Random Column Names: Security & Data Protection

TL;DR

Using randomly generated column names in your databases can significantly improve security by making it harder for attackers to predict and exploit your data structure. It also helps with compliance and reduces the risk of accidental data exposure.

Why Use Random Column Names?

Traditionally, database columns have descriptive names like ‘customer_name’, ‘order_date’, or ’email_address’. While convenient for developers, these predictable names are a goldmine for attackers. Here’s why:

• SQL Injection: Attackers can guess column names to craft malicious SQL queries that extract sensitive data.
• Data Discovery: Predictable names make it easier for attackers to map out your database schema and identify valuable information.
• Compliance: Some regulations require obfuscation of sensitive data, which random column names can help achieve.

How to Implement Random Column Names

1. Generate Unique Names: Create a function or script that generates unique, random strings for each column name. The length and complexity should be sufficient to prevent brute-force guessing (e.g., 16+ characters with mixed case letters, numbers, and symbols).

import uuid

def generate_column_name():
    return str(uuid.uuid4())[:16] # Generates a 16-character random string

2. Mapping Table: Maintain a separate table (or configuration file) that maps the random column names to their actual meanings. This is crucial for developers and applications to understand the data.

Example mapping table structure:

Random Column Name	Actual Meaning
a1b2c3d4e5f6g7h8	customer_name
i9j0k1l2m3n4o5p6	email_address

3. Application Logic: Modify your application code to use the mapping table when interacting with the database. Instead of directly referencing ‘customer_name’, it should look up the corresponding random column name.

   # Example Python using a dictionary for the mapping
   mapping = {"a1b2c3d4e5f6g7h8": "customer_name", "i9j0k1l2m3n4o5p6": "email_address"}
   
   def get_data(column_meaning):
       if column_meaning in mapping:
           return mapping[column_meaning]
       else:
           return None # Handle cases where the meaning isn't found
   

4. Database Creation Scripts: Integrate the random name generation into your database creation scripts. This ensures that all new columns are automatically assigned random names.

   For example, in PostgreSQL:

   CREATE TABLE customers (
       id SERIAL PRIMARY KEY,
       name VARCHAR(255) AS (generate_column_name()),
       email VARCHAR(255) AS (generate_column_name())
   );
   

5. Regular Rotation: Consider periodically rotating the random column names. This adds another layer of security, as even if an attacker discovers the current mapping, it will eventually become outdated.

Considerations

• Performance: Looking up column names in a mapping table can introduce a slight performance overhead. However, this is usually negligible compared to the security benefits.
• Maintainability: Managing the mapping table requires careful planning and documentation. Ensure that it’s properly versioned and backed up.
• Compatibility: Some database tools or reporting applications may not be compatible with random column names. Test thoroughly before deploying to production.