Here I am again talking about NoSQL databases, as I’ve done before. But for good reason: We’re seeing more and more security and compliance teams scrambling to make sure they can fulfill their missions when businesses decide to roll out these new databases to support cloud, social and mobile apps.

Because effective teamwork relies on at least some common level of understanding, data security professionals must learn the basics of these systems so they can effectively consult with application teams to articulate the relative risk involved. However, they also need to weigh that risk against the benefits the business hopes to gain. So, assuming that you have a say in the decision, coming in with a plan for cooperation and collaboration for mitigating risk is a win-win.

Why Are NoSQL Databases Appealing?

Many organizations need to stay on the cutting edge of technology. They are creating new breeds of applications and thus are evaluating, proving and moving to production with NoSQL databases. Why? Because these databases are often specifically designed to address the varying needs of cloud, mobile, social and analytics.

You can pick a NoSQL database that has better technical characteristics for certain types of applications and thus optimize for speed or scalability. These databases often handle unstructured data much better. They also streamline development because there is a closer alignment between the data structures and the application object model.

Many of these new databases are developed through the open source community, which makes them responsive to the needs of developers. They often include basic security, but more advanced security features are usually provided by enterprise versions of the software distributed by a vendor.

For more background, you might want to take a look at this ranking of NoSQL databases by popularity. There are also analyst reports that offer insight into relative market share for various NoSQL database systems. Of course, this space is constantly shifting as new players are added and these systems gain or lose popularity based on experience from actual deployments.

Why Your Opinion Counts

Data breaches are a reality in your world. You understand the implications. It can be hard to determine when any particular database is breached, let alone a NoSQL database, and there are examples of serious security incidents. More will come as cybercriminals uncover new vulnerabilities.

In an ideal world, data security professionals would have some influence over new database decisions. We would all join hands in harmony and evaluate database candidates based on critical factors such as cost, scalability, performance, availability and security. I hope this is happening where you work.

If you have influence over a database decision from a security point of view, think about the basics:

• Does this database have a robust authentication model? Will it integrate with existing identity management and authentication mechanisms used in the enterprise, such as LDAP or Kerberos?
• Does the database include granular authorization capabilities? Does it support use of database roles to ease the management of authorizations inside the database and yet ensure the principle of least privilege?
• What options for encryption exist for data at rest and in motion? Will the encryption solution seamlessly integrate with existing key management infrastructure?
• What about data masking or fine-grained access control? Can security rules control access to specific attributes or subsets of an object?
• Can I audit database access without significantly impacting database performance?
• What do we need to do to ensure we are compliant with industry standards? Does the solution work with an existing data security and compliance solution? Or will we need to do special report processing and build our own alerting infrastructure to meet basic security and compliance requirements?

How to Improve NoSQL Security

When there are gaps, teams must work together to agree on appropriate compensating controls, which could include an independent security and auditing solution or adding requirements to build security controls into the application. This could affect the overall cost/benefit analysis, but it must be added to the equation.

If not, it becomes a political and technical struggle during deployment when it is more costly and stressful to handle. Best to just deal with the reality early on — preferably when the application is being architected and before the database decision is made. Tools such as IBM Security Guardium can help you uniformly secure and protect SQL and NoSQL databases, big data platforms and files across the organization.

Read the white paper: Finding the path to security in the big data landscape