{'fraction_non_alphanumeric': 0.029063859192715744, 'fraction_numerical': 0.008658184626641193, 'mean_word_length': 5.101686507936508, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Data security as a top priority in the digital world: preserve data value by being proactive and thinking security first

Today, large amounts of data are being continuously produced, collected, and exchanged between systems. As the number of devices, systems and data produced grows up, the risk of security breaches increases. This is all the more relevant in times of COVID-19, which has affected not only the health and lives of human beings' but also the lifestyle of society, i.e., the digital environment has replaced the physical. This has led to an increase in cyber security threats of various nature. While security breaches and different security protection mechanisms have been widely covered in the literature, the concept of a primitive artifact such as data management system seems to have been more neglected by researchers and practitioners. But are data management systems always protected by default? Previous research and regular updates on data leakages suggest that the number and nature of these vulnerabilities are high. It also refers to little or no DBMS protection, especially in case of NoSQL, which are thus vulnerable to attacks. The aim of this paper is to examine whether traditional vulnerability registries provide a sufficiently comprehensive view of DBMS security, or they should be intensively and dynamically inspected by DBMS owners by referring to Internet of Things Search Engines moving towards a sustainable and resilient digitized environment. The paper brings attention to this problem and makes the reader think about data security before looking for and introducing more advanced security and protection mechanisms, which, in the absence of the above, may bring no value.


Introduction
Today, in the age of information and Industry 4.0, billions of data sources, including but not limited to interconnected devices (sensors, monitoring devices) forming Cyber-Physical Systems (CPS) and the Internet of Things (IoT) ecosystem, continuously generate, collect, process, and exchange data [1]. With the rapid increase in the number of devices (smart objects or "things", e.g., smartphones, smartwatches, intelligent vehicles etc.) and information systems in use, the amount of data is increasing. Moreover, due to the digitization and variety of data being continuously produced and processed with a reference to Big Data, their value, is also growing and as a result, the risk of security breaches and data leaks, including but not limited to users' privacy [2]. The value of data, however, is dependent on several factors, where data quality and data security that can affect the data quality if the data are accessed and corrupted, are the most vital. Data serve as the basis for decision-making, input for models, forecasts, simulations etc., which can be of high strategical and commercial / business value.
This has become even more relevant in terms of COVID-19 pandemic, when in addition to affecting the health, lives, and lifestyle of billions of citizens globally, making it even more digitized, it has had a significant impact on business [3]. This is especially the case because of challenges companies have faced in maintaining business continuity in this so-called "new normal". However, in addition to those cybersecurity threats that are caused by changes directly related to the pandemic and its consequences, many previously known threats have become even more desirable targets for intruders, hackers. Every year millions of personal records become available online [4][5][6].
Lallie et al. [3] have compiled statistics on the current state of cybersecurity horizon during the pandemic, which clearly indicate a significant increase of such. As an example, Shi [7] reported a 600% increase in phishing attacks in March 2020, just a few months after the start of the pandemic, when some countries were not even affected. Miles [8], however, reported that in 2021, there was a record-breaking number of data compromises, where "the number of data compromises was up more than 68% when compared to 2020", when LinkedIn was the most exploited brand in phishing attacks, followed by DHL, Google, Microsoft, FedEx, WhatsApp, Amazon, Maersk, AliExpress and Apple. And while [5] suggests that vulnerability landscape is returning to normal, there is another trigger closely related to cybersecurity that is now affecting the world -geopolitical upheaval.
Recent research demonstrated that weak data and database protection in particular is one of the key security threats [4, 6,[9][10][11]. This poses a serious security risk, especially in the light of the popularity of search engines for Internet connected devices, also known as Internet of Things Search Engines (IoTSE), Internet of Everything (IoE) or Open Source Intelligence (OSINT) Search Engines such as Shodan, Censys, ZoomEye, BinaryEdge, Hunter, Greynoise, Shodan, Censys, IoTCrawler. While these tools may represent a security risk, they provide many positive and security-enhancing opportunities. They provide an overview on network security, i.e., devices connected to the Internet within the company, are useful for market research and adapting business strategies, allow to track the growing number of smart devices representing the IoT world, tracking ransomware -the number and nature of devices affected by it, and therefore allow to determine the appropriate actions to protect yourself in the light of current trends. However, almost every of these white hat-oriented objectives can be exploited by blackhatters. The popularity of IoTSE decreased a level of complexity of searching for connected devices on the internet and easy access even for novices due to the widespread popularity of step-by-step guides on how to use IoT search engine to find and gain access if insufficiently protected to webcams, routers, databases and in particular non-relational (NoSQL) databases, and other more «exotic» artifacts such as power plants, wind turbines or refrigerators. They provide service-and country-wised exposure dashboards, TOP vulnerabilities according to CVE, statistics about the authentication status, Heartbleed, BlueKeep -a vulnerability revealed in Microsoft's Remote Desktop Protocol that has become even more widely used during pandemics, port usage and the number of already compromised databases. Some of these data play a significant role for experienced and skilled attackers, making these activities even less resource-consuming by providing an overview of the ports to be used to increase the likelihood of faster access to the artifact etc.
In the past, vulnerability databases such as CVE Details were considered useful resources for monitoring the security level of a product being used. However, they are static and refer to very common vulnerabilities in the product being registered when a vulnerability is detected. Advances in ICT, including the power of the IoTSE, require the use of more advanced techniques for this purpose.
The aim of this paper is to examine both current data security research and to analyse whether "traditional" vulnerability registries provide a sufficient insight on DBMS security, or they should be rather inspected by using IoTSE-based and respective passive testing, or dynamically inspected by DBMS holders conducting an active testing. As regards the IoTSE tool, this study refers to Shodan-and Binary Edge-based vulnerable open data sources detection tool -ShoBeVODSDT -proposed in [9].
The paper is structured as follows: Section 2 provides the reader with a background, including a brief overview of data(base) security research, Section 3 gives an overview of database security threats according to the CVE Details, Section 4 provides a comparative analysis of the results extracted from the CVE database with the results obtained as a result of the application of the IoTSE-based tool. Section 5 summarizes the study, making call for "security first" principle.

