Ferdous Pathan, profile picture
Uploaded byFerdous Pathan
PDF, PPTX4,183 views

Database Security

The document discusses database security. It covers main aspects of database security including integrity, confidentiality, and availability. It also discusses access control methods like discretionary access control and mandatory access control. The document lists various threats to database security from hardware, software, networks, users, and programmers/operators. These threats include things like fires, unauthorized data access, data theft, and inadequate security policies.

Embed presentation

Download as PDF, PPTX
Database Security Ghezal Ahmad Zia Information Systems Department Faculty of Computer Science Kabul University ghezalahmadzia@yahoo.com May 16, 2014 Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 1 / 42
Contents I 1 Introduction 2 Main Aspect of Database Security Integrity Confidentiality Availability 3 Access Control Discretionary Access Control Mandatory Access Control 4 Conclusion 5 References Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 2 / 42
How to think about Insecurity? Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 3 / 42
How to think about Insecurity? People are part of the problem... Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 3 / 42
How to think about Insecurity? People are part of the problem... Bad guys don’t follow rules Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 3 / 42
How to think about Insecurity? People are part of the problem... Bad guys don’t follow rules Need to understand what sort of attack possible to compromise a system Prerequisite to understand what to protect in a system! Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 3 / 42
Causes of Software Security Incidents Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 4 / 42
Causes of Software Security Incidents Buggy software and wrong configurations Unsafe program languages Complex programs Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 4 / 42
Causes of Software Security Incidents Buggy software and wrong configurations Unsafe program languages Complex programs Lack of awareness and education Few courses in computer security Programming text books do not emphasize security Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 4 / 42
Causes of Software Security Incidents Buggy software and wrong configurations Unsafe program languages Complex programs Lack of awareness and education Few courses in computer security Programming text books do not emphasize security Poor usability Security sometimes makes things harder to use Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 4 / 42
Causes of Software Security Incidents Buggy software and wrong configurations Unsafe program languages Complex programs Lack of awareness and education Few courses in computer security Programming text books do not emphasize security Poor usability Security sometimes makes things harder to use Economic factors Consumers do not care about security Security is difficult, expensive and takes time Few security audits Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 4 / 42
Causes of Software Security Incidents Buggy software and wrong configurations Unsafe program languages Complex programs Lack of awareness and education Few courses in computer security Programming text books do not emphasize security Poor usability Security sometimes makes things harder to use Economic factors Consumers do not care about security Security is difficult, expensive and takes time Few security audits Human Factor Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 4 / 42
Human Factor Who are the attackers? Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 5 / 42
Human Factor Who are the attackers? Why do the attack systems? Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 5 / 42
What is Database security? Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 6 / 42
What is Database security? Database It is a collection of information stored in a computer Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 6 / 42
What is Database security? Database It is a collection of information stored in a computer Security It is being free from danger Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 6 / 42
What is Database security? Database It is a collection of information stored in a computer Security It is being free from danger Database Security It is the mechanisms that protect the database against intentional or accidental threats. OR Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 6 / 42
What is Database security? Database It is a collection of information stored in a computer Security It is being free from danger Database Security It is the mechanisms that protect the database against intentional or accidental threats. OR Protection from malicious attempts to steal (view) or modify data. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 6 / 42
What is Threats? Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 7 / 42
What is Threats? Threats - Any situation or event, whether intensional or accidental, that may adversely affect a system and consequently the organization. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 7 / 42
What is Threats? Threats - Any situation or event, whether intensional or accidental, that may adversely affect a system and consequently the organization. Computer Systems Databases Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 7 / 42
Threats Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 8 / 42
Threats Hardware Fire/Flood/bombs Data corruption due to power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 9 / 42
Threats Hardware Fire/Flood/bombs Data corruption due to power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 10 / 42
Threats Hardware Fire/Flood/bombs Data corruption due to power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Communication Networks Wire tapping Breaking or disconnection of cables Electronic interference and radiation Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 11 / 42
Threats Hardware Fire/Flood/bombs Data corruption due to power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Communication Networks Wire tapping Breaking or disconnection of cables Electronic interference and radiation Database Unauthorized amendment or copying of data Theft of data Data corruption due to power loss or surge Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 12 / 42
Threats Hardware Fire/Flood/bombs Data corruption due to power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Communication Networks Wire tapping Breaking or disconnection of cables Electronic interference and radiation Database Unauthorized amendment or copying of data Theft of data Data corruption due to power loss or surge Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 13 / 42
Threats Hardware Fire/Flood/bombs Data corruption due to power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Communication Networks Wire tapping Breaking or disconnection of cables Electronic interference and radiation Database Unauthorized amendment or copying of data Theft of data Data corruption due to power loss or surge User o  Using another person’s means of access o  Viewing and disclosing unauthorized data o  Inadequate staff training o  Illegal entry by hacker o  Blackmail o  Introduction of viruses Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 14 / 42
Threats Hardware Fire/Flood/bombs Data corruption due to power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Communication Networks Wire tapping Breaking or disconnection of cables Electronic interference and radiation Database Unauthorized amendment or copying of data Theft of data Data corruption due to power loss or surge Programmers/ Operators o  Creating trapdoors o  Program alteration (such as creating software that is insecure) o  Inadequate staff training o  Inadequate security policies and procedure User o  Using another person’s means of access o  Viewing and disclosing unauthorized data o  Inadequate staff training o  Illegal entry by hacker o  Blackmail o  Introduction of viruses Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 15 / 42
Threats Hardware Fire/Flood/bombs Data corruption due to power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Communication Networks Wire tapping Breaking or disconnection of cables Electronic interference and radiation Database Unauthorized amendment or copying of data Theft of data Data corruption due to power loss or surge Programmers/ Operators o  Creating trapdoors o  Program alteration (such as creating software that is insecure) o  Inadequate staff training o  Inadequate security policies and procedure User o  Using another person’s means of access o  Viewing and disclosing unauthorized data o  Inadequate staff training o  Illegal entry by hacker o  Blackmail o  Introduction of viruses Data/Database Administrator o  Inadequate security o  Policies and procedures Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 16 / 42
Definition of Database security Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 17 / 42
Definition of Database security Database Security is defined as the process by which ”Confidentiality, Integrity, and Availability”of the database can be protected Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 17 / 42
Definition of Database security Database Security is defined as the process by which ”Confidentiality, Integrity, and Availability”of the database can be protected Countermeasures authorization access control views backup and recovery encryption RAID technology Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 17 / 42
Database security Concepts Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 18 / 42
Database security Concepts Three Main Aspects Confidentiality Integrity Availability Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 18 / 42
Database security Concepts Three Main Aspects Confidentiality Integrity Availability Threats to databases: Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 18 / 42
Database security Concepts Three Main Aspects Confidentiality Integrity Availability Threats to databases: Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 18 / 42
Database security Concepts Three Main Aspects Confidentiality Integrity Availability Threats to databases: Loss of Integrity Loss of Availability Loss of Confidentiality Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 18 / 42
Confidentiality Confidentiality No one can read our data / communication unless we want them to Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 19 / 42
Confidentiality Confidentiality No one can read our data / communication unless we want them to It is protecting the database from unauthorized users. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 19 / 42
Confidentiality Confidentiality No one can read our data / communication unless we want them to It is protecting the database from unauthorized users. Ensures that users are allowed to do the things they are trying to do. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 19 / 42
Confidentiality Confidentiality No one can read our data / communication unless we want them to It is protecting the database from unauthorized users. Ensures that users are allowed to do the things they are trying to do. For example: The employees should not see the salaries of their managers. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 19 / 42
