BTech CSE-AIML Semester-3

Database Management Systems (BTA30102)

2025-26 (Odd Semester)

Module-IV

Database Security
Security of databases refers to the array of controls, tools, and procedures designed to ensure and
safeguard confidentiality, integrity, and accessibility. This tutorial will concentrate on
confidentiality because it's a component that is most at risk in data security breaches.

Security for databases must cover and safeguard the following aspects:

o The database containing data.

o Database management systems (DBMS)
o Any applications that are associated with it.
o Physical database servers or the database server virtual, and the hardware that runs it.
o The infrastructure for computing or network that is used to connect to the database.
Security of databases is a complicated and challenging task that requires all aspects of security
practices and technologies. This is inherently at odds with the accessibility of databases. The more
usable and accessible the database is, the more susceptible we are to threats from security. The
more vulnerable it is to attacks and threats, the more difficult it is to access and utilize.

Why Database Security is Important?

According to the definition, a data breach refers to a breach of data integrity in databases. The
amount of damage an incident like a data breach can cause our business is contingent on various
consequences or elements.

o Intellectual property that is compromised: Our intellectual property--trade secrets,

inventions, or proprietary methods -- could be vital for our ability to maintain an advantage in
our industry. If our intellectual property has been stolen or disclosed and our competitive
advantage is lost, it could be difficult to keep or recover.
o The damage to our brand's reputation: Customers or partners may not want to purchase
goods or services from us (or deal with our business) If they do not feel they can trust our
company to protect their data or their own.
o The concept of business continuity (or lack of it): Some businesses cannot continue to
function until a breach has been resolved.
o Penalties or fines to be paid for not complying: The cost of not complying with international
regulations like the Sarbanes-Oxley Act (SAO) or Payment Card Industry Data Security
Standard (PCI DSS) specific to industry regulations on data privacy, like HIPAA or regional
privacy laws like the European Union's General Data Protection Regulation (GDPR) could be
a major problem with fines in worst cases in excess of many million dollars for each violation.
o Costs for repairing breaches and notifying consumers about them: Alongside notifying
customers of a breach, the company that has been breached is required to cover the investigation
and forensic services such as crisis management, triage repairs to the affected systems, and
much more.

Faculty of CSE-AI Department

Brainware University, Kolkata
BTech CSE-AIML Semester-3
Database Management Systems (BTA30102)
2025-26 (Odd Semester)

Common Threats and Challenges

Numerous software configurations that are not correct, weaknesses, or patterns of carelessness or
abuse can lead to a breach of security. Here are some of the most prevalent kinds of reasons for
security attacks and the reasons.

Insider Dangers
An insider threat can be an attack on security from any three sources having an access privilege to
the database.

o A malicious insider who wants to cause harm

o An insider who is negligent and makes mistakes that expose the database to attack. vulnerable
to attacks
o An infiltrator is an outsider who acquires credentials by using a method like phishing or
accessing the database of credential information in the database itself.
Insider dangers are among the most frequent sources of security breaches to databases. They often
occur as a consequence of the inability of employees to have access to privileged user credentials.

Human Error
The unintentional mistakes, weak passwords or sharing passwords, and other negligent or
uninformed behaviours of users remain the root causes of almost half (49 percent) of all data
security breaches.

Database Software Vulnerabilities can be Exploited

Hackers earn their money by identifying and exploiting vulnerabilities in software such as
databases management software. The major database software companies and open-source
databases management platforms release regular security patches to fix these weaknesses.
However, failing to implement the patches on time could increase the risk of being hacked.

SQL/NoSQL Injection Attacks

A specific threat to databases is the infusing of untrue SQL as well as other non-SQL string attacks
in queries for databases delivered by web-based apps and HTTP headers. Companies that do not
follow the safe coding practices for web applications and conduct regular vulnerability tests are
susceptible to attacks using these.

Buffer Overflow is a way to Exploit Buffers

Buffer overflow happens when a program seeks to copy more data into the memory block with a
certain length than it can accommodate. The attackers may make use of the extra data, which is
stored in adjacent memory addresses, to establish a basis for they can begin attacks.

