Introduction to Database Security
Database Security concerns the use of a broad range of information security controls to protect databases (potentially including the data, the database applications or stored functions, the database systems, the database servers and the associated network links) against compromises of their confidentiality, integrity and availability. It involves various types or categories of controls, such as technical, procedural/administrative and physical.
Definition of Database Security:
Database security refers to the collective measures used to protect and secure a database or database management software from illegitimate use and malicious threats and attacks.
It is a broad
term that includes a multitude of processes, tools and methodologies that
ensure security within a database environment.
Database
security is generally planned, implemented and maintained by a database
administrator and or other information security professional.
Data Security:
Data security is the practice of keeping data protected from corruption and unauthorized access. The focus behind data security is to ensure privacy while protecting personal or corporate data. There has been a huge emphasis on data security as of late, largely because of the internet. There are number of options for locking down your data from software solutions to hardware mechanisms. Computer users are certainly more conscious these days, but are your data really secure? If you're not following the essential guidelines, your sensitive J information just may be at risk.
Security risks to database systems include, for example:
1. Unauthorized or unintended activity or misuse by authorized database users, database administrators, or network/systems managers, or by unauthorized users or hackers (e.g. inappropriate access to sensitive data, metadata or functions within databases, or inappropriate changes to the database programs, structures or security configurations).
2. Malware infections causing incidents such as unauthorized access, leakage or disclosure of personal or proprietary data, deletion of or damage to the data or programs, interruption or denial of authorized access to the database, attacks on other systems and the unanticipated failure of database services;
IT’S IMPORTANT TO PROTECT:
1. Data stored in database
2. Database server
3. Database management system (DBMS)
4. Other database workflow applications
Software Security:
Buffer overflow, stack overflow, command injection and SQL injections are the most common attacks on the software. Buffer and stack overflow attacks overwrite the contents of the heap or stack respectively by writing extra bytes. Command injection can be achieved on the software code when system commands are used predominantly. New system commands are appended to existing commands by the malicious attack. Sometimes system command may stop services and cause DoS.
Data security is
critical for most businesses and even home computer users. Client information,
payment information, personal files, bank account details-all of this
information can be hard to replace and potentially dangerous if it falls into
the wrong hand. Data lost due to disasters such as a flood or fire crushing,
but losing it to hackers or a malware I can have much greater consequences.
Risk Assessment
Thorough data
security begins with an overall and risk assessment. This will enable you to
the risks you are faced with and what could if valuable data is lost through
theft, malware infection or a system crash.
Securing Data
Once you draw up
a plan and assess your risks, it is time to put data security system into
action. Since data can be compromised in many ways, the best security s against
misuse or theft involves a combination of technical measures, physical and a
well-educated staff. You should implement clearly defined polices into your infrastructure
and effectively present them to the staff.
Type of security control on the data
Access Control: Access control is the selective restriction of access to a place or other resource. The act of accessing may mean consuming, or using. Permission to access a resource authorization.
Auditing: Database auditing involves observing a so as to be aware of the actions of users. Database administrators and consultants often set up auditing for security. for example, to ensure that those without the permission to access information do not access it.
Authentication: authentication is another part of data that we encounter with everyday computer usage. Just think about when you log into your email or blog account. That single sign-on process is a form authentication that allows you to log into applications, files, folders and even an entire computer system. Once logged in, you have various given privileges until logging out. Some systems will cancel a session if your machine has been idle for a certain amount of time, requiring that you prove authentication once again to re-enter.
The single
sign-on scheme is also implemented into strong user authentication systems.
However, it requires individuals to login using multiple factors of
authentication. This may include a password, a one-time password, a smart card
or even a fingerprint.
Encryption: Encryption has become a critical security feature for thriving networks and active home users alike. This security mechanism uses mathematical schemes and algorithms to scramble data into unreadable text. It can only be decoded or decrypted by the party that possesses the associated key.
Integrity controls
Backups: a backup, or the process of backing up, refers to the copying and archiving of computer data so it may be used to restore the original after a data loss event. Backups have two distinct purposes. The primary purpose is to recover data after its loss, be it by data deletion or corruption. Data loss can be a common experience of computer users. The secondary purpose of backups is to recover data from an earlier time, according to a user-defined data retention policy, typically configured within a backup application for how long copies of data are required. Though backups popularly represent a simple form of disaster recovery and should be part of a disaster recovery by themselves, backups should not alone be considered disaster recovery. One reason for this is not all backup systems or backup applications able to reconstitute a computer system or other complex configurations such as a computer cluster, active directory servers, or a database server, by restoring only data from a backup.
Application security: Application security is the use of software, hardware, and procedural methods to protect applications from external threats.
Once an
afterthought in software design, security is becoming an increasingly important
concern during development as applications become more frequently accessible
over networks and are, as a result, vulnerable to a wide variety of threats.
Role of the database administrator in data security
A database administrator (short form DBA) is a person responsible for the installation, configuration, upgrade, administration, monitoring and maintenance of databases in an organization. The role includes the development and design of database strategies, system monitoring and improving database performance and capacity, and planning for future expansion requirements. They may also plan, co-ordinate and implement security measures to safeguard the database.
A database administrator's responsibilities can include the following tasks:
1.
Installing
and upgrading the database server and application tools
2.
Allocating
system storage and planning future storage requirements for the database system
3.
Modifying
the database structure, as necessary, from information given by application
developers
4.
Enrolling
users and maintaining system security
5.
Ensuring
compliance with database vendor license agreement
6.
Controlling
and monitoring user access to the database
7.
Monitoring
and optimizing the performance database
8.
Planning
for backup and recovery of database information
9.
Maintaining
archived data
10.
Backing
up and restoring databases
11.
Contacting
database vendor for technical support
12. Generating
various reports by querying from database as per need.
Exercises:
l. Explain data
security
2. State the
importance of data security
3. Defines the
roles of a Database Administrator in data security
4. Define encryption