Database Security Management

Database Security Management

• 1.
  Presentation to: Mam HinaAkram 1
• 2.
  Group Members • AhsinYousaf • Adnan Hussain • Usman Jamil • Ayesha Afzal • L1F17MSCT0047 • L1F17MSCT0051 • L1F17MSCT00 • L1F17MSCT00
• 3.
  OUTLINE  Overview ToDatabaseSecurity.  What is Database Security  Why need of database security.  Concepts of Database Security.  Security Problems  Security Controls 2
• 4.
  Mobile Computer Vehicles OVERVIEW Intoday’s world,we need everything secured whetherit is your mobile phone ,computer ,vehicle or almost anything. 3
• 5.
  What is database security? 5 Database: Itis a collection of information stored in a computer. Security: It is being free from danger. Database Security: It is the mechanisms that protect the database against intentional or accidental threats.
• 6.
  Database Security is definedas the process by which “Confidentiality, Integrity and Availability” of the database can be protected Definition of Database Security 6
• 7.
  If there isno security to database what happens??? Data will be easily corrupted 7 It is important to restrict access to the database from authorized users to protect sensitivedata. Why need of database security?
• 8.
  Three are 3main aspects 1. Secrecy or Confidentiality 2. Integrity 3. Availability 8 Concepts of Database Security
• 9.
  SECRECY/  It isprotecting the database from unauthorized users.  Ensures that users are allowed to do the things theyare trying to do.  Encryption is a technique or a process by which the data is encoded in such a way that only that authorized users are able to read the data. 9
• 10.
  INTEGRITY 1 0  Protecting thedatabase from authorized users.  Ensures that what users are trying to do is correct. For examples,  An employee should be able to modify his or herown information.
• 11.
  AVAILABILITY 10 Database must havenot unplanned downtime. Toensure this ,following steps should be taken Restrict the amount of the storage space given to each user in the database. Limit the number of concurrent sessionsmade available to each database user. Back up the data at periodic intervals to ensure data recovery in case of application users.
• 12.
  SECURITY PROBLEMS 12
• 13.
  Any circumstance orevent with the potential to adversely impact an IS through unauthorized access, destruction, disclosure, modification of data, and/or denial of service. There are two kinds of threat. Non-fraudulent Threat fraudulent Threat 13
• 14.
  1. Non-fraudulent Threat 14 Natural or accidental disasters.  Errors or bugs in hardware or software.  Humanerrors. 2. fraudulentThreat  Authorized users  Those who abuse their privileges andauthority.  Hostile agents  Those improper users (outsider orinsiders).  who attack the software and/or hardware system, or read or write data in adatabase.
• 15.
  DATABASEPROTECTION REQUIREMENTS 15 1. Protection fromImproperAccess 2. Protection from Inference 3. Integrity of the Database 4. User Authentication 5. Multilevel Protection 6. Confinement 7. Management and Protection of SensitiveData
• 16.
  SECURITY CONTROLS 15
• 17.
   Authorization -privileges, views.  Encryption - public key / private key,secure sockets.  Authentication –passwords.  Logical - firewalls, net proxies. 17
• 18.
  AFIREWALLis dedicated softwareon another computer which inspects network traffic passing through it and denies (or) permits passage based on set of rules. Basically it is a piece of softwarethat monitors all traffic that goes from your system to another via the Internet or network and ViceVersa Database Firewalls are a type of Web Application Firewalls that monitor databases to identify and protect against database specific attacks that mostly seek to access sensitive information stored inthe databases. 18
• 19.
  19
• 20.
   Data encryptionenables to encrypt sensitive data, such as credit card numbers, stored in table columns.  Encrypted data is decrypted for a database user who has access to the data.  Data encryption helps protect data stored on media in the event that the storage media or data file gets stolen. 20
• 21.
   As asecurity administrator, one can be sure that sensitive data is safe in case the storage media or data file gets stolen.  You do not need to create triggers or views to decrypt data. Data from tables is decrypted for the database user.  Database users need not be aware of the fact that the data they are accessing is stored in encrypted form. Data is transparently decrypted for the database users and does not require any action on their part.  Applications need not be modified to handle encrypted data. Data encryption/decryption is managed by the database. 21
• 22.
   Read authorization- allows reading, but not modification of data  Insert authorization - allows insertion of new data, but not modification of existing data.  Update authorization - allows modification, but not deletion of data.  Delete authorization - allows deletion of data 22
• 23.
  23