Confidentiality Confidentiality involves: privacy: protection of private data, secrecy: protection of organisational data Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 20 / 42
Integrity Integrity No one can manipulate our data / processing / communication unless we want them to Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 21 / 42
Integrity Integrity No one can manipulate our data / processing / communication unless we want them to Protecting the database from authorized users. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 21 / 42
Integrity Integrity No one can manipulate our data / processing / communication unless we want them to Protecting the database from authorized users. Ensures that what users are trying to do is correct For example: An employee should be able to modify his or her own information. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 21 / 42
Integrity ”Making sure that everything is as it is supposed to be.” Preventing unauthorized writing or modifications Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 22 / 42
Availability Availability We can access our data / conduct our processing / use our communication capabilities when we want to Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 23 / 42
Availability Availability We can access our data / conduct our processing / use our communication capabilities when we want to Authorized users should be able to access data for Legal Purposes as necessary Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 23 / 42
Availability Availability We can access our data / conduct our processing / use our communication capabilities when we want to Authorized users should be able to access data for Legal Purposes as necessary For example: Payment orders regarding taxes should be made on time by the tax law. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 23 / 42
Availability Services are accessible and useable (without delay) whenever needed by an authorized entity. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 24 / 42
Relationship between Confidentiality Integrity and Availability Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 25 / 42
Relationship between Confidentiality Integrity and Availability Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 26 / 42
Thanks for your attention! Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 27 / 42
Integrity How is data integrity preserved? Through Data integrity Constraints Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 28 / 42
Integrity How is data integrity preserved? Through Data integrity Constraints Constraints restrict data values that can be inserted or updated Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 28 / 42
Column CHECK constraints Example Validity Checking Example CREATE TABLE test (rollno number(2) check (rollno between 1 and 50), name varchar2(15)); Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 29 / 42
Column CHECK constraints Example Validity Checking Example CREATE TABLE test (rollno number(2) check (rollno between 1 and 50), name varchar2(15)); Validity Checking Example INSERT INTO test values(45, ’ Willy’ ); Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 29 / 42
Column CHECK constraints Example Validity Checking Example CREATE TABLE test (rollno number(2) check (rollno between 1 and 50), name varchar2(15)); Validity Checking Example INSERT INTO test values(45, ’ Willy’ ); 1 row inserted Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 29 / 42
Column CHECK constraints Example Validity Checking Example CREATE TABLE test (rollno number(2) check (rollno between 1 and 50), name varchar2(15)); Validity Checking Example INSERT INTO test values(45, ’ Willy’ ); 1 row inserted Validity Checking Example INSERT INTO test values(55, ’ Hiess’ ); Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 29 / 42
Column CHECK constraints Example Validity Checking Example CREATE TABLE test (rollno number(2) check (rollno between 1 and 50), name varchar2(15)); Validity Checking Example INSERT INTO test values(45, ’ Willy’ ); 1 row inserted Validity Checking Example INSERT INTO test values(55, ’ Hiess’ ); ERROR-Check constraints violated Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 29 / 42
Referential Integrity Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 30 / 42
Confidentiality Example: How to ensure data confidentiality? Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 31 / 42
Confidentiality Example: How to ensure data confidentiality? Cryptography Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 31 / 42
Confidentiality Example: How to ensure data confidentiality? Cryptography Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 31 / 42
Confidentiality Example: How to ensure data confidentiality? Cryptography Strong Access Control Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 31 / 42
Confidentiality Example: How to ensure data confidentiality? Cryptography Strong Access Control Limiting number of places where data can appear Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 31 / 42
Access Control Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 32 / 42
Access Control An identity permits access to resources In computer security this is called Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 32 / 42
Access Control An identity permits access to resources In computer security this is called Access Control Authorization We talk about: Subjects (for whom an action is performed) Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 32 / 42
Access Control An identity permits access to resources In computer security this is called Access Control Authorization We talk about: Subjects (for whom an action is performed) Objects (upon what an action is performed) Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 32 / 42
Access Control An identity permits access to resources In computer security this is called Access Control Authorization We talk about: Subjects (for whom an action is performed) Objects (upon what an action is performed) Operations (the type of action performed) Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 32 / 42
Access Control Models A DBMS provides access control mechanisms to help implement a security policy. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 33 / 42
Access Control Models A DBMS provides access control mechanisms to help implement a security policy. Two complementary types of mechanism: Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 33 / 42
Access Control Models A DBMS provides access control mechanisms to help implement a security policy. Two complementary types of mechanism: 1 Discretionary access control (DAC) Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 33 / 42
Access Control Models A DBMS provides access control mechanisms to help implement a security policy. Two complementary types of mechanism: 1 Discretionary access control (DAC) 2 Mandatory access control (MAC) Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 33 / 42
Discretionary Access Control Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
Discretionary Access Control Idea Achieve security based on the concept of access rights: 1 privileges for objects Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
Discretionary Access Control Idea Achieve security based on the concept of access rights: 1 privileges for objects (certain access rights for tables, columns, etc.), and Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
Discretionary Access Control Idea Achieve security based on the concept of access rights: 1 privileges for objects (certain access rights for tables, columns, etc.), and 2 a mechanism for giving users privileges (and revoking privileges) Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
Discretionary Access Control Idea Achieve security based on the concept of access rights: 1 privileges for objects (certain access rights for tables, columns, etc.), and 2 a mechanism for giving users privileges (and revoking privileges) Users are given privileges to access the appropriate schema objects (tables, views). Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
Discretionary Access Control Idea Achieve security based on the concept of access rights: 1 privileges for objects (certain access rights for tables, columns, etc.), and 2 a mechanism for giving users privileges (and revoking privileges) Users are given privileges to access the appropriate schema objects (tables, views). Users can grant privileges to other users at their own discretion. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
Discretionary Access Control Idea Achieve security based on the concept of access rights: 1 privileges for objects (certain access rights for tables, columns, etc.), and 2 a mechanism for giving users privileges (and revoking privileges) Users are given privileges to access the appropriate schema objects (tables, views). Users can grant privileges to other users at their own discretion. Implementation: GRANT and REVOKE commands Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
Granting/Revoking Privileges GRANT SELECT ON database.* TO user@’localhost’; Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 35 / 42
Granting/Revoking Privileges GRANT SELECT ON database.* TO user@’localhost’; GRANT SELECT ON database.* TO user@’localhost’ IDENTIFIED BY ’password’; Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 35 / 42
DBMSs and Web Security Countermeasures Proxy servers Firewalls Secure Socket Layer or SSL Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 36 / 42
DBMSs and Web Security Countermeasures Proxy servers Firewalls Secure Socket Layer or SSL Which is used extensively to secure e-commerce on the Internet today. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 36 / 42
Proxy Servers Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 37 / 42
Proxy Servers Definition Proxy servers is a computer that sits between a Web browser and a Web servers. It intercepts all requests for web pages and saves them locally for some times. Proxy server provides improvement in performance and filters requests. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 37 / 42
Proxy Servers Definition Proxy servers is a computer that sits between a Web browser and a Web servers. It intercepts all requests for web pages and saves them locally for some times. Proxy server provides improvement in performance and filters requests. Computer A Computer B Proxy-server Internet Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 37 / 42
Firewalls Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 38 / 42
Firewalls Firewalls Is a system that prevents unauthorized access to or from private network. Implemented in software, hardware or both. Packet filter Application gateway Proxy server Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 38 / 42
Conclusion Data security is critical. Requires security at different levels. Several technical solutions . But human training is essential. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 39 / 42
References Mark Stamp INFORMATION SECURITY PRINCIPLES AND PRACTICE Mark Stamp Database Systems Security , Chapter 19, 541 Michael Gertz Handbook of Database Security Applications and Trends Dorothy Elizabeth Robling Denning Cryptography and Data Security Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 40 / 42
Thanks for your attention! Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 41 / 42

