DATABASE SECURITY ISSUES

Database A database is an organized collection of data for

one or more purposes, usually in digital form. The data are typically organized to model relevant aspects of reality (for example, the availability of rooms in hotels), in a way that supports processes requiring this information (for example, finding a hotel with vacancies). The term "database" refers both to the way its users view it, and to the logical and physical materialization of its data, content, in files, computer memory, and computer data storage. This definition is very general, and is independent of the technology used.

3

Data - Information - Is Valuable

Many enterprises depend on secure & reliable DBMSs: Banks, the stock exchange, airlines, hospitals, ...

DBMS systems may be at risk from situations such as: Theft, fraud Loss of confidentiality (business secrets) – loss of

competitiveness Loss of privacy (personal information) – legal implications Loss of integrity – corrupted data Loss of availability

4

Identity Theft

Pretend to be someone else and get credit cards/loans in their name Identification based on “private” information that is not hard to

obtain online Hurts victims even more than regular theft

Onus goes on innocent people to prove they didn't get loans or make credit card payment

Credit history gets spoilt, making it harder to get future loans And you may have been robbed without ever knowing about it.

5

Security at the Database/Application Program

Authentication and authorization mechanisms to allow specific users access only to required data

Authentication: who are you? Prove it!

Authorization: what you are allowed to do

6

Common Security Measures Authorization - privileges, views Authentication - passwords Verification - digital signatures/certificates Encryption - public key / private key, secure sockets Backups - offsite backups, journaling, log files Physical - data centres, alarms, guards, UPS Logical - firewalls, net proxies

7

Firewalls

Firewalls block unauthorised external network access

Firewalls may limit access to the internet for ‘internal’ machines

InternalClient

Internal Client

DBMS Server

FirewallInternal Network

The Internet

??

Thank You