Untitled Quiz

Database Security and Auditing - Chapter 1: Security Architecture

• Objectives: Define security, describe information systems and their components, define database management system functionalities, outline the concept of information security, identify major components of information security architecture, define database security, list types of information assets and their values, describe security methods.

Security

• Database security