More Related Content

PPTX
Database security
byMaryamAsghar9
 
PPTX
Database security
byafzaalkhalid1
 
PPTX
Database Security Management
byAhsin Yousaf
 
PPTX
Database Security And Authentication
bySudeb Das
 
PDF
Database security
byMurchana Borah
 
PPT
DB security
byERSHUBHAM TIWARI
 
PPTX
Database Security
byShingalaKrupa
 
PPTX
Database security
byArpana shree
 
Database security
byMaryamAsghar9
 
Database security
byafzaalkhalid1
 
Database Security Management
byAhsin Yousaf
 
Database Security And Authentication
bySudeb Das
 
Database security
byMurchana Borah
 
DB security
byERSHUBHAM TIWARI
 
Database Security
byShingalaKrupa
 
Database security
byArpana shree
 

What's hot

PDF
Data security and Integrity
byZaid Shabbir
 
PPTX
Database security
bySoftware Engineering
 
PDF
Chapter 5 database security
bySyaiful Ahdan
 
PPT
Database security
byCAS
 
PDF
Database security
bykeerthusandeepreddy
 
PPTX
Security and Integrity of Data
byAdeel Riaz
 
PPTX
Database security
byBirju Tank
 
PPTX
DBMS SECURITY
byWasim Raza
 
PPTX
Database security and security in networks
byPrachi Gulihar
 
PDF
Best Practices for implementing Database Security Comprehensive Database Secu...
byKal BO
 