Faculty of CSE-AI Department

Brainware University, Kolkata
BTech CSE-AIML Semester-3
Database Management Systems (BTA30102)
2025-26 (Odd Semester)

DDoS (DoS/DDoS) Attacks

In a denial-of-service (DoS) attack in which the attacker overwhelms the targeted server -- in this
case, the database server with such a large volume of requests that the server is unable to meet no
longer legitimate requests made by actual users. In most cases, the server is unstable or even fails
to function.

Malware
Malware is software designed to exploit vulnerabilities or cause harm to databases. Malware can
be accessed via any device that connects to the databases network.

Attacks on Backups
Companies that do not protect backup data using the same rigorous controls employed to protect
databases themselves are at risk of cyberattacks on backups.

The following factors amplify the threats:

o Data volumes are growing: Data capture, storage, and processing continue to increase
exponentially in almost all organizations. Any tools or methods must be highly flexible to meet
current as well as far-off needs.
o The infrastructure is sprawling: Network environments are becoming more complicated,
especially as companies shift their workloads into multiple clouds and hybrid cloud
architectures and make the selection of deployment, management, and administration of
security solutions more difficult.
o More stringent requirements for regulatory compliance: The worldwide regulatory
compliance landscape continues to increase by complexity. This makes the compliance of every
mandate more challenging.

Best use of Database Security

As databases are almost always accessible via the network, any security risk to any component or
part of the infrastructure can threaten the database. Likewise, any security attack that impacts a
device or workstation could endanger the database. Therefore, security for databases must go
beyond the limits of the database.

In evaluating the security of databases in our workplace to determine our organization's top
priorities, look at each of these areas.

o Security for physical security: If the database servers are on-premises or the cloud data centre,
they should be placed in a secure, controlled climate. (If our server for database is located in a
cloud-based data centre, the cloud provider will handle the security on our behalf.)
o Access to the network and administrative restrictions: The practical minimum number of
users granted access to the database and their access rights should be restricted to the minimum
level required to fulfil their tasks. Additionally, access to the network is limited to the minimum
permissions needed.

Faculty of CSE-AI Department

Brainware University, Kolkata
BTech CSE-AIML Semester-3
Database Management Systems (BTA30102)
2025-26 (Odd Semester)

o End security of the user account or device: Be aware of who has access to the database and
when and how data is used. Monitoring tools for data can notify you of data-related activities
that are uncommon or seem to be dangerous. Any device that connects to the network hosting
the database must be physically secured (in the sole control of the appropriate person) and be
subject to security checks throughout the day.
o Security: ALL data--including data stored in databases, as well as credential information
should be secured using the highest-quality encryption when in storage and while in transport.
All encryption keys must be used in accordance with the best practices guidelines.
o Security of databases using software: Always use the most current version of our software to
manage databases and apply any patches immediately after they're released.
o Security for web server applications and websites: Any application or web server that
connects to the database could be a target and should be subjected to periodic security testing
and best practices management.
o Security of backups: All backups, images, or copies of the database should have the identical
(or equally rigorous) security procedures as the database itself.
o Auditing: Audits of security standards for databases should be conducted every few months.
Record all the logins on the server as well as the operating system. Also, record any operations
that are made on sensitive data, too.

Data protection tools and platforms

Today, a variety of companies provide data protection platforms and tools. A comprehensive
solution should have all of the following features:

o Discovery: The ability to discover is often needed to meet regulatory compliance