Rationale of the study
Data security, and therefore database security, should be a priority for IT management as an extremely valuable asset for any organization [10][11]. Failure to comply with the requirements for security and protection of data and sensitive data in particular can lead to significant damage and losses of commercial, reputation, operational etc. nature. Recent research, however, often point out the problems associated with meeting even the most trivial requirements. A Data Breach Investigations Report [6] revealed that one of the most prominent and growing problems is the misconfiguration of DBMS. This is even more the case for NoSQL. Given that in case of NoSQL there is less focus on the security mechanism (i.e., it was not their priority), some research such as Fahd et al. [11] do not recommended to directly expose them to an open environment, where untrusted clients can directly access them. This refers to a frequently observed highly vulnerable combination of data (such as relational or document databases or cloud file storage) placed on the Internet without controls, combined with security researchers looking for them [6]. These rather undesirable combinations have been on the rise for the past few years constituting the concept of "open database". The term does not refer to data storage facilities that have been assigned the Open Database License (ODL), whereby they are knowingly made available to users to be freely used, shared, modified while maintaining the same freedom for others, thus contributing to the openness paradigm. Instead, it refers to insecure and unprotected database that can be accessed by any stakeholder despite the agreement of the data holder, which poses a serious risk. This was studied in [9], revealing that while there are databases that can be considered as open databases being accessible via Internet, the difference between NoSQL and relational database management systems (RDBMS) is not as obvious with some weak results demonstrated by SQL databases.
All in all, research aimed at identifying security threats and vulnerabilities in databases is relatively limited, with especially little research on NoSQL security, despite the vulnerabilities in NoSQL database systems is a well-known problem [9,11]. Moreover, when examining recent database research, other aspects not related to security -their performance and efficiency in certain scenarios, scalability (sharding), availability (replication), dynamism (no rigid schema) etc. appear to be more popular with much less attention paid to security [11]. An analysis of a set of key security features offered by four NoSQL systems -Redis, Cassandra, MongoDB and Neo4j [11], however, concluded that NoSQL is characterized by mostly low level of both builtin security, encryption, authentication and authorization, and auditing, while most NoSQL lack them.
The next Section is intended to provide an insight on database security provided by CVE Details -probably the most widely known registry of vulnerabilities.

CVE scope and classification of the vulnerabilities
The CVE security vulnerability database is a free source of information providing details on disclosed cybersecurity vulnerabilities and exploits constituting a catalogue of over 172 thousand entries. These records are added to the database through a six-step process, where each interested party can contribute to the database and, if the identified vulnerability is approved, the relevant information will become part of the registry with the priority and risk assigned as a result of its discovery, where the verification is performed by the CVE participant, thereby making this list authoritative.
cross-site scripting known as XSS, 3.
code execution (arbitrary code on vulnerable system), 6.