PPTX
Data base security & integrity
byPooja Dixit
 
PPTX
Security of the database
byPratik Tamgadge
 
DOCX
Database Security Concepts | Introduction to Database Security
byRaj vardhan
 
PPT
Database Security
byalraee
 
PPTX
security and privacy in dbms and in sql database
bygourav kottawar
 
PPT
Database security
byPrabhat gangwar
 
PPTX
01 database security ent-db
byuncleRhyme
 
PPTX
Database security
byZubair Rahim
 
PPT
Database Security
byRabiaIftikhar10
 
PPTX
System security
byReachLocal Services India
 
Data security and Integrity
byZaid Shabbir
 
Database security
bySoftware Engineering
 
Chapter 5 database security
bySyaiful Ahdan
 
Database security
byCAS
 
Database security
bykeerthusandeepreddy
 
Security and Integrity of Data
byAdeel Riaz
 
Database security
byBirju Tank
 
DBMS SECURITY
byWasim Raza
 
Database security and security in networks
byPrachi Gulihar
 
Best Practices for implementing Database Security Comprehensive Database Secu...
byKal BO
 
Data base security & integrity
byPooja Dixit
 
Security of the database
byPratik Tamgadge
 
Database Security Concepts | Introduction to Database Security
byRaj vardhan
 
Database Security
byalraee
 
security and privacy in dbms and in sql database
bygourav kottawar
 
Database security
byPrabhat gangwar
 
01 database security ent-db
byuncleRhyme
 
Database security
byZubair Rahim
 
Database Security
byRabiaIftikhar10
 
System security
byReachLocal Services India
 

Viewers also liked

PDF
Database security issues
byn|u - The Open Security Community
 
PPT
Database Systems Security
byamiable_indian
 
PPTX
Data Security - English
byData Security
 
PPTX
database recovery techniques
byKalhan Liyanage
 
PPTX
Data Privacy and Protection Presentation
bymlw32785
 
PDF
Ppt security-database-overview-11g r2
byOracle BH
 
PPTX
Information security group presentation ppt
byvaishalshah01
 
PPTX
SSL/TLS Eavesdropping with Fullpath Control
byMike Thompson
 
PPTX
141118 Thales contributions and benefits
bySINTAS
 
PPT
Introduction to Hacking
byRishabha Garg
 
PPTX
Data base testing
byBugRaptors
 
PPTX
Database modeling and security
byNeeharika Nidadavolu
 
PDF
Testing the technology
byHamza Bhamla
 
PDF
Information Retrieval Models Part I
byIngo Frommholz
 
PPT
Leya 10.15
byguest3879e7
 
PPT
Information Security Lesson 6 - Web Security - Eric Vanderburg
byEric Vanderburg
 
PPTX
Mobile database security threats
byAkhil Kumar
 
PPT
Reading process
bySukhmohinder Nagpal
 
PPT
Data Protection Presentation
byIBM Business Insight
 
PPT
Reading Workshop
byenglishonecfl
 
Database security issues
byn|u - The Open Security Community
 
Database Systems Security
byamiable_indian
 
Data Security - English
byData Security
 
database recovery techniques
byKalhan Liyanage
 
Data Privacy and Protection Presentation
bymlw32785
 
Ppt security-database-overview-11g r2
byOracle BH
 
Information security group presentation ppt
byvaishalshah01
 
SSL/TLS Eavesdropping with Fullpath Control
byMike Thompson
 
141118 Thales contributions and benefits
bySINTAS
 
Introduction to Hacking
byRishabha Garg
 
Data base testing
byBugRaptors
 
Database modeling and security
byNeeharika Nidadavolu
 
Testing the technology
byHamza Bhamla
 
Information Retrieval Models Part I
byIngo Frommholz
 
Leya 10.15
byguest3879e7
 
Information Security Lesson 6 - Web Security - Eric Vanderburg
byEric Vanderburg
 
Mobile database security threats
byAkhil Kumar
 
Reading process
bySukhmohinder Nagpal
 
Data Protection Presentation
byIBM Business Insight
 
Reading Workshop
byenglishonecfl
 

Similar to Database Security

PDF
A Database System Security Framework
byMaria Perkins
 
PDF
A DATABASE SYSTEM SECURITY FRAMEWORK
byijcsit
 
PDF
Database security presentation in easy way
byArsalanMaqsood1
 
PDF
5db-security.pdf
byHODCA1
 
PPTX
203135 Muhammad Usama.pptx
bymuhammadusama257191
 
PPTX
Database Security, Threats & Countermeasures.pptx
bySaqibAhmedKhan4
 
PPTX
Database Security - IK
byIlgın Kavaklıoğulları
 
PPTX
Database security presentation for Vims.pptx
byvimbaimapfumo25
 
PDF
security in database management system.
byprajal
 
DOCX
Database security
byMehrdad Jingoism
 
PPTX
Database Security and Management Systems
byIsmaelKakaRealsoft
 
PPTX
basic to advance network security concepts
byamansinght675
 
PDF
Database security 12.pdf
byShajanShajan2
 
PPTX
Comparative Analysis of Windows and Linux System.pptx
byGreen University of Bangladesh
 
PPTX
Importance of DBMS.pptx
byGreen University of Bangladesh
 
PPT
Chap05
bysumit621
 
PPTX
Database security in database management.pptx
byFarhanaMariyam1
 
PDF
A1802030104
byIOSR Journals
 
PDF
databasesecurit-phpapp01.pdf
byAnSHiKa187943
 
PPTX
Database Security Presentation Why database Security is important
byKamruzzamansohel2
 
