Database Security and

Auditing: Protecting Data

Integrity and Accessibility

Chapter 6(2)
Security Architecture
Introduction
 Security violations and attacks are
increasing globally at an annual average
rate of 20%.
 You serve as a database administrator to
enforce security policies. Responsibilities
can be:
◦ Design and implement a new DB security
policy.
◦ Enforce a stringent security policy.
◦ Implement functional specification of a module,
i.e. encrypt the stored data, replace sensitive
data using the data masking pack.

2
Introduction
 Security measures
◦ Prevent physical access to the servers where
the data resided.
◦ Operating systems require authentication of
the identity of computer users.
◦ Implement security models that enforce
security measures.
 DBA should manage databases and
implement security policies to protect
the data (assets).

3
Security
 Database security: degree to which data is
fully protected from tampering or
unauthorized acts
 Comprises information system and

information security concepts

6
Information Systems
 Wise decisions require:
◦ Accurate and timely information
◦ Information integrity
 Information system: comprised of
components working together to produce
and generate accurate information
 Categorized based on usage: low-level,

mid-level and high-level

7
Information Systems
(continued)

8
Information Systems
(continued)

9
Information Systems (continued)

10
Information Systems
(continued)
 Information system components include:
◦ Data
◦ Procedures
◦ Hardware
◦ Software
◦ Network
◦ People

11
Information Systems (continued)

12
Information Systems
(continued)
 Client/server architecture:
◦ Based on the business model
◦ Can be implemented as one-tier; two-tier; n-tier
◦ Composed of three layers
 Tier: physical or logical platform
 Database management system (DBMS):

collection of programs that manage

database

13
Information Systems
(continued)

14
Database Management
 Essential to success of information system
 DBMS functionalities:
◦ Organize data
◦ Store and retrieve data efficiently
◦ Manipulate data (update and delete)
◦ Enforce referential integrity and consistency
◦ Enforce and implement data security policies and
procedures
◦ Back up, recover, and restore data

15
Database Management
(continued)
 DBMS components include:
◦ Data
◦ Hardware
◦ Software
◦ Networks
◦ Procedures
◦ Database servers

16
Database Management
(continued)

17
Information Security
 Information is one of an organization’s most
valuable assets
 Information security: consists of

procedures and measures taken to protect

information systems components
 C.I.A. triangle: confidentiality, integrity,

availability
 Security policies must be balanced

according to the C.I.A. triangle

18
Information Security (continued)

19
Confidentiality
 Addresses two aspects of security:
◦ Prevention of unauthorized access
◦ Information disclosure based on classification
 Classify company information into levels:
◦ Each level has its own security measures
◦ Usually based on degree of confidentiality
necessary to protect information

20
 Confidentiality (continued)
In confidence a
classification that
identifies
information that, if
disclosed, may
result in damage to
a party’s
commercial
interests,
intellectual property
or trade secrets.

21
Integrity
 Consistent and valid data, processed
correctly, yields accurate information
 Information has integrity if:

◦ It is accurate
◦ It has not been tampered with
 Read consistency: each user sees only his
changes and those committed by other
users

22
Integrity -- Example
 Employee A learns that his adversarial
coworker is earning higher salary than he is.
 A accesses an application program by
accounting dept and manipulates the
vacation hours and overtime hours of his
colleague.
 Two security violations:
◦ Confidential data is disclosed
inappropriately
◦ An application to modify data was accessed
inappropriately.
 There should be a control to cross-check
overtime hours against actual time cards,
computed vacation hours, and verified
entered values. If they are different, the app
requires override from another person (data 23
24
Integrity (continued)

25
Integrity (continued)

26
Availability

 Systems must be always available to

authorized users
 Systems determines what a user can do

with the information

27
Availability (continued)
 Reasonsfor a system to become
unavailable:
◦ External attacks and lack of system
protection
◦ System failure with no disaster recovery
strategy
◦ Overly stringent and obscure security
policies
◦ Bad implementation of authentication
processes
28
Information Security
Architecture
 Protects data and information
produced from the data
 Model for protecting logical and

physical assets
 Is the overall design of a company’s

implementation of C.I.A. triangle

29
Information Security
Architecture (continued)

30
Information Security Architecture
(continued)
 Components include:
◦ Policies and procedures
◦ Security personnel and administrators
◦ Detection equipments
◦ Security programs
◦ Monitoring equipment
◦ Monitoring applications
◦ Auditing procedures and tools

31
Database Security

 Enforce security at all database levels

 Security access point: place where

database security must be protected and

applied
 Data requires highest level of protection;

data access point must be small

32
Database Security
(continued)

33
Database Security
(continued)
 Reducing access point size reduces
security risks
 Security gaps: points at which security is

missing
 Vulnerabilities: kinks in the system that can

become threats
 Threat: security risk that can become a

system breach

34
Database Security
(continued)

35
Database Security
(continued)
 People: individuals who have been granted
privileges and permissions to access applications,
networks, servers, databases, data files and data.
 Applications: application design and
implementation, which includes privileges and
permissions granted to people. Be cautious
because too loose permission results in violation
of data access, and too strict permission
compromises availability.
 Network is the most sensitive security access
point. Use best effort to protect the network.

