Database Security

1
Outline
 Overview To Database Security.

 What is Database Security
 Why need of database security.
 Concepts of Database Security.
 Security Problems
 Security Controls
OVERVIEW
In today’s world, we need everything secured whether it is your mobile phone ,
computer , vehicle or almost anything.
 Every day, hackers unleash attacks designed to steal confidential data, and an
organization’s database servers are often the primary targets of these attacks. Databases
are one of the most compromised assets .
 “The reason databases are targeted so often is quite simple—they are at the heart of any
organization, storing customer records and other confidential business data,”.
 Organizations are not protecting these crucial assets well enough.
 “When hackers and malicious insiders gain access to sensitive data, they can quickly
extract value, inflict damage or impact business operations.
 In addition to financial loss or reputation damage, breaches can result in regulatory
violations, fines and legal fees. 3
What is database
Database: security?
It is a collection of information stored in a computer.
Security:
It is being free from danger.
Database Security:
It is the mechanisms that protect the database against intentional or

accidental threats.
4
Definition of Database Security
Database Security is defined as the process by

which “Confidentiality, Integrity and Availability” of
the database can be protected
5
Why need of database security?
Data will be easily

If there is no corrupted
security to
database what It is important to restrict
happens??? access to the database from
authorized users to protect
sensitive data.
6
Concepts of Database Security
Three are 3 main

aspects
1. Secrecy or Confidentiality
2. Integrity
3. Availability
7
SECRECY /
 It is protecting the database from unauthorized users.
 Ensures that users are allowed to do the things they are

trying to do.
 Encryption is a technique or a process by which the data

is encoded in such a way that only that authorized users
are able to read the data.
8
INTEGRITY
 Protecting the database from authorized users.
 Ensures that what users are trying to do is correct.
For examples,
 An employee should be able to modify his or her own
information.
9
AVAILABILITY
 Database must have not unplanned downtime.
 To ensure this ,following steps should be taken
Restrict the amount of the storage space given to each user in the database.
 Limit the number of concurrent sessions made available to each

 database user.
Back up the data at periodic intervals to ensure data recovery in case of

application users.
10
11
SECURITY
PROBLEM
S
Any circumstance or event with the potential to adversely12
impact an IS through unauthorized access, destruction,
disclosure, modification of data, and/or denial of service.
There are two kinds of threat.
 Non-fraudulent Threat
 fraudulent Threat
13
1. Non-fraudulent Threat
 Natural or accidental disasters.
 Errors or bugs in hardware or software.
 Human errors. Often this is due to the lack of expertise required to implement security
controls, enforce policies or conduct incident response processes
 Excessive privileges. When workers are granted default database privileges that exceed the
requirements of their job functions, these privileges can be abused.
 Unmanaged sensitive data. Many companies struggle to maintain an accurate inventory of
their databases and the critical data objects contained within them. “Forgotten databases
may contain sensitive information, and new databases can emerge without visibility to the
security team. Sensitive data in these databases will be exposed to threats if the required
controls and permissions are not implemented.
fraudulent Threat
 Authorized users
 Those who abuse their privileges and authority.
 Hostile agents
 Those improper users (outsider or insiders).
 who attack the software and/or hardware system, or read or write
data in a database.
Fraudulent attacks……
 The most common database threats include:
 Legitimate privilege abuse. Users may abuse legitimate database privileges for unauthorized purposes.
 Malware. A perennial threat, malware is used to steal sensitive data via legitimate users using infected devices.
 Database injection attacks. The two major types of database injection attacks are SQL injections that target
traditional database systems and NoSQL injections that target “big data” platforms.
Fraudulent attacks…..
 Storage media exposure. Backup storage media is often completely unprotected from attack. As a result, numerous
security breaches have involved the theft of database backup disks and tapes. Furthermore, failure to audit and
monitor the activities of administrators who have low-level access to sensitive information can put your data at risk.
Taking the appropriate measures to protect backup copies of sensitive data and monitor your most highly privileged
users is not only a data security best practice, but also mandated by many regulations.
 Exploitation of vulnerable databases. It generally takes organizations months to patch databases, during which
time they remain vulnerable. Attackers know how to exploit unpatched databases or databases that still have default
accounts and configuration parameters.
DATABASE
PROTECTION 17
REQUIREMENTS
1. Protection from Improper Access
2. Protection from Inference
3. Integrity of the Database
4. User Authentication
5. Multilevel Protection
6. Confinement
7. Management and Protection of Sensitive Data