A Database System Security Framework
byMaria Perkins
 
A DATABASE SYSTEM SECURITY FRAMEWORK
byijcsit
 
Database security presentation in easy way
byArsalanMaqsood1
 
5db-security.pdf
byHODCA1
 
203135 Muhammad Usama.pptx
bymuhammadusama257191
 
Database Security, Threats & Countermeasures.pptx
bySaqibAhmedKhan4
 
Database Security - IK
byIlgın Kavaklıoğulları
 
Database security presentation for Vims.pptx
byvimbaimapfumo25
 
security in database management system.
byprajal
 
Database security
byMehrdad Jingoism
 
Database Security and Management Systems
byIsmaelKakaRealsoft
 
basic to advance network security concepts
byamansinght675
 
Database security 12.pdf
byShajanShajan2
 
Comparative Analysis of Windows and Linux System.pptx
byGreen University of Bangladesh
 
Importance of DBMS.pptx
byGreen University of Bangladesh
 
Chap05
bysumit621
 
Database security in database management.pptx
byFarhanaMariyam1
 
A1802030104
byIOSR Journals
 
databasesecurit-phpapp01.pdf
byAnSHiKa187943
 
Database Security Presentation Why database Security is important
byKamruzzamansohel2
 

Recently uploaded

PPTX
Ethics in AI - Artificial Intelligence Fundamentals.pptx
byemenyiblessing
 
PPTX
The Landscape of Computer Software Development Companies
byYash Singh
 
PPT
software-security-intro in information security.ppt
byismaeelsahib032
 
PDF
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
PDF
DIGITAL FORENSICS - Notes for Everything.pdf
bypankajkumavatbeit
 
PPTX
From Backup to Resilience: How MSPs Are Preparing for 2026
byMSP360
 
PPTX
Basics of Identity Access Management In mordern Infrastructure
byPrinceXavier18
 
PDF
Energy Storage Landscape Clean Energy Ministerial
bySurajitBanerjee38
 
DOCX
Introduction to the World of Computers (Hardware & Software)
byALIABBAS ABASOV
 
PDF
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
DOCX
Cloud Security, Serverless Security. Cybersecurity
byEdcelPacayraDuena
 
PDF
Unser Jahresrückblick – MarvelClient in 2025
bypanagenda
 
PDF
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
PDF
Session 1 - Solving Semi-Structured Documents with Document Understanding
byDianaGray10
 
PDF
MuleSoft Vibes is an AI-powered assistant
byVikalp Bhalia
 
PDF
Is It Possible to Have Wi-Fi Without an Internet Provider
bySidra Jefferi
 
PDF
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
PDF
Safeguarding AI-Based Financial Infrastructure
byYasir Naveed Riaz
 
PDF
Unlocking the Power of Salesforce Architecture: Frameworks for Effective Solu...
byvarsha30tiwari
 
PDF
Digit Expo 2025 - EICC Edinburgh 27th November
byRay Bugg
 
Ethics in AI - Artificial Intelligence Fundamentals.pptx
byemenyiblessing
 
The Landscape of Computer Software Development Companies
byYash Singh
 
software-security-intro in information security.ppt
byismaeelsahib032
 
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
DIGITAL FORENSICS - Notes for Everything.pdf
bypankajkumavatbeit
 
From Backup to Resilience: How MSPs Are Preparing for 2026
byMSP360
 
Basics of Identity Access Management In mordern Infrastructure
byPrinceXavier18
 
Energy Storage Landscape Clean Energy Ministerial
bySurajitBanerjee38
 
Introduction to the World of Computers (Hardware & Software)
byALIABBAS ABASOV
 
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
Cloud Security, Serverless Security. Cybersecurity
byEdcelPacayraDuena
 
Unser Jahresrückblick – MarvelClient in 2025
bypanagenda
 
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
Session 1 - Solving Semi-Structured Documents with Document Understanding
byDianaGray10
 
MuleSoft Vibes is an AI-powered assistant
byVikalp Bhalia
 
Is It Possible to Have Wi-Fi Without an Internet Provider
bySidra Jefferi
 
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
Safeguarding AI-Based Financial Infrastructure
byYasir Naveed Riaz
 
Unlocking the Power of Salesforce Architecture: Frameworks for Effective Solu...
byvarsha30tiwari
 
