A Discussion of Some of the Nuances of Database Security

Only available on StudyMode
  • Download(s) : 13
  • Published : April 14, 2013
Open Document
Text Preview
STRAYER UNIVERSITY
CIS 512
Professor: Angela Gabriel

Advanced Data and Computer Architectures

A discussion of some of the nuances
Of
Database Security

James A. Wallace
June 09, 2006

ABSTRACT:
When it comes to the topic of database security head just do not turn the way benchmarking world records and reports of ever-shorter downtimes do. However, security breaches do turn heads as well as undermine customer confidence, as the well-publicized thefts of credit card numbers from a few e-businesses showed in 2000. Databases introduce a number of unique security requirements for their users and administrators. On one hand, databases are designed to promote open and flexible access to data. On the other hand, this same open access makes databases vulnerable to many kinds of malicious activity. Moreover, as more businesses participate in the e-space, it becomes particularly important to separate private from public data. Securing a database involves not only establishing a strong policy, but also establishing adequate access controls. In this paper, we will discuss several of the various nuances of Database security.

TABLE OF CONTENTS
I.INTRODUCTION
II.UNDERSTANDING VULNERABILITIES
A.VENDOR BUGS
B.POOR ARCHITECTURE
C.MISCONFIGURATIONS
D.INCORRECT USAGE
E.SERVER SECURITY
F.DATABASE CONNECTIONS
G.TABLE ACCESS CONTROL
III.WHO NEEDS ASSESS TO THE DATABASE?
IV.BASIC SECURITY STRUCTURE
V.LEVELS OF ACCESS
VI.PRIVILEGES
VII.SECURING A DATABASE INVOLVES
VIII.AUTHENTICATION
IX.SECURE SOCKET LAYERS
X.SUMMARY

INTRODUCTION

Security is a journey, not a destination. You should never assume that any product or technique is secure, because you cannot possibly know what new attacks will become possible in the future. One of the more recent evolutions in network security has been the movement away from protecting the perimeter of the network to protecting data at the source. The reason behind this change has been that perimeter security no longer works in today's environment. Today, more than just a companies employees have a need access to data. There are potentially different categories of users for any information system, ranging from end users to administrators of information systems.

For users to access the database system, it must be accessible on the local (LAN) or wide area network (WAN) and today the World Wide Web (Internet) as well. Applications using Web browsers as the primary user interface are so common as to be the norm for new development. When the database is put on the web, it becomes vulnerable to hackers and other criminals from outside the organization who can damage the organizations system or steal its data just because they can. Direct security breaches against databases appear to be on the rise, according to the recently released summer 2002 Database Developers survey from research firm Evans Data Corp. The report revealed that one in five respondents have experienced a direct breach in security, up significantly from the winter survey six months ago when 12% reported direct breaches. The most frequent type of security breach was a viral attack from outside the enterprise, at 22%.

The survey, which is fielded among more than 700 database specialists across North America, also revealed that all of the strategies for managing web-based data from real-time updating, to data collection to dynamic page creation, have increased in relative importance in the eyes of database developers. Evans said that the majority of database developers, 72%, rate dynamic page creation as critical and first in importance of features found in a database with web access, while 72% also give high priority to automatic site updating.

Obviously, organization must defend against the potential for the capacity of deliberate harm from people both inside and outside an organization. However, an even larger problem could be the myriad of chances for honest...
tracking img