Practical 2: Study of Data Security Requirements, Security Concerns and Possible Risks
in Database Systems:
Aim
To study the fundamental data security requirements, security concerns, and possible risks
associated with database systems.
Objectives
1. To understand the basic requirements of database security.
2. To identify common security concerns in database systems.
3. To study possible threats and risks to database information.
4. To understand various methods used to protect databases from unauthorized access and
attacks.
Theory
Database security refers to the protection of a database against unauthorized access, misuse,
modification, disclosure, destruction, or loss of data.
A database may contain sensitive information such as personal details, financial records,
passwords, business information, and confidential organizational data. Therefore, proper
security mechanisms are required to maintain the confidentiality, integrity, and availability of
the stored information.
Fundamental Data Security Requirements
1. Confidentiality
Confidentiality ensures that data is accessible only to authorized users.
Example: A student's academic records should be accessible only to authorized faculty
members and administrators.
2. Integrity
Integrity ensures that data remains accurate, consistent, and protected against unauthorized
modification.
Example: An unauthorized user should not be able to change a student's marks.
3. Availability
Availability ensures that authorized users can access the database whenever required.
Example: A banking database should remain available to authorized users during normal
operating hours.
4. Authentication
Authentication verifies the identity of a user before allowing access to the database.
Examples:
Username and password
Multi-factor authentication
Digital certificates
5. Authorization
Authorization determines what an authenticated user is allowed to access or modify.
Example: A student may view their marks but may not modify them.
6. Accountability
Database activities should be recorded so that actions can be traced to individual users.
Example: Database logs can record who accessed or modified a particular record.
7. Privacy
Personal and sensitive information should be collected, stored, and processed according to
applicable privacy requirements and organizational policies.
Security Concerns in Database Systems
The major security concerns include:
1. Unauthorized Access
Attackers or unauthorized users may attempt to access confidential database information.
2. Weak Authentication
Weak or easily guessed passwords can allow attackers to gain access to database accounts.
3. SQL Injection
SQL injection occurs when malicious input is used to manipulate database queries. It can
potentially allow unauthorized viewing, modification, or deletion of data.
Prevention: Use parameterized queries/prepared statements and validate input.
4. Privilege Abuse
A user with excessive privileges may intentionally or accidentally access or modify information
beyond their responsibilities.
5. Data Leakage
Sensitive database information may be exposed through insecure applications, misconfigured
databases, backups, or unauthorized users.
6. Insider Threats
Employees or other authorized users may misuse their database privileges to steal, modify, or
disclose information.
7. Insecure Backups
Database backups may contain complete copies of sensitive information. If they are not
properly protected, they can become a major source of data leakage.
8. Malware and Ransomware
Malicious software can damage databases, steal information, or make data unavailable.
9. Poor Configuration
Incorrect database permissions, publicly exposed database services, or unnecessary enabled
features can increase security risks.
10. Lack of Monitoring
Without proper logging and monitoring, suspicious activities may remain undetected.
Possible Risks in Database Systems
Risk Description Possible Impact
Unauthorized access Access by users without permission Data disclosure
Malicious manipulation of database
SQL injection Data theft or modification
queries
Data modification Unauthorized alteration of records Loss of data integrity
Data deletion Accidental or malicious deletion Data loss
Data leakage Exposure of confidential information Privacy and financial loss
Weak passwords Easily guessed credentials Account compromise
Insider attack Misuse by an authorized user Confidentiality breach
Malicious software affecting the Service interruption/data
Malware/Ransomware
database loss
Hardware failure Failure of storage or database server Database unavailability
Insecure backup Unauthorized access to backup files Large-scale data exposure
Denial of Service Database resources are exhausted Loss of availability
Incorrect permissions or security
Misconfiguration Unauthorized access
settings
Database Security Measures
The following measures can be used to improve database security:
1. Use strong passwords and multi-factor authentication.
2. Apply the principle of least privilege, giving users only the permissions they require.
3. Use role-based access control.
4. Encrypt sensitive data during storage and transmission.
5. Use parameterized queries to prevent SQL injection.
6. Regularly update and patch the database management system.
7. Maintain secure and tested backups.
8. Enable database auditing and activity logging.
9. Monitor unusual database activities.
10. Protect database servers using firewalls and network security controls.
11. Remove unnecessary accounts and services.
12. Regularly review user permissions.
13. Perform security assessments and vulnerability testing.
14. Develop a disaster recovery plan.
Precautions
Database credentials should not be shared with other users.
Sensitive information should not be stored or transmitted unnecessarily.
Administrative privileges should be given only to authorized personnel.
Backups should be encrypted and stored securely.
Database software should be kept updated.
Logs should be protected against unauthorized modification.
Security testing should be performed only on authorized systems.
Result
The fundamental requirements of database security, major security concerns, and possible risks
associated with database systems were studied successfully. The importance of confidentiality,
integrity, availability, authentication, authorization, and accountability in protecting database
systems was understood.
Conclusion
Database security is essential for protecting information from unauthorized access,
modification, disclosure, and destruction. Proper authentication, authorization, encryption,
access control, auditing, backups, monitoring, and regular security updates help reduce
database-related risks and maintain the confidentiality, integrity, and availability of data.