To say that database security managers have to be masters of multitasking is a huge understatement. While their daily to-do lists are large and varied enough to give anyone a headache, some parts of the job cause more headaches than others.

Polling database security managers using Protegrity Inc.'s Secure.Data privacy-management products, Ulf Mattsson and Peter Nilsson came up with this list of the top 10 database security management headaches. Mattsson is CTO, and Nilsson serves as senior vice president for Stamford, Conn.-based Protegrity, a maker of privacy-management products.

Besides giving managers a chance to vent, this list also provides insights into why database security problems arise and tips about how to avoid mistakes and which tasks should be performed regularly.

1. Odious daily maintenance tasks. One part of the daily grind is maintaining privileges to the database, which involves updating and changing user access rights and assigning different types of access control to different users. Another task is maintaining control or an overview of the new objects performing against the database. This involves asking questions like: What data are they querying? Are the users authorized to that data? Finally, it's a hassle, but a necessity, to review database audit logs to ensure that there hasn't been a misappropriation of data.

2. When users are losers. It's very common for users to lose or delete data, objects or tables. Restoring that lost-in-cyberspace information can be tough.

3. Microsoft's goofs. Most people won't be surprised to hear that Windows operating systems have some shortcomings in database security. Theft of passwords is the top problem in Windows environments. For example, a user or administrator could access the database by creating a ?run-as? service and get unauthorized access to data. Denial of service is another hassle caused by Windows administrators making mistakes in start-up or shutdown of database services.

4. Application designers who avoid the road most traveled. Building non-standardized or varying methods of database security for different applications can cause administrative hassles and difficulties, particularly in maintaining access policies across different applications. Also, building in a reliance on application security without proper access controls at the database layer can expose sensitive data.

5. When haste makes waste in migrations and upgrades. Failure to perform a proper post-migration evaluation often leads to overlooked losses or exposures. Too often, security and database administrators fail to perform security consistency checks before and after the upgrade or migration. In the case of ultra-sensitive, highest-security operations, failure to ensure continuity of database security mechanisms during the upgrade or migration can leave a window of opportunity for hacker-attacks.

6. Middleware muddles. Managers report that unwanted middleware access to the database causes security breaches. To avoid this hassle, security and database administrators must stop unauthorized database access from middleware components, including the application server, which can be treated as a middleware in this scenario. Also, you can cement database security by using trusted/secured connections and communications between middleware and the database and proven/standardized authentication mechanisms.

7. Culture clashes. Oftentimes in an organization, all database management activities are left in the exclusive control of the database administrators, creating a dependency on the DBA to establish and apply access control rules to data. However, for database security to be effective, a separation of duties must be established. This establishment should allow the DBA to attend to management of the database environment but a security officer to administer the security procedures around sensitive data. Without a separation of duties, the security and privacy of protected data cannot be enforced to all users, regardless of IT position.

8. UFUs: Unidentified Filing Users. One of a database security administrator's toughest jobs is managing user authentication mechanisms. Not knowing the source of user-authentication can weaken the whole security process. For example, other database security steps such as authorization to specific data rely first on the trusted authentication and identification of the user.

9. Will the real application please stand up? Unauthorized applications can be created by malicious users and disguised as ones with legitimate connections to the database. This practice, called application spoofing, makes it difficult to identify and verify the validity of all applications that are accessing the database.

10. The little goofs that bring down the roof. Lack of password management and access control measures can lead to disasters.

Failure to properly manage user-passwords and histories, and password rules and recycling can lead to password-based vulnerabilities. Many publicized hack-attacks have been related to oversights in removing IDs and access privileges of former employees or users.

Failure to apply even the most basic access control mechanisms as provided by the major databases, can leave the door wide open for a host of unauthorized users to access the database. Although access control does not directly secure data-items like encryption, it does provide an important first step in deterring unwanted access to the database.