CVE statistics of most popular databases
For the purposes of this study, the most popular databases were selected for their further analysis. The list was formed based on the results of the DB-Engines Ranking, presenting data on March 2022. In addition to the TOP-10 most popular databases CouchDB, Memcached and Cassandra were selected based on their popularity in other lists. Table I lists them along with their type and basic statistics on their vulnerabilities. The latter is retrieved from the CVE registry, where the date of the 1st and last reported vulnerability is recorded to determine if the registry provides continuous and up-to-date data, the total number of vulnerabilities reported between these dates, the most frequently reported vulnerability, and a list of 3 most popular vulnerabilities in recent 5 years. This is intended to provide some general statistics and point to current trends and whether they have changed, i.e., whether the most popular vulnerability over the years is still a key threat or the developers managed to resolve it.
Despite the undeniable popularity of NoSQL databases, relational databases remain popular, and TOP-5 consists of 4 RDBMS and MongoDB. However, at the same time, it should be noted that all the most popular relational DBMS, taking the highest places are multi-model, i.e., adapted to current trends. For example, Oracle has proven to be the most popular, using a relational DBMS as its primary database model, while secondary models include document store, graph DBMS, RDF store, and Spatial DBMS. Similarly, MySQL secondary database models are represented by document store and spatial database, as are PostgreSQL and Microsoft SQL, although the latter uses graph DBMS in addition to the above.
The highest number of discovered vulnerabilities are in MySQL, although this is the only database for which data are no longer provided, i.e., the last vulnerability was registered in 2015. MySQL is followed by PostgreSQL and IBM Db2, with Cassandra, Memcached, CouchDB, Microsoft Access, Elasticsearch and Redis reporting the fewest vulnerabilities. Although the number of revealed vulnerabilities does not necessarily mean that the level of the relevant databases is definitely higher or lower, which may depend on the popularity of these databases, users and community involvement, this suggests such an assumption. In some cases, these statistics play a decisive role in choosing a database giving the impression of a higher "security-by-design" level. At the same time, the aforementioned databases with fewer reported vulnerabilities have come under the spotlight in some of recent data leakages, with Elasticsearch dominating [13-14], from which data on unique 1.2 billion people was leaked in 2019, making this one of the largest data leaks from a single source organization in history. This also applies to perhaps the most provocative database -MongoDB, whose low security level has been widely discussed and because of which it is very often the object of IoT search engines "trainings", for which step-by-step guides are provided. Ferrari et al.
For the most common and major vulnerabilities encountered over time, most of them are DoS, although code execution is also a widespread vulnerability. A database-wised analysis of the most frequently reported vulnerabilities over the past 5 years demonstrate that Code Execution is the most common and is in the TOP-3 for 11 databases, followed by overflow (7), DoS (6), bypassing something (4), gaining information (3). While these data are very general, Figure 1 shows data on vulnerabilities reported in 2021 and their scores, i.e., risk level (red bars indicate the highest scores or the highest number of highrisk level vulnerabilities). While for some of them data for 2022 is also provided, the purpose of this study requires to focus on 2021, when IoTSE-driven analysis by Daskevics & Nikiforova [9] took place, thereby allowing for more consistent comparison of results. At the same time, there data on Elasticsearch, Microsoft Access and Memcached for 2021 are not available. In terms of their vulnerability in 2020, however, Elasticsearch suffered most from XSS with information obtaining and DoS, Microsoft Access -code execution, where one was combined with an overflow, while for Memcached DoS was registered.

Fig. 1. Vulnerability of data storages in 2021 and their score (based on CVE Details) [author]
For the most popular vulnerability, the same trend is observed, i.e., 8 of 43 vulnerabilities refer to DoS, another 8 -to code execution, followed by 7 cases of overflow and 5 information leaks. Some vulnerabilities may overlap, which explains the inconsistencies in the data obtained from the registry, i.e., 31 of 43 have been supplied with corresponding detail. This, however, together with [5], according to which VulnDB has identified many thousands of vulnerabilities that were not registered in the CVE Details database, puts into question the completeness and accuracy of the CVE registry in regard to the actual state of the art.
MongoDB and Oracle have the most reported vulnerabilities, followed by Redis and PostgreSQL. Again, despite the widespread discussion about the highest risk of vulnerabilities for NoSQL compared to SQL, this is not so obvious since RDBMS are also at risk. The level of risk of registered vulnerabilities for Microsoft SQL is the highest.
Otherwise, very obvious and strong conclusions cannot be drawn from the data provided. However, it can be speculated that MongoDB is weak against DoS, but Redis against code execution and overflow. To get more supported results, this paper addresses the call made in [9] and maps the results obtained in that study to the data obtained from CVE Details.

