Authorization – The granting of a right or privilege that enables a subject to have legitimate access to a system or a system’s objects.
Authentication – A mechanism that determines whether a user is who he/she claims to be.
Views View - A view is the dynamic result of one or more relational operations operating on the base relations to produce another relation. A view is a virtual relation that does not actually exist in the database, but is produced upon request by a particular user, at the time of request. The view mechanism provides a powerful and flexible security mechanism by hiding parts of the database from certain users.
Backup and Recovery Backup - The process of periodically taking a copy of the database and log file on to offline storage media. Journaling - The process of keeping and maintaining a log file (or journal) of all changes made to the database to enable recovery to be undertaken effectively in the event of a failure.
Encryption Encryption - The encoding of the data by a special algorithm that renders the data unreadable by any program without the decryption key. Symmetric encryption - DES, IDEA, RC4, BlowFish, AES. Asymmetric encryption - RSA, Diffie-Helman. Plain-data Algorithm and password Encrypted data
RAID - Redundant Array of Independent Disks
RAID is a category of disk drives that employ two or more drives in combination for fault tolerance and performance. RAID disk drives are used frequently on servers running the databases.
Level 0: Provides data striping (spreading out blocks of each file across multiple disks) but no redundancy. This improves performance but does not deliver fault tolerance.
Level 1: Provides disk mirroring.
Level 3: Same as Level 0, but also reserves one dedicated disk for error correction data. It provides good performance and some level of fault tolerance.
Level 5: Provides data striping at the byte level and also stripe error correction information. This results in excellent performance and good fault tolerance.
Microsoft Access and Oracle DBMS Microsoft Access: System level security - password. User-level security - identification as a member of groups (Administrators and Users), permissions are granted (Open/Run, Read, Update, Delete, etc). Oracle DBMS: System level security - name, password. User-level security is based on a privilege, i.e a right to execute a particular type of SQL statements or to access another user’s object. System privileges and object privileges.
DBMSs and Web Security
Message Digest Algorithms and Digital Signature
SSL and S-HTTP
Proxy servers Proxy servers is a computer that sits between a Web browser and a Web servers. It intercepts all requests for web pages and saves them locally for some time. Proxy server provides improvement in performance and filters requests. Computer A Computer B Proxy-server Internet
Firewall - is a system that prevents unauthorized access to or from private network. Implemented in software, hardware or both.
Circuit-level gateway (TCP, UDP protocols)
Message Digest Algorithms and Digital Signatures Message digest algorithm is the one-way hash function that produces a fixed-length string (hash) from an arbitrary-sized message. It’s computationally infeasible that there is another message with the same digest, the digest does not reveal anything about the message. Digital signature consist of two parts: a string of bits that is computed from the message and the private key of organization. Digital signature is used to verify that the message comes from this organization.
Digital Certificates Digital Certificate is an attachment to an electronic message used for security purposes, most commonly to verify that a user sending a message is who he/she claims to be, and provide the receiver with the means to encrypt a reply. Protocol - X.509. Digital Certificate Authorities - VeriSign, Thwate.
Secure Sockets Layer and Secure HTTP
SSL creates a secure connection between a client and a server, over which any amount of data can be sent securely. S-HTTP is designed to transmit individual messages securely. Both use asymmetric encryption.
Allow Web browsers and servers to authenticate each other
Permit Web site owners to control access to particular servers, directories, files
Allow sharing of sensitive information (credit card numbers) only between browser and server
Ensure that data exchange between browser and server is reliable