Today’s lecture is about Database Security.
What is database security? Database security is the system, processes, and procedures that protect a database from unintended activity. Unintended activity can be categorized as authenticated misuse, malicious attacks or inadvertent mistakes made by authorized individuals or processes. Characteristic for a good Database Security Management System include privacy, integrity and availability. Privacy signifies that an unauthorized user cannot disclose the data. Integrity ensures unauthorized user cannot modify the data while availability ensures that data is available to authorized user unfailingly.
There are four levels of database security which is physical security, operating system security, DBMS security and data encryption. The first three levels (physical security, operating system security, DBMS security) cannot provide sufficient security because it is hard to control the disclosure of raw data and also hard to control the disclosure of confidential data in as distributed database system. Therefore, encryption is a means to enforce database security. Data is encrypted into ciphertext which only can be decrypted with decryption key.
The basic security requirements in database are physical database integrity, logical database integrity, element integrity, access control, user authentication and availability. DBMS runs on top of operating system and there’s no trusted path. Thus, user must be suspicious of information received. Availability means that when two users is requesting the same record at the same time, the record must be available. Besides, it also means to withholiding some non protected data to avoid revealing the protected data.
On the other hand, reliability and integrity are important element in database management system. Database integrity concern that the database as a whole is protected from damage. Element integrity concern with the value of element is written or changed only by authorized users. Recovery is equally vital in database management system and can be exercised through backup and change log.
In database, there’s sensitive data. Sensitive data is data that should not be made public. The factors that make data sensitive are the data is inherently sensitive, the data is from sensitive source, the data is declared to be sensitive and the data is sensitive in relation to previously disclosed information. To secure sensitive data, access decision is essential. Assurance of authenticity could be done in way of DBA permit user to access database during certain hours. The difference between secrecy and precision is database is that secrecy allow only disclosure to data that is not sensitive while precision protect all sensitive data while revealing as much non sensitive data as possible.
There are several attacks that can be performed on database. Inference attack is one of them. An Inference Attack is a data mining technique performed by analyzing data in order to illegitimately gain knowledge about a database. A subject's sensitive information can be considered as leaked if an adversary can infer its real value with a high confidence. An Inference attack occurs when a user is able to infer from trivial information more robust information about a database without directly accessing it. The attack can be direct or indirect. In direct attack, one tries determine values of sensitive fields by seeking them directly with queries that yield few records. On the other hand, indirect attack is an attack by sum tries to infer a value from a reported sum.
Multilevel database enhance security of database. Multilevel database provides granular security for data depending on the sensitivity of the data field and clearance of the user for both writing and reading data. It is a Column based table with different security and view layers. The first layer corresponds to a model for a non-protected database. The second layer corresponds to a model for a multilevel database. In this second layer, a list of theorems that must be respected in order to build a secure multilevel database is proposed. The third layer corresponds to a model for a MultiView database, that is, a database that provides at each security level a consistent view of the multilevel database.
No comments:
Post a Comment