STUDY OF THE EFFECTIVENESS OF SERVER ATTACKS ON RELATIONAL AND NON-RELATIONAL DATABASES. CREATION OF A DEFENSE STRATEGY.

Abstract

The current state of information technology development is characterized by the widespread use of databases in various fields of activity, in particular, in business, medicine, science and public administration. The growth of data volumes and their value leads to an increase in the number of cyberattacks on databases. In this regard, the issue of ensuring database security is becoming particularly relevant. The article considers the effectiveness of server attacks on relational and non-relational databases. A detailed analysis of attack methods, such as SQL/NoSQL injections and dictionary attacks, is carried out, and their consequences for the security of information systems are assessed. The effectiveness of password brute-force cracking is analyzed depending on the parameters of hash functions and the number of hashing rounds of the bcrypt library. It is shown that with an increase in the number of hashing rounds, the computational stability of password selection increases, so each attempt takes more time to process. However, even with a limited dictionary and an effective brute-force method, the attack can be performed in a fairly short period of time if the hashing parameters are chosen incorrectly. Schematic drawings of attacks on the corresponding types of databases are presented. A comprehensive protection strategy is proposed to ensure the confidentiality, integrity and availability of information, which includes pre-processing of user data, hashing of passwords, setting limits on the number of requests, delimiting access and blocking of computerized actions. Methods for countering server attacks are described and implemented, in particular, functional libraries for the secure storage of user passwords are considered. In addition, a comparison of the effectiveness of different types of attacks in the context of existing protection methods is carried out. The results of the study demonstrated that the comprehensive implementation of the basic components of the protection strategy significantly increases the resistance of data to typical server attacks, especially in a scalable environment with a large number of entry points.