network of 1,329 Twitter users whose recent tweets contained "#DevOps", or who were replied to or mentioned in those tweets, taken from a data set limited to a maximum of 18,000 tweets. The network was obtained from Twitter on Thursday, 10 January 2019 at 23:50 UTC. The tweets in the network were tweeted over the 7-hour, 6-minute period from Thursday, 10 January 2019 at 16:29 UTC to Thursday, 10 January 2019 at 23:36 UTC. Additional tweets that were mentioned in this...
Over the course of two days, in addition to insightful conversations and presentations delving into the industry's current pressing challenges, there was considerable buzz about digital transformation and how it is enabling global enterprises to accelerate business growth. Blockchain has been a term that people hear but don't quite understand. The most common myths about blockchain include the assumption that it is private, or that there is only one blockchain, and the idea that blockchain is...
Never mind that we might not know what the future holds for cryptocurrencies and how much values will fluctuate or even how the process of mining a coin could cost as much as the value of the coin itself - cryptocurrency mining is a hot industry and shows no signs of slowing down. However, energy consumption to mine cryptocurrency is one of the biggest issues facing this industry. Burning huge amounts of electricity isn't incidental to cryptocurrency, it's basically embedded in the core of "mini...