© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION © Digital_Art/Shutterstock CHAPTER © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC 8NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC NOT IntroductionFOR SALE OR DISTRIBUTION toNOT FOR SALE OR DISTRIBUTION © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC NOT FOR SALE ORDatabase DISTRIBUTION SecurityNOT FOR SALE OR DISTRIBUTION © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION TABLE OF CONTENTS CHAPTER OBJECTIVES © Jones8.1 & IssuesBartlett in Database Learning, Security LLC © Jones In & this Bartlett chapter you Learning, will learn the LLC NOT 8.2FOR SALE Fundamentals OR DISTRIBUTION of Access Control NOT FORfollowing: SALE OR DISTRIBUTION U 8.3 Database Access Control The meaning of database 8.4 Using Views for Access Control security U 8.5 Security Logs and Audit Trails How security protects privacy and confidentiality © Jones & Bartlett8.6 Learning, Encryption LLC © Jones & Bartlett Learning, LLC U Examples of accidental or NOT FOR SALE OR8.7 DISTRIBUTION SQL Data Control Language NOT FOR SALE OR DISTRIBUTION deliberate threats to security 8.8 Security in Oracle U Some database security 8.9 Statistical Database Security measures 8.10 SQL Injection U The meaning of user 8.11 Database© Jones Security & and Bartlett the Internet Learning, LLC © Jones & Bartlett Learning, LLC authentication 8.12 ChapterNOT Summary FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION U The meaning of authorization Exercises U How access control can be represented © Jones & Bartlett Learning, LLC © JonesU & How Bartlett the view Learning, functions as a LLC NOT FOR SALE OR DISTRIBUTION NOT FOR securitySALE device OR DISTRIBUTION © Jones & Bartlett Learning, LLC© Jones & Bartlett Learning, LLC.© NOTJones FOR SALE& Bartlett OR DISTRIBUTION. Learning, LLC NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 9781284079050_CH08_PASS03.indd 361 11/06/15 5:23 pm © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 362 CHAPTER 8 Introduction to Database Security © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC U The purpose ofNOT the FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION security log and audit trail 8.1 Issues in Database Security U How and why data Database security involves protecting the database from unauthorized encryption is performed access, modi cation, or destruction. Since the database represents an essential ©U HowJones to protect & Bartlett databases Learning, corporate LLC resource, database security© is Jonesan important & Bartlett subcomponent Learning, of LLC NOTagainst FOR SQL SALE injection OR DISTRIBUTIONany organization’s overall informationNOT systems FOR security SALE plan. OR In DISTRIBUTIONaddition to the need to preserve and protect data for the smooth functioning of the U How security is enforced organization, database designers have a responsibility to protect the privacy in some systems of individuals about whom data is kept. Privacy is the right of individuals to U How Internet security is have some control over information about themselves. Many countries have © Jones & Bartlettimplemented Learning, LLC laws designed to protect© Jonesprivacy, and & everyBartlett organization Learning, that collects LLC and stores NOT FOR SALE OR DISTRIBUTION information about individualsNOT FOR is legally SALE obliged OR to DISTRIBUTIONadopt policies that conform to local privacy legislation. e database design should re ect the organization’s commitment to the protection of individual privacy rights by including only those items that the organization has a right to know and keeping them secure. © Jones & Bartlett e security Learning, of information LLC typically follows the CIA © model, Jones where & CIABartlett Learning, LLC NOT FOR SALEstands forOR con DISTRIBUTION dentiality , integrity , and availability . ConNOT dentiality FOR requires SALE OR DISTRIBUTION that only authorized users have access to information in order to preserve the privacy of individuals, business intellectual property, and national security e orts. With the growth of social media and online business due to the Internet, maintaining con dentiality involves using appropriate encryption techniques © Jones & Bartlett Learning,as well LLCas user authorization, identi cation,© Jones and authentication & Bartlett procedures. Learning, LLC NOT FOR SALE OR DISTRIBUTION Integrity requires that only authorizedNOT users beFOR allowed SALE to modify OR data,DISTRIBUTION thus maintaining data consistency and trustworthiness. If