Digit Expo 2025 - EICC Edinburgh 27th November
byRay Bugg
 

Database Security

  • 1.
    Database Security Ghezal AhmadZia Information Systems Department Faculty of Computer Science Kabul University ghezalahmadzia@yahoo.com May 16, 2014 Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 1 / 42
  • 2.
    Contents I 1 Introduction 2Main Aspect of Database Security Integrity Confidentiality Availability 3 Access Control Discretionary Access Control Mandatory Access Control 4 Conclusion 5 References Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 2 / 42
  • 3.
    How to thinkabout Insecurity? Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 3 / 42
  • 4.
    How to thinkabout Insecurity? People are part of the problem... Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 3 / 42
  • 5.
    How to thinkabout Insecurity? People are part of the problem... Bad guys don’t follow rules Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 3 / 42
  • 6.
    How to thinkabout Insecurity? People are part of the problem... Bad guys don’t follow rules Need to understand what sort of attack possible to compromise a system Prerequisite to understand what to protect in a system! Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 3 / 42
  • 7.
    Causes of SoftwareSecurity Incidents Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 4 / 42
  • 8.
    Causes of SoftwareSecurity Incidents Buggy software and wrong configurations Unsafe program languages Complex programs Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 4 / 42
  • 9.
    Causes of SoftwareSecurity Incidents Buggy software and wrong configurations Unsafe program languages Complex programs Lack of awareness and education Few courses in computer security Programming text books do not emphasize security Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 4 / 42
  • 10.
    Causes of SoftwareSecurity Incidents Buggy software and wrong configurations Unsafe program languages Complex programs Lack of awareness and education Few courses in computer security Programming text books do not emphasize security Poor usability Security sometimes makes things harder to use Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 4 / 42
  • 11.
    Causes of SoftwareSecurity Incidents Buggy software and wrong configurations Unsafe program languages Complex programs Lack of awareness and education Few courses in computer security Programming text books do not emphasize security Poor usability Security sometimes makes things harder to use Economic factors Consumers do not care about security Security is difficult, expensive and takes time Few security audits Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 4 / 42
  • 12.
    Causes of SoftwareSecurity Incidents Buggy software and wrong configurations Unsafe program languages Complex programs Lack of awareness and education Few courses in computer security Programming text books do not emphasize security Poor usability Security sometimes makes things harder to use Economic factors Consumers do not care about security Security is difficult, expensive and takes time Few security audits Human Factor Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 4 / 42
  • 13.
    Human Factor Who arethe attackers? Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 5 / 42
  • 14.
    Human Factor Who arethe attackers? Why do the attack systems? Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 5 / 42
  • 15.
    What is Databasesecurity? Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 6 / 42
  • 16.
    What is Databasesecurity? Database It is a collection of information stored in a computer Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 6 / 42
  • 17.
    What is Databasesecurity? Database It is a collection of information stored in a computer Security It is being free from danger Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 6 / 42
  • 18.
    What is Databasesecurity? Database It is a collection of information stored in a computer Security It is being free from danger Database Security It is the mechanisms that protect the database against intentional or accidental threats. OR Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 6 / 42
  • 19.
    What is Databasesecurity? Database It is a collection of information stored in a computer Security It is being free from danger Database Security It is the mechanisms that protect the database against intentional or accidental threats. OR Protection from malicious attempts to steal (view) or modify data. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 6 / 42
  • 20.
    What is Threats? GhezalAhmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 7 / 42
  • 21.
    What is Threats? Threats- Any situation or event, whether intensional or accidental, that may adversely affect a system and consequently the organization. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 7 / 42
  • 22.
    What is Threats? Threats- Any situation or event, whether intensional or accidental, that may adversely affect a system and consequently the organization. Computer Systems Databases Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 7 / 42
  • 23.
    Threats Ghezal Ahmad Zia(@ISD-CSF-KU) Database Security May 16, 2014 8 / 42
  • 24.
    Threats Hardware Fire/Flood/bombs Data corruption dueto power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 9 / 42
  • 25.
    Threats Hardware Fire/Flood/bombs Data corruption dueto power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 10 / 42
  • 26.
    Threats Hardware Fire/Flood/bombs Data corruption dueto power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Communication Networks Wire tapping Breaking or disconnection of cables Electronic interference and radiation Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 11 / 42
  • 27.
    Threats Hardware Fire/Flood/bombs Data corruption dueto power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Communication Networks Wire tapping Breaking or disconnection of cables Electronic interference and radiation Database Unauthorized amendment or copying of data Theft of data Data corruption due to power loss or surge Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 12 / 42
  • 28.
    Threats Hardware Fire/Flood/bombs Data corruption dueto power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Communication Networks Wire tapping Breaking or disconnection of cables Electronic interference and radiation Database Unauthorized amendment or copying of data Theft of data Data corruption due to power loss or surge Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 13 / 42
  • 29.
    Threats Hardware Fire/Flood/bombs Data corruption dueto power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Communication Networks Wire tapping Breaking or disconnection of cables Electronic interference and radiation Database Unauthorized amendment or copying of data Theft of data Data corruption due to power loss or surge User o  Using another person’s means of access o  Viewing and disclosing unauthorized data o  Inadequate staff training o  Illegal entry by hacker o  Blackmail o  Introduction of viruses Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 14 / 42
  • 30.
    Threats Hardware Fire/Flood/bombs Data corruption dueto power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Communication Networks Wire tapping Breaking or disconnection of cables Electronic interference and radiation Database Unauthorized amendment or copying of data Theft of data Data corruption due to power loss or surge Programmers/ Operators o  Creating trapdoors o  Program alteration (such as creating software that is insecure) o  Inadequate staff training o  Inadequate security policies and procedure User o  Using another person’s means of access o  Viewing and disclosing unauthorized data o  Inadequate staff training o  Illegal entry by hacker o  Blackmail o  Introduction of viruses Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 15 / 42