requirements. Look for a tool that can detect and categorize weaknesses across our databases,
whether they're hosted in the cloud or on-premises. It will also provide recommendations to
address any vulnerabilities that are discovered.
o Monitoring of Data Activity: The solution should be capable of monitoring and analysing the
entire data activity in all databases, whether our application is on-premises, in the cloud, or
inside a container. It will alert us to suspicious activity in real-time to allow us to respond more
quickly to threats. It also provides visibility into the state of our information through an
integrated and comprehensive user interface. It is also important to choose a system that
enforces rules that govern policies, procedures, and the separation of duties. Be sure that the
solution we select is able to generate the reports we need to comply with the regulations.
o The ability to Tokenize and Encrypt Data: In case of an incident, encryption is an additional
line of protection against any compromise. Any software we choose to use must have the
flexibility to protect data cloud, on-premises hybrid, or multi-cloud environments. Find a tool
with volume, file, and application encryption features that meet our company's regulations for
compliance. This could require tokenization (data concealing) or advanced key management of
security keys.
o Optimization of Data Security and Risk Analysis: An application that will provide
contextual insights through the combination of security data with advanced analytics will allow
users to perform optimizing, risk assessment, and reporting in a breeze. Select a tool that is able
to keep and combine large amounts of recent and historical data about the security and state of
your databases. Also, choose a solution that provides data exploration, auditing, and reporting
capabilities via an extensive but user-friendly self-service dashboard.

1. Authentication

Faculty of CSE-AI Department

Brainware University, Kolkata
BTech CSE-AIML Semester-3
Database Management Systems (BTA30102)
2025-26 (Odd Semester)

 Definition: Authentication is the process by which the identity of a user or system

trying to gain access to a database is verified. The goal is to confirm that the individual
or entity requesting access is indeed who they claim to be.

Authentication is the process of confirmation that whether the user log in only according to
the rights provided to him to perform the activities of data base. A particular user can login
only up to his privilege but he can’t access the other sensitive data. The privilege of accessing
sensitive data is restricted by using Authentication.
By using these authentication tools for biometrics such as retina and figure prints can prevent
the data base from unauthorized/malicious users.

 Types of Authentications:
o Single-Factor Authentication (SFA): The simplest form, typically involving a
username and password. This form is more susceptible to attacks such as
phishing or brute force.
o Two-Factor Authentication (2FA) and Multi-Factor Authentication
(MFA): Adds additional layers of security. For instance, 2FA might require a
password and a verification code sent to the user's phone. MFA could include
additional steps like biometric scans.
o Biometric Authentication: Uses physical attributes like fingerprints, facial
recognition, or retinal scans. This method is highly secure but requires
specialized hardware.
o Token-Based Authentication: Involves hardware tokens, software tokens, or
smart cards. For example, a device generates a temporary access code that the
user must enter along with their credentials.
o Certificate-Based Authentication: Uses digital certificates to validate the
user's identity. These certificates are issued by a trusted Certificate Authority
(CA) and are used in environments requiring high levels of security.
o OAuth and Single Sign-On (SSO): OAuth is an open standard for access
delegation, commonly used as a way to grant access to resources without
sharing login credentials. SSO allows users to authenticate once and gain access
to multiple systems.
 Implementation:
o Database User Accounts: Each user has unique credentials to access the
database. These credentials are stored securely, often using hashing algorithms.
o LDAP Integration: Lightweight Directory Access Protocol (LDAP) can be
used to centralize authentication in enterprise environments.
o Encrypted Connections: Secure protocols like SSL/TLS ensure that
authentication data is encrypted during transmission.
 Challenges:
o Password Management: Ensuring users create strong, complex passwords and
regularly update them.
o Phishing and Social Engineering: Attackers may try to trick users into
revealing their credentials.

Faculty of CSE-AI Department

Brainware University, Kolkata
BTech CSE-AIML Semester-3
Database Management Systems (BTA30102)
2025-26 (Odd Semester)

o Brute Force Attacks: Automated attempts to guess passwords require

measures like account lockouts or CAPTCHA.