SECURITY
CONTROLS
15
19
 Authorization - privileges, views.
 Encryption - public key / private key,

secure
sockets.
 Authentication – passwords.
 Logical - firewalls, net proxies.

20
A FIREWALL is dedicated software on another computer which

inspects network traffic passing through it and denies (or) permits
passage based on set of rules. Basically it is a piece of software that
monitors all traffic that goes from your system to another via the
Internet or network and Vice Versa
Database Firewalls are a type of Web Application Firewalls that

monitor databases to identify and protect against database specific
attacks that mostly seek to access sensitive information stored in
the databases.
21
22
 Data encryption enables to encrypt sensitive data, such as credit

card numbers, stored in table columns.
 Encrypted data is decrypted for a database user who has

access to the data.
 Data encryption helps protect data stored on media in the event

that the storage media or data file gets stolen.
23
 As a security administrator, one can be sure that sensitive data is safe in

case the storage media or data file gets stolen.
 You do not need to create triggers or views to decrypt data. Data from
tables is decrypted for the database user.
 Database users need not be aware of the fact that the data they are
accessing is stored in encrypted form. Data is transparently decrypted for
the database users and does not require any action on their part.
 Applications need not be modified to handle encrypted data. Data

encryption/decryption is managed by the database.
24
 Read authorization - allows reading, but not modification of data
 Insert authorization - allows insertion of new data, but not

modification of existing data.
 Update authorization - allows modification, but not

deletion of data.
 Delete authorization - allows deletion of data

25
select: allows read access to relation, or the ability to query using the view
insert: the ability to insert tuples
update: the ability to update using the SQL update statement
delete: the ability to delete tuples.

26
Example:
With grant option: grant select on
allows a user who is branch to U1 with
granted a privilege to grant option
gives U1 the select
pass the privilege on privileges on branch and
to other users. allows U1 to grant this
privilege to others

Database Security

Uploaded by

Copyright:

Available Formats

Database Security

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Database Security

Uploaded by

Copyright:

Available Formats

1

 Overview To Database Security.

It is being free from danger.

It is the mechanisms that protect the database against intentional or

Database Security is defined as the process by

Data will be easily

Three are 3 main

 Ensures that users are allowed to do the things they are

 Encryption is a technique or a process by which the data

 Ensures that what users are trying to do is correct.

 Database must have not unplanned downtime.

 To ensure this ,following steps should be taken

 Limit the number of concurrent sessions made available to each

Back up the data at periodic intervals to ensure data recovery in case of

There are two kinds of threat.

2. Protection from Inference

3. Integrity of the Database

7. Management and Protection of Sensitive Data

 Authorization - privileges, views.

 Encryption - public key / private key,

 Logical - firewalls, net proxies.

A FIREWALL is dedicated software on another computer which

Database Firewalls are a type of Web Application Firewalls that

 Data encryption enables to encrypt sensitive data, such as credit

 Encrypted data is decrypted for a database user who has

 Data encryption helps protect data stored on media in the event

 As a security administrator, one can be sure that sensitive data is safe in

 Applications need not be modified to handle encrypted data. Data

 Read authorization - allows reading, but not modification of data

 Insert authorization - allows insertion of new data, but not

 Update authorization - allows modification, but not

 Delete authorization - allows deletion of data

insert: the ability to insert tuples

update: the ability to update using the SQL update statement

delete: the ability to delete tuples.

You might also like