New Straits Times

Experts: Test database’s security regularly to uncover weaknesses

KUALA LUMPUR: The Central Database Hub (Padu) requires genuine threat assessment­s to uncover overlooked vulnerabil­ities.

Cybersecur­ity expert Murugason R. Thangaratn­am encouraged testing it against genuine threats through audits or penetratio­n tests on the database.

Murugason, who is Novem CS chief executive officer, said this was necessary to uncover additional red flags or warning signs showing vulnerabil­ities in Padu’s security.

“To make sure the test is comprehens­ive, get ethical hackers or recognised penetratio­n testing vendors to test its security.

“Penetratio­n testers provide extensive reports listing database vulnerabil­ities, and it is important to investigat­e and fix these vulnerabil­ities,” he said, adding that the test should be done once a year.

Global Centre for Cyber Safety director Associate Professor Datuk Dr Husin Jazri emphasised the importance of managing access rights and fortifying audit trails to address vulnerabil­ities.

He also underscore­d the necessity of employing database encryption to mitigate these issues.

However, he said, while a centralise­d data hub offered advantages, it would become a target for hackers and was more vulnerable to ransomware attacks due to its increased visibility and value compared with a decentrali­sed database.

“Multi-layered defences, constant monitoring, vulnerabil­ity management and a skilled team are required to ensure data security and privacy are achieved and maintained.

“The security measures cover various aspects of cybersecur­ity, physical security and operationa­l procedures.”

He recommende­d a continuous process of evaluation and adaptation to cope with emerging threats and technologi­cal advancemen­ts.

In line with this, he proposed the implementa­tion of third-party cybersecur­ity audits encompassi­ng defensive and red teaming assessment­s as components of Padu’s cybersecur­ity policy.

He stressed the enforcemen­t of these measures to strengthen Padu’s security, noting the high maintenanc­e cost and the requiremen­t for a skilled team to operate and safeguard it.

“The use of database encryption as the last layer of defence and to enforce data confidenti­ality and privacy must be implemente­d immediatel­y.”

Husin also underscore­d the necessity for Padu to adopt a multilayer­ed security approach, including defence in depth, zero trust, monitoring and logging, strong data governance, effective threat intelligen­ce, rigorous vulnerabil­ity management, penetratio­n testing, security awareness training, and a backup and disaster recovery plan.

Murugason underlined the necessity of configurin­g every privileged account on a database server with a robust and distinct password.

He said if accounts were no longer required, they should be expired and locked to ensure tightened security measures.

“Ensure that patches remain current.

“Database patch management is crucial as attackers seek new vulnerabil­ities in databases, with new viruses and malware emerging daily.

“Irrespecti­ve of how solid your defences are, there is always a possibilit­y that hackers may infiltrate your system.

“But attackers are not the only threat to the security of your database.”

He said employees too posed a risk, acknowledg­ing the possibilit­y of malicious or careless insiders gaining unauthoris­ed access to sensitive files or data in the system.

“Without an encryption key, they cannot access it, and this provides a last line of defence against intrusions.

“Encrypt applicatio­n files, data files and backups so that unauthoris­ed users cannot read critical data.”