  • 31.
    Threats Hardware Fire/Flood/bombs Data corruption dueto power loss or surge Failure of security mechanisms giving greater access Theft of equipment Physical damage of equipment DBMS and Application Software Failure of security mechanism giving greater access Program alteration Theft of programs Communication Networks Wire tapping Breaking or disconnection of cables Electronic interference and radiation Database Unauthorized amendment or copying of data Theft of data Data corruption due to power loss or surge Programmers/ Operators o  Creating trapdoors o  Program alteration (such as creating software that is insecure) o  Inadequate staff training o  Inadequate security policies and procedure User o  Using another person’s means of access o  Viewing and disclosing unauthorized data o  Inadequate staff training o  Illegal entry by hacker o  Blackmail o  Introduction of viruses Data/Database Administrator o  Inadequate security o  Policies and procedures Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 16 / 42
  • 32.
    Definition of Databasesecurity Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 17 / 42
  • 33.
    Definition of Databasesecurity Database Security is defined as the process by which ”Confidentiality, Integrity, and Availability”of the database can be protected Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 17 / 42
  • 34.
    Definition of Databasesecurity Database Security is defined as the process by which ”Confidentiality, Integrity, and Availability”of the database can be protected Countermeasures authorization access control views backup and recovery encryption RAID technology Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 17 / 42
  • 35.
    Database security Concepts GhezalAhmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 18 / 42
  • 36.
    Database security Concepts ThreeMain Aspects Confidentiality Integrity Availability Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 18 / 42
  • 37.
    Database security Concepts ThreeMain Aspects Confidentiality Integrity Availability Threats to databases: Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 18 / 42
  • 38.
    Database security Concepts ThreeMain Aspects Confidentiality Integrity Availability Threats to databases: Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 18 / 42
  • 39.
    Database security Concepts ThreeMain Aspects Confidentiality Integrity Availability Threats to databases: Loss of Integrity Loss of Availability Loss of Confidentiality Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 18 / 42
  • 40.
    Confidentiality Confidentiality No one canread our data / communication unless we want them to Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 19 / 42
  • 41.
    Confidentiality Confidentiality No one canread our data / communication unless we want them to It is protecting the database from unauthorized users. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 19 / 42
  • 42.
    Confidentiality Confidentiality No one canread our data / communication unless we want them to It is protecting the database from unauthorized users. Ensures that users are allowed to do the things they are trying to do. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 19 / 42
  • 43.
    Confidentiality Confidentiality No one canread our data / communication unless we want them to It is protecting the database from unauthorized users. Ensures that users are allowed to do the things they are trying to do. For example: The employees should not see the salaries of their managers. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 19 / 42
  • 44.
    Confidentiality Confidentiality involves: privacy: protectionof private data, secrecy: protection of organisational data Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 20 / 42
  • 45.
    Integrity Integrity No one canmanipulate our data / processing / communication unless we want them to Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 21 / 42
  • 46.
    Integrity Integrity No one canmanipulate our data / processing / communication unless we want them to Protecting the database from authorized users. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 21 / 42
  • 47.
    Integrity Integrity No one canmanipulate our data / processing / communication unless we want them to Protecting the database from authorized users. Ensures that what users are trying to do is correct For example: An employee should be able to modify his or her own information. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 21 / 42
  • 48.
    Integrity ”Making sure thateverything is as it is supposed to be.” Preventing unauthorized writing or modifications Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 22 / 42
  • 49.
    Availability Availability We can accessour data / conduct our processing / use our communication capabilities when we want to Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 23 / 42
  • 50.
    Availability Availability We can accessour data / conduct our processing / use our communication capabilities when we want to Authorized users should be able to access data for Legal Purposes as necessary Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 23 / 42
  • 51.
    Availability Availability We can accessour data / conduct our processing / use our communication capabilities when we want to Authorized users should be able to access data for Legal Purposes as necessary For example: Payment orders regarding taxes should be made on time by the tax law. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 23 / 42
  • 52.
    Availability Services are accessibleand useable (without delay) whenever needed by an authorized entity. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 24 / 42
  • 53.
    Relationship between ConfidentialityIntegrity and Availability Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 25 / 42
  • 54.
    Relationship between ConfidentialityIntegrity and Availability Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 26 / 42
  • 55.
    Thanks for yourattention! Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 27 / 42
  • 56.
    Integrity How is dataintegrity preserved? Through Data integrity Constraints Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 28 / 42
  • 57.
    Integrity How is dataintegrity preserved? Through Data integrity Constraints Constraints restrict data values that can be inserted or updated Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 28 / 42
  • 58.
    Column CHECK constraints Example ValidityChecking Example CREATE TABLE test (rollno number(2) check (rollno between 1 and 50), name varchar2(15)); Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 29 / 42
  • 59.
    Column CHECK constraints Example ValidityChecking Example CREATE TABLE test (rollno number(2) check (rollno between 1 and 50), name varchar2(15)); Validity Checking Example INSERT INTO test values(45, ’ Willy’ ); Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 29 / 42
  • 60.
    Column CHECK constraints Example ValidityChecking Example CREATE TABLE test (rollno number(2) check (rollno between 1 and 50), name varchar2(15)); Validity Checking Example INSERT INTO test values(45, ’ Willy’ ); 1 row inserted Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 29 / 42
  • 61.
    Column CHECK constraints Example ValidityChecking Example CREATE TABLE test (rollno number(2) check (rollno between 1 and 50), name varchar2(15)); Validity Checking Example INSERT INTO test values(45, ’ Willy’ ); 1 row inserted Validity Checking Example INSERT INTO test values(55, ’ Hiess’ ); Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 29 / 42
  • 62.