data is incorrect, it is no longer useful. Incorrect data can also be harmful to individuals (such as wrong data on a credit report) and organizations (such as invalid nancial reports). Availability requires that information be accessible by authorized users when © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC needed. Security attacks against an organization can cause business services to NOT FOR SALE OR DISTRIBUTION become unavailable, NOTleading FOR to violations SALE of ORservice DISTRIBUTION level agreements that are critical to business operations. Some of the laws and standards requiring controls on access, disclosure, and modi cation of sensitive data are: © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC U The Federal Information Security Management Act (FISMA) . NOT FOR SALE FISMAOR DISTRIBUTION requires federal agencies in the United StatesNOT to developFOR SALE and OR DISTRIBUTION implement an agency-wide information security plan in support of federal operations. U e European General Data Protection Regulation (GDPR) . © Jones & Bartlett Learning, LLC e GDPR establishes data protection© Jones regulations & Bartlett for allLearning, foreign LLC NOT FOR SALE OR DISTRIBUTIONcompanies that process data of NOTEuropean FOR Union SALE residents. OR DISTRIBUTION © Jones & Bartlett Learning, LLC© Jones & Bartlett Learning, LLC.© NOTJones FOR SALE& Bartlett OR DISTRIBUTION. Learning, LLC NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 9781284079050_CH08_PASS03.indd 362 11/06/15 5:23 pm © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION 8.1 Issues in Database Security 363 U e ©U.S. Jones Health & Insurance Bartlett Portability Learning, and LLC Accountability Act © Jones & Bartlett Learning, LLC (HIPAA)NOT . HIPAA FOR deSALE nes requirements OR DISTRIBUTION for health care organizations NOT FOR SALE OR DISTRIBUTION for maintaining security and privacy of patient data. U e U.S. Sarbanes-Oxley (SOX) Act . SOX de nes strict regulations for nancial reporting activities of publically traded companies. © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC U e U.S. Gramm-Leach-Bliley Act (GLBA) . GLBA establishes pro- NOT FORvisions SALE to ensureOR DISTRIBUTION the protection of consumers’ nancial information.NOT FOR SALE OR DISTRIBUTION U e Worldwide Payment Card Industry Data Security Standard (PCI DSS) . PCI DSS de nes a framework for secure processing of consumer credit card information. © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC NOT FOR SALE OR Violation DISTRIBUTION of these practices and regulations canNOT lead FOR to fraud, SALE nancial OR DISTRIBUTION losses, and severe penalties. Security threats are events or situations that could harm the system by compromising privacy or con dentiality, or by damaging the database itself. A vulnerability is a weakness in a system, such as inappropriate access control or loopholes in© rewall Jones protection, & Bartlett that allows Learning, a threat to LLCoccur. Security threats © Jones & Bartlett Learning, LLC can occur eitherNOT accidentally FOR SALE or deliberately OR DISTRIBUTION . Putting a database security plan NOT FOR SALE OR DISTRIBUTION in place should include a risk assessment process that identi es threats and vulnerabilities and establishes appropriate controls in the context of the CIA model. © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC NOT 8.1.1FOR SALE Accidental OR DISTRIBUTION Security Threats NOT FOR SALE OR DISTRIBUTION Some examples of accidental security violations are the following: U e user may unintentionally request an object or an operation for which he or she should not be authorized, and the request could © Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC be granted because of an oversight in authorization procedures or NOT FOR SALE OR DISTRIBUTIONbecause of an error in the database managementNOT FOR system SALE or operating OR DISTRIBUTION system. U A person may accidentally be sent a message that should be directed to another user, resulting in unauthorized disclosure of database contents.© Jones & Bartlett Learning, LLC © Jones & Bartlett Learning, LLC NOT FOR SALE OR DISTRIBUTION NOT FOR SALE OR DISTRIBUTION U A communications system error might connect a user to a session that belongs to another user with di erent access privileges. U e operating system might accidentally overwrite les and destroy part of the database, fetch the wrong les, and then inadvertently © Jones &send Bartlett them to Learning, the user, or it LLC might fail to erase les that should© Jones