Database Security LESSON1

DATABASE SECURITY
OBJECTIVES
Understand and explain the place of database
security in the context of security analysis and
management.
Understand, explain and apply the security concepts
relevant to database systems.
Understand, identify and find solutions to security
problems in database systems.
Understand the basic language of security
mechanisms as applied to database systems.
Analyze access control requirements and perform
fairly simple implementations using SQL.
Appreciate the limitations of security subsystems.
OVERVIEW
All systems have ASSETS and security is about

protecting assets. The first thing, then, is to
know your assets and their value. In this
chapter, concentrate on database objects
(tables, views, rows), access to them, and the
overall system that manages them. Note that
not all data is sensitive, so not all requires
great effort at protection. All assets are under
threat.
OVERVIEW
The second thing to know is what THREATs are

putting your assets at risk. These include
things such as power failure and employee
fraud. Note that threats are partly hypothetical,
always changing and always imperfectly
known. Security activity is directed at
protecting the system from perceived threats.
OVERVIEW
If a threat is potential, you must allow for it to

become an actuality. When it becomes actual
there is an IMPACT. Impact you can consider
and plan for. But in the worst case, there will be
a LOSS. Security activity here is directed at
minimizing the loss and recovering the
database to minimize the loss as well as further
protecting from the same or similar threats.
Threat Impact Loss
PROTECT
DETECT
PREDICT RECOVER
MINIMIZE
PREVENT
AN OUTLINED DEVELOPMENT
MECHANISM IS:
Document assets (what they are, what their

value is)
Identify treats (what they are, how likely they
are, what will be the impact is if they occur).
Associate threats with each asset.
Design mechanisms to protect each asset
appropriate to its value and the cost of its
protection, to detect a security breach against
each asset, to minimize the losses incurred
and to recover normal operation.
THREATS TO THE DATABASE
Building your security skills comes from two

directions.
One is from the appreciation and awareness
of changing threats, and
the other from the technical remedies to
them.
THREATS INCLUDE:
Unauthorized modification: Changing data

values for reasons of sabotage, crime or
ignorance which may be enabled by
inadequate security mechanisms, or sharing
of passwords or password guessing, for
example.
THREATS INCLUDE:
Unauthorized
disclosure: When
information that should
not have been disclosed
has been disclosed. A
general issue of crucial
importance, which can
be accidental or
deliberate.
THREATS INCLUDE:
Loss of availability:
Sometimes called denial
of service. When the
database is not available
it incurs a loss (otherwise
life is better without the
system!). So any threat
that gives rise to time
offline, even to check
whether something has
occurred, is to be avoided.
CATEGORIES OF SPECIFIC REGULATORY
THREATS TO DATABASE SYSTEMS.
Commercial sensitivity: Most financial
losses through fraud arise from
employees. Access controls provide
both protection against criminal acts
and evidence of attempts (successful
or otherwise) to carry out acts
detrimental to the organization,
whether fraud, extraction of sensitive
data or loss of availability.
Data logs, User Authentication
THREATS TO DATABASE SYSTEMS
Personal privacy and data protection:
Internationally, personal data is
normally subject to legislative
controls. Personal data is data about
an identifiable individual.
Example: Postal code for a home may
in some cases identify an individual, if
only one person is living at an address
with the postal code. Such data needs
careful handling and control.
THREATS TO DATABASE SYSTEMS
Computer misuse: There is also
generally legislation on the misuse
of computers. Misuse includes the
violation of access controls and
attempts to cause damage by
changing the database state or
introducing worms and viruses to
interfere with proper operation.
These offences are often
extraditable.
Audit requirements: These are
operational constraints built around the
need to know who did what, who tried to
do what, and where and when everything
happened. They involve the detection of
events (including CONNECT and GRANT
transactions), providing evidence for
detection, assurance as well as either
defense or prosecution. There are issues
related to computer-generated evidence.
System logs
END

Database Security LESSON1

Uploaded by

Copyright:

Available Formats

Database Security LESSON1

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Database Security LESSON1

Uploaded by

Copyright:

Available Formats

DATABASE SECURITY

All systems have ASSETS and security is about

The second thing to know is what THREATs are

If a threat is potential, you must allow for it to

Document assets (what they are, what their

Building your security skills comes from two

Unauthorized modification: Changing data

You might also like