    Column CHECK constraints Example ValidityChecking Example CREATE TABLE test (rollno number(2) check (rollno between 1 and 50), name varchar2(15)); Validity Checking Example INSERT INTO test values(45, ’ Willy’ ); 1 row inserted Validity Checking Example INSERT INTO test values(55, ’ Hiess’ ); ERROR-Check constraints violated Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 29 / 42
  • 63.
    Referential Integrity Ghezal AhmadZia (@ISD-CSF-KU) Database Security May 16, 2014 30 / 42
  • 64.
    Confidentiality Example: How toensure data confidentiality? Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 31 / 42
  • 65.
    Confidentiality Example: How toensure data confidentiality? Cryptography Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 31 / 42
  • 66.
    Confidentiality Example: How toensure data confidentiality? Cryptography Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 31 / 42
  • 67.
    Confidentiality Example: How toensure data confidentiality? Cryptography Strong Access Control Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 31 / 42
  • 68.
    Confidentiality Example: How toensure data confidentiality? Cryptography Strong Access Control Limiting number of places where data can appear Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 31 / 42
  • 69.
    Access Control Ghezal AhmadZia (@ISD-CSF-KU) Database Security May 16, 2014 32 / 42
  • 70.
    Access Control An identitypermits access to resources In computer security this is called Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 32 / 42
  • 71.
    Access Control An identitypermits access to resources In computer security this is called Access Control Authorization We talk about: Subjects (for whom an action is performed) Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 32 / 42
  • 72.
    Access Control An identitypermits access to resources In computer security this is called Access Control Authorization We talk about: Subjects (for whom an action is performed) Objects (upon what an action is performed) Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 32 / 42
  • 73.
    Access Control An identitypermits access to resources In computer security this is called Access Control Authorization We talk about: Subjects (for whom an action is performed) Objects (upon what an action is performed) Operations (the type of action performed) Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 32 / 42
  • 74.
    Access Control Models ADBMS provides access control mechanisms to help implement a security policy. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 33 / 42
  • 75.
    Access Control Models ADBMS provides access control mechanisms to help implement a security policy. Two complementary types of mechanism: Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 33 / 42
  • 76.
    Access Control Models ADBMS provides access control mechanisms to help implement a security policy. Two complementary types of mechanism: 1 Discretionary access control (DAC) Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 33 / 42
  • 77.
    Access Control Models ADBMS provides access control mechanisms to help implement a security policy. Two complementary types of mechanism: 1 Discretionary access control (DAC) 2 Mandatory access control (MAC) Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 33 / 42
  • 78.
    Discretionary Access Control GhezalAhmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
  • 79.
    Discretionary Access Control Idea Achievesecurity based on the concept of access rights: 1 privileges for objects Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
  • 80.
    Discretionary Access Control Idea Achievesecurity based on the concept of access rights: 1 privileges for objects (certain access rights for tables, columns, etc.), and Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
  • 81.
    Discretionary Access Control Idea Achievesecurity based on the concept of access rights: 1 privileges for objects (certain access rights for tables, columns, etc.), and 2 a mechanism for giving users privileges (and revoking privileges) Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
  • 82.
    Discretionary Access Control Idea Achievesecurity based on the concept of access rights: 1 privileges for objects (certain access rights for tables, columns, etc.), and 2 a mechanism for giving users privileges (and revoking privileges) Users are given privileges to access the appropriate schema objects (tables, views). Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
  • 83.
    Discretionary Access Control Idea Achievesecurity based on the concept of access rights: 1 privileges for objects (certain access rights for tables, columns, etc.), and 2 a mechanism for giving users privileges (and revoking privileges) Users are given privileges to access the appropriate schema objects (tables, views). Users can grant privileges to other users at their own discretion. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
  • 84.
    Discretionary Access Control Idea Achievesecurity based on the concept of access rights: 1 privileges for objects (certain access rights for tables, columns, etc.), and 2 a mechanism for giving users privileges (and revoking privileges) Users are given privileges to access the appropriate schema objects (tables, views). Users can grant privileges to other users at their own discretion. Implementation: GRANT and REVOKE commands Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 34 / 42
  • 85.
    Granting/Revoking Privileges GRANT SELECTON database.* TO user@’localhost’; Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 35 / 42
  • 86.
    Granting/Revoking Privileges GRANT SELECTON database.* TO user@’localhost’; GRANT SELECT ON database.* TO user@’localhost’ IDENTIFIED BY ’password’; Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 35 / 42
  • 87.
    DBMSs and WebSecurity Countermeasures Proxy servers Firewalls Secure Socket Layer or SSL Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 36 / 42
  • 88.
    DBMSs and WebSecurity Countermeasures Proxy servers Firewalls Secure Socket Layer or SSL Which is used extensively to secure e-commerce on the Internet today. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 36 / 42
  • 89.
    Proxy Servers Ghezal AhmadZia (@ISD-CSF-KU) Database Security May 16, 2014 37 / 42
  • 90.
    Proxy Servers Definition Proxy serversis a computer that sits between a Web browser and a Web servers. It intercepts all requests for web pages and saves them locally for some times. Proxy server provides improvement in performance and filters requests. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 37 / 42
  • 91.
    Proxy Servers Definition Proxy serversis a computer that sits between a Web browser and a Web servers. It intercepts all requests for web pages and saves them locally for some times. Proxy server provides improvement in performance and filters requests. Computer A Computer B Proxy-server Internet Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 37 / 42
  • 92.
    Firewalls Ghezal Ahmad Zia(@ISD-CSF-KU) Database Security May 16, 2014 38 / 42
  • 93.
    Firewalls Firewalls Is a systemthat prevents unauthorized access to or from private network. Implemented in software, hardware or both. Packet filter Application gateway Proxy server Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 38 / 42
  • 94.
    Conclusion Data security iscritical. Requires security at different levels. Several technical solutions . But human training is essential. Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 39 / 42
  • 95.
    References Mark Stamp INFORMATION SECURITYPRINCIPLES AND PRACTICE Mark Stamp Database Systems Security , Chapter 19, 541 Michael Gertz Handbook of Database Security Applications and Trends Dorothy Elizabeth Robling Denning Cryptography and Data Security Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 40 / 42
  • 96.
    Thanks for yourattention! Ghezal Ahmad Zia (@ISD-CSF-KU) Database Security May 16, 2014 41 / 42