07312006DataValidSecurityRev.ppt

7/23/2019 07312006DataValidSecurityRev.ppt

1/37

Module 8*********

DataValidation &

SecurityWorkforce Information

Database TrainingLast update November 2006


2/37

Providing Accurate Data Consistently

Data validation allows us to provide data

with confidence in its accuracy, and wecan consistently provide this data byimplementing thorough security

Module 8

Data Validation & Security


3/37

Data Integrity!alidity, consistency, and accuracy ofthe data in a database

Table"level#ield"level$elationship"level

%usiness $ules

Module 8



4/37

Module 8


Data !alidationThe process of determining if anupdate to a value in a table&s data cell

is within a preestablished range or is amember of a set of allowable values


5/37

What are some common data'uality problems that affect

data integrity and validation(

Module 8



6/37

Common Data )uality Problems

Illegal values

!iolated attribute dependencies *ni'ueness violation $eferential integrity violation +issing values

+isspellings Cryptic values mbedded values +isfielded values

Module 8



7/37

Common Data )uality Problemscontinued-

Word transpositions Duplicate records Contradicting records Wrong references .verlapping data/matching records 0ame conflicts 1tructural conflicts

Inconsistencies

Module 8



8/37

What are some methods forchecking for data validity(

Module 8



9/37

+ethods for checkingfor data validity

!isual/manual Aggregation $eviewers guide Auto data checks $ecord counts 1pell checks 2ave data provider review

Module 8



10/37

Time to 3ercise44

Module 8



11/37


12/37

Network

permissions

Physical security

(including backup& restoration plan)

Data Storage Access

(Server or PC)Websecurity

Application

securityUserlevel

ALMIS atabase Security !onsiderations

Database security prevents unauthorized person(s) from vieing! destroying or altering data ithin the database"

Security Concerns#

!on"identialityIntegrity

Availability

UserlevelUserlevel

Application

security#$MS%$!

Suppression "lagsata aggregation issues

$etor%

(&A$'WA$)

security

'e contact in my state is

*roduction vs+ test *roduction vs+ test

Module 8



13/37

Network

permissions

Physical security


Data Storage Access


Application

securityUserlevel



Security Concerns#


Availability

UserlevelUserlevel

Application

security#$MS%$!


$etor%

(&A$'WA$)

security



Module 8



14/37

Physical 1ecurity

)uestions to ask yourself5

Where is your data actually stored(

Are you responsible for physical security(

If you are...

Module 8



15/37

Physical 1ecurity

What physical security measures do you

have in place(

Do you have the right hardware(

Are you using obsolete hardware that isprone to crashing or hacking( Do youhave a choice(

Module 8



16/37

Physical 1ecurity

Do you have a database backup plan(

Do you have remote backup so if a fireburns the building you don&t lose bothyour primary and backup data at the

same time(

Do you have a data restoration plan(Does the backup plan allow for feasible

restoration(

Module 8



17/37

Physical 1ecurity

$estoration Plan

Does your restoration plan allow forthe restoration of individual tablesor re'uire the entire database(

Do you maintain copies of the tableson your hard drive(

Module 8



18/37

Physical 1ecurity

Who has access to the physical storagelocation(

Is your database on a PC or server thatsomeone could easily kick, spill coffeeon, or accidentally reappropriate(

If you are not responsible for physicalIf you are not responsible for physical

security, ask these 'uestions of thosesecurity, ask these 'uestions of those

who are4who are4

Module 8



19/37

Network

permissions

Physical security


Data Storage Access


Application

securityUserlevel



Security Concerns#


Availability

UserlevelUserlevel

Application

security#$MS%$!


$etor%

(&A$'WA$)

security



Module 8



20/37

Data 1torage Access

What software are you using to store the

database(

1)6 1erver, .racle, #o3Pro, Access(

1urvey says51)6 1erver 789

.racle :89

.ther :79

Module 8



21/37

Data 1torage Access

What can be done at the server level to

provide for security(

Confidentiality, Integrity, Availability

DO apply advanced security to the mostsensitive data, but DONT applyadvanced security to non-sensitive data

Module 8



22/37

Data 1torage Access

1ecurity at the server and/or databaselevel-

Permissions

What kind of permissions e3ist(

$ead only, 1A, etc

Who sets those permissions(

Who has those permissions(

Module 8



23/37

A6+I1 Database 1ecurity

1ecurity at the data level-

1uppression

1uppression flags

1uppression can be handled at the

database level or the application level

Module 8



24/37

A6+I1 Database Data 1ecurity

Two approaches5

; A6+I1 Database contains 0. confidentialdata


25/37

A6+I1 Database 1ecurity

Tables that have suppression flags

ces

indprj

industry

iomatrix

occprj

oesa!e

stindprj

stoccprj

0.T5 tablesstfirmsand a!ehave nosuppression flags but may contain confidential data

Module 8



26/37


Issues to consider regarding suppression5

If your database doesn&t containsuppressed records, detailed data won&taggregate to totals


27/37


A note on confidential data5

If you are checking :>: data


28/37

Network

permissions

Physical security


Data Storage Access


Application

securityUserlevel



Security Concerns#


Availability

UserlevelUserlevel

Application

security#$MS%$!


$etor%

(&A$'WA$)

security



Module 8



29/37

*ser Access

Three ma?or types of user access5

PC " direct to database


30/37

*ser Access via the Web

2ow do Web users access the data from thedatabase(

"assive #static tables automaticallyupdated to eb pa!es$

%ctive #&uery throu!h application$

Module 8



31/37



What kind of web server are you using(What are the security considerations withthat choice(

What kind of firewall do you have(

Module 8



32/37


Does your web interface havesecurity/confidentiality suppression(

Do you display suppressed data to certainusers( If so, how is access managed(Passwords( IP address(

Module 8



33/37

*ser Access via a 0etwork


34/37

*ser Access via a 0etwork


35/37

*ser Access via direct connection


Is local access machine passwordprotected(

Who has access to your machine(

Is there a backup plan for your accessmachine(

Is the source data for your database

secure( %ackup plan( $estorable(

Module 8



36/37


Documentation

It may prove beneficial to keep detailedrecords on-

2ow security is done Where security e3ists Who is responsible for security Who has access/permissions to what tc

Module 8



37/37

Data 1ecurityDI1C*11I.0

Module 8


07312006DataValidSecurityRev.ppt

Documents

Transcript of 07312006DataValidSecurityRev.ppt