36
Database Security
(continued)
 Operating system: the authentication to
the system and the gateway to the data.
 DBMS: logical structure of the database,

include memory, executables, and other

binaries.
 Data files: to be protected through the use

of permissions and encryption.

 Data: need to enforce data integrity, and

necessary privileges.

37
Database Security
(continued)

38
Database Security Levels
 Relational database: collection of related
data files
 Data file: collection of related tables
 Table: collection of related rows (records)
 Row: collection of related columns (fields)

39
 Database Security Levels
(continued)
By database management
system through user
accounts and password

Through file
permission

Schema owners/security
administrator grant or
revoke privileges

40
Menaces/Dangers to
Databases
 Security vulnerability: a weakness in any
information system component

41
Menaces to Databases
(continued)
 Security threat: a security violation or
attack that can happen any time because of
a security vulnerability.

42
Menaces to Databases
(continued)
 Security risk: a known security gap left
open.

43
Menaces to Databases
(continued)

44
Asset Types and Their
Value
 Security measures are based on the value of
each asset
 Types of assets include:
◦ Physical: tangible assets including buildings, cars,
hardware, …
◦ Logical: such as business applications, in-house
programs, purchased software, databases, …
◦ Intangible: business reputation, public confidence, …
◦ Human: human skills, knowledge, expertise, …

45
Security Methods

46
Security Methods

47
Security Methods
(continued)

48
Database Security Methodology

49
Summary
 Security: level and degree of being free
from danger and threats
 Database security: degree to which data is

fully protected from unauthorized tampering

 Information systems: backbone of day-to-

day company operations

50
Summary (continued)
 DBMS: programs to manage a database
 C.I.A triangle:
◦ Confidentiality
◦ Integrity
◦ Availability
 Secure access points
 Security vulnerabilities, threats and risks
 Information security architecture

◦ Model for protecting logical and physical assets

◦ Company’s implementation of a C.I.A. triangle
 Enforce security at all levels of the database

51
Databases
 Oracle 11g database:
◦ Oracle Database Software Downloads is available at:
http://www.oracle.com/technology/software/products/databa
se/index.html

◦ Oracle installation guide is available at:

http://www.oracle.com/webfolder/technetwork/tutorials/obe/
db/11g/r2/2day_dba/index.html
◦ Tutorial of Installing Oracle Database 11g on Windows
is available at:
http://st-curriculum.oracle.com/obe/db/11g/r2/2day_dba/instal
l/install.htm

52
Quick Quiz (5 minutes)
 Data is processed or transformed by a collection of
components working together to produce and generate
accurate information. These components are known as a(n)
_____________.
◦ information system
◦ database
◦ DBA
◦ operating system
 The concept behind a(n) __________________ application is
based on the business model of a customer ordering a
service or product and the representative of a business
granting that request.
◦ information system
◦ C.I.A. triangle
◦ DBMS
◦ client/server
 _____________________________ is a model for protecting
logical and physical assets.

53
Quick

Quiz (5 minutes)
A ____________________ is a place where database security must
be protected and applied.
◦ Security gap
◦ Security access point
◦ Security threat
◦ Security vulnerability
 A ____________________ is a security violation or attack that can
happen any time because of a security vulnerability.
◦ Security risk
◦ Security privilege
◦ Security policy
◦ Security threat
 _____________________________ is a collection of security policies
and procedures, data constraints, security methods, and
security tools blended together to implement all necessary
measures to secure the integrity, accessibility, and
confidentiality of every component of the database
environment.

54
Hands-on Projects (10 minutes)
You are a security officer working for a medium-
sized research company. You have been
assigned to guard a back entrance checkpoint.
One day, a well-known manager walks out with
a box of papers. A day after you are summoned
to the security office by your manager and the
security director for questioning about the
manager who had been terminated the day
before. The manager had walked out with
highly confidential information.
1. Outline briefly what types of security measures
were violated and how to avoid those violations.
2. Describe how this incident may result in security
violations.

55
Hands-on Projects (10 minutes)
You are an employee of a company responsible for
the administration of ten production databases.
Lately, you have noticed that your manager is
asking you frequent questions about the data
used by one of the top researchers of the
Engineering department. For two days, while
conducting routine database tasks, you notice
your manager exporting data from the database
the top researchers are using.
1. What type of security threat is the exportation of
data? How can your prevent it?
2. To what type of security risk could exporting
data lead?
3. Explain briefly how you would react to this
incident.

56
Preparation lab: Install Oracle database
Project 1: Exercise SQL in Oracle Database
 Create the database schema (you can use
the script from the textbook), refer to
Figure 4-20 for details.
 Fill in the data (you can use the script from
the textbook)
 Use SQL commands to manipulate the
data, such as query, insert and delete.

 Submit a written report including above

activities.

57