2. Authorization

 Definition: After a user is authenticated, the next step is to determine what the user is
authorized to do. Authorization is the process of granting or denying specific
permissions to the authenticated user.
 Authorization Models:
o Role-Based Access Control (RBAC):
 Concept: Users are assigned roles, and roles are assigned permissions.
For example, an “admin” role might have full access, while a “viewer”
role has read-only access.
 Advantages: Simplifies management, especially in large organizations,
by grouping permissions into roles.
 Use Cases: Common in enterprise environments where users' access
needs are well-defined.
o Attribute-Based Access Control (ABAC):
 Concept: Permissions are granted based on attributes like user role,
department, location, or even time of day.
 Example: A user may have access to sensitive data only during work
hours from a specific location.
 Flexibility: Highly granular and dynamic but can be complex to
implement and manage.
o Access Control Lists (ACLs):
 Concept: Each resource (like a table or file) has a list specifying which
users or groups have access and what actions they can perform (read,
write, delete, etc.).
 Use Cases: Often used in file systems and networked environments.
o Mandatory Access Control (MAC):
 Concept: A strict policy where a central authority defines access rules.
Users cannot change permissions on resources.
 Use Cases: Common in government and military environments where
strict security is necessary.
o Discretionary Access Control (DAC):
 Concept: The data owner decides who can access the data and what
permissions they have.
 Example: A database table owner can grant read access to specific
users.
 Flexibility: More flexible but less secure compared to MAC.
 Granularity of Authorization:
o Database Level: Access to the entire database.
o Table Level: Access to specific tables within a database.
o Column Level: Access to specific columns within a table, useful for protecting
sensitive information.

Faculty of CSE-AI Department

Brainware University, Kolkata
BTech CSE-AIML Semester-3
Database Management Systems (BTA30102)
2025-26 (Odd Semester)

o Row Level: Access to specific rows based on criteria, often implemented using
policies or filters.
 Challenges:
o Over-Privileged Users: Users having more access than necessary poses
security risks. The principle of least privilege should be enforced.
o Managing Permissions: In large systems, managing user permissions can
become complex.
o Audit and Compliance: Regular audits are needed to ensure that permissions
comply with organizational policies and regulations.

3. Access Control

 Definition: Access control is the overall mechanism that restricts user access to
resources based on authentication and authorization. It enforces who can do what and
under what circumstances.

The security mechanism of DBMS must include some provisions for restricting access to the
data base by unauthorized users. Access control is done by creating user accounts and to
control login process by the DBMS. So, that database access of sensitive data is possible only
to those people (database users) who are allowed to access such data and to restrict access to
unauthorized persons.
The database system must also keep the track of all operations performed by certain user
throughout the entire login time.

 Types of Access Control:

o Discretionary Access Control (DAC): The owner of the resource has full
control over who can access it. It is easy to implement but can be prone to
unauthorized access if permissions are not carefully managed.
o Mandatory Access Control (MAC): The system enforces access control
policies based on data classification and user clearance levels. This model is
highly secure but less flexible.
o Role-Based Access Control (RBAC): Access permissions are based on the
roles that users are assigned. It simplifies access management but may not
provide the necessary granularity for some applications.
o Attribute-Based Access Control (ABAC): Access decisions are based on a
combination of attributes (user role, resource type, environment conditions). It
offers high flexibility but can be complex.
o Rule-Based Access Control: Access is governed by rules set by an
administrator. For example, rules might specify that access is only allowed
during certain hours or from specific IP addresses.
o Time-Based Access Control: Access is restricted to specific times. For
example, certain data might be accessible only during business hours.
 Techniques and Implementations:
o Policies and Permissions: Define who can access what resources and perform
which actions.

Faculty of CSE-AI Department

Brainware University, Kolkata
BTech CSE-AIML Semester-3
Database Management Systems (BTA30102)
2025-26 (Odd Semester)

o Data Masking: Conceals parts of data, making it unreadable to unauthorized

users (useful for protecting sensitive information).
o Database Views: Create views to restrict access to certain columns or rows.
o Encryption: Use encryption to protect data, ensuring only authorized users can
decrypt and access it.
o Auditing and Logging: Record user activities, which helps in monitoring and
detecting unauthorized access.
 Challenges:
o Policy Management: Managing complex access policies can be difficult,
especially in environments with a high number of users and resources.
o Performance: Access control mechanisms can introduce performance
overhead, especially if implemented inefficiently.
o Insider Threats: Even authorized users can pose a threat if they misuse their
access.

Faculty of CSE-AI Department

Brainware University, Kolkata