CVE registry vs. IoTSE-based testing results
In this section, a brief overview of the results will be given, and more specifically their comparison with the results obtained by IoTSE-based tool ShoBeVODSDST that conducts a penetration testing [9]. In addition to providing both results and ranking databases by overall results, the focus will be on "Gain Information" category, as it corresponds well to the aspect inspected by ShoBeVODSDST -"managed to connect and gather sensitive data" (4th of 5 risk levels). In [9], it was expected that a correlation will be determined, allowing assumption to be made about less secure data sources. Table 2 shows the statistics of the services under consideration, as well as their total number of vulnerabilities and the percentage of the "Gain Information" vulnerability. It should be noted that ShoBeVODSDST inspects a limited list of predefined data sources (8) with the possibility of enriching it, as its source code is publicly available. According to Table 2, MySQL, the data on which is not updated by CVE, accounts more than half of all databases found on the Internet. However, the number of instances that it was able to connect to is not very high for MySQL representing 18 databases, which is similar to PostgreSQL where the number of found databases is 1187 with only 2 databases could be connected. However, there were 5 vulnerabilities in PostgreSQL registered by CVE Details, with 2 of them related to information gaining that was not found by ShoBeVODSDT. At the same time, the absolute leader in this negative trend is Memcached, where it was possible to connect to 93 of 116 databases with more than 20% of the databases, from which data have been either gathered or they were found to be already compromised. Similar results were obtained for Elasticsearch, where it was possible to connect to 90% of all databases found, and 27% of the databases are already compromised or data could be gathered from them. Similarly, CVE Details does not provide details of its vulnerabilities in 2021. MongoDB and Redis showed the worst results for both data sources, where MongoDB was inferior to data gatherings and has a large number of compromised databases according to ShoBeVODSDT and is subject to both DoS, code execution and data gatherings according to CVE Details. Redis, however, with being relatively difficult to connect to, where every 10th database is inferior to this, is characterized by a high ratio of information gatherings. According to CVE Details, both DoS, code execution, overflow, and memory corruption have been detected for it. Additionally, Oracle was one of the most frequently reported databases in CVE Details, with 10 vulnerabilities in total, while only two of them have a comprehensive description -both related to DoS.
All in all, the results in most cases are rather complimentary, and one source cannot completely replace the second. This is not only due to scope limitations of both sources -CVE Details cover some databases not covered by ShobeVODSDT, while not providing the most up-to-date information with a very limited insight on MySQL.
At the same time, there are cases when both sources refer to a security-related issues and their frequency, which can be seen as a trend and treated by users respectively taking action to secure the database that definitely do not comply with the "secure by design" principle. This refers to MongoDB, PostgreSQL and Redis. CouchDB, however, can be considered relatively secure by design, as is less affected, as evidenced by both data sources, where only one vulnerability was reported in CVE Details in 2021, while it was the only data source, to which ShoBeVODSDT was not able to connect. The latter, however, could be because CouchDB proved to be less popular, with only 14 of nearly 15 000 instances found.

Conclusions
Obviously, data security should be the top priority of any information security strategy. Failure to comply with the requirements for security and protection of data can lead to significant damage and losses of commercial, reputation, operational etc. nature [11]. However, despite the undeniable importance of data security, the current level of data security is relatively lowdata leaks occur regularly, data become corrupted in many cases remaining unnoticed for IS holders. According to Risk Based Security Monthly Newsletter, 73 million records were exposed in March 2022, and 358 vulnerabilities were identified as having a public exploit that had not yet been provided with CVE IDs.
This study provided a brief insight of the current state of data security provided by CVE Details -the most widely known vulnerability registry, considering 13 databases. Although the idea of CVE Details is appealing, i.e., it supports stakeholder engagement, where each person or organization can submit a report about a detected vulnerability in the product, it is obviously not sufficiently comprehensive. It can be used to monitor the current state of vulnerabilities, but this static approach, which sometimes provides incomplete or inconsistent information even about revealed vulnerabilities, must be complemented by other more dynamic solutions. This includes not only the use of IoTSE-based tools, which, while providing valuable insight into unprotected databases seen or even accessible from outside the organization, are also insufficient.
The paper shows an obvious reality, which, however, is not always visible to the company. In other words, while this may seem surprisingly in light of current advances, the first step that still needs to be taken thinking about date security is to make sure that the database uses the basic security features: authentication, access control, authorization, auditing, data encryption and network security [11,[16][17]. Ignorance or non-awareness can have serious consequences leading to data leakages if these vulnerabilities are exploited. Data security and appropriate database configuration is not only about NoSQL, which is typically considered to be much less secured, but also about RDBMS. This study has shown that RDBMS are also relatively inferior to various types of vulnerabilities. Moreover, there is no "secure by design" database, which is not surprising since absolute security is known to be impossible. However, this does not mean that actions should not be taken to improve it. More precisely, it should be a continuous process consisting of a set of interrelated steps, sometimes referred to as "reveal-prioritize-remediate".
It should be noted that 85% of breaches in 2021 were due to a human factor, with social engineering recognized as the most popular pattern [12]. The reason for this is that even in the case of highly developed and mature data and system protection mechanism (e.g., IDS), the human factor remains very difficult to control. Therefore, education and training of system users regarding digital literacy, as well as the definition, implementation and maintaining security policies and risk management strategy, must complement technical advances.