DATABASE SECURITY
RAVINDRANATH KANAUJIA
AMIT TUKSHETTI
VIKAS GUPTA
&
DEEPAK PRAKASH
Index
• Introduction
• Objectives of Database Security
• Types of Database Security Issues
• Threats to Database
• Countermeasure to Threats
• Database Security and DBA
Introduction
• Importance of data
– Details of Bank a/c, Credit Card, Salary, Income-Tax,
University admissions, Marks/Grades, Land records,
Licenses, etc.
– Considered as corporate assets.
– Some of the recent headlines
• Personal information of millions of credit card users stolen.
• Hackers created fake web-sites to phish for credit card
information.
• Criminal gangs get into identity theft.
Introduction Contd.
Corporations must consider ways to manage the
data in order to
– Protect the intrinsic (genuine) value of data.
– Ensure privacy of the data.
– Provide control access to data.
Objectives of Database Security
• Three main objectives of designing a secure
database application:
– Secrecy (Information shouldn’t be disclose to
unauthorized user)
– Integrity (Only authorize user should be allowed
to modify data)
– Availability (Authorized users shouldn’t be denied
access)
Types of Database Security Issues
Database security addresses many issues, some of
which are:
Legal and Ethical Issues
Policy Issues
System Related Issues
Organization Based Issues (Need to Identify Multiple
Security Level)
Threats to Database
Threats may be defined as any situation or event,
whether intentional or accidental, that may adversely
affect a system and consequently the organization.
• Loss of Integrity
• Loss of Availability
• Loss of Confidentiality
• Loss of Privacy
• Theft and Fraud
• Accidental Losses
Countermeasure for Threats
To protect database from the previous said
threats four type of countermeasure can be
implemented
• Access Control (Discretionary and Mandatory Access)
• Inference Control
• Flow Control
• Encryption
Access Control
• The security mechanism of a DBMS must
include provisions for restricting access to the
database as a whole
– This function is called access control and is
handled by creating user accounts and passwords
to control login process by the DBMS.
Inference Control
• The security problem associated with
databases is that of controlling the access to a
statistical database, which is used to provide
statistical information or summaries of values
based on various criteria.
– The countermeasures to statistical database
security problem is called inference control
measures.
Flow Control
• Another security is that of flow control, which
prevents information from flowing in such a
way that it reaches unauthorized users.
– Channels that are pathways for information to
flow implicitly in ways that violate the security
policy of an organization are called covert
channels.
Encryption
• A final security issue is data encryption, which
is used to protect sensitive data (such as
credit card numbers) that is being transmitted
via some type communication network.
• The data is encoded using some encoding
algorithm.
– An unauthorized user who access encoded data
will have difficulty deciphering it, but authorized
users are given decoding or decrypting algorithms
(or keys) to decipher data.
Database Security and the DBA
• The database administrator (DBA) is the
central authority for managing a database
system.
– The DBA’s responsibilities include
• granting privileges to users who need to use the system
• classifying users and data in accordance with the policy
of the organization
• The DBA is responsible for the overall security
of the database system.
• The DBA has a DBA account in the DBMS
– Sometimes these are called a system or superuser
account
– These accounts provide powerful capabilities such
as:
1. Account creation
2. Privilege granting
3. Privilege revocation
4. Security level assignment
