Database Systems Vulnerabilities

Vulnerabilities specific to the database system itself include the following:

Data Mining

Data mining is a process of discovering information in data warehouses by running queries on the data. A large repository of data is required to perform data mining. Data mining is used to reveal hidden relationships, patterns, and trends in the data warehouse. Data mining is based on a series of analytical techniques taken from the fields of mathematics, statistics, cybernetics, and genetics. The techniques are used independently and in cooperation with one another to uncover information from data warehouses.

Aggregation

Aggregation is combining non-sensitive or lower sensitivity data from separate sources to create higher sensitivity information. For example, a user takes two or more publicly available pieces of data and combines them to form a classified piece of data that then becomes unauthorized for that user. Thus, the combined data sensitivity can be greater than the sensitivity of individual parts.

Database systems inherit any platform vulnerabilities and add database-specific vulnerabilities. They typically contain large quantities of valuable information and require high-speed operation with large number of transactions.

Databases are considered a high-value target and may be sought out by attackers and have attackers willing to spend greater effort to find technical vulnerabilities to exploit than other system types.

Inference

Attacker guesses information from observing available information. Essentially, users may be able to determine unauthorized information from what information they can access and may never need to directly access unauthorized data.

This tends to make database systems high-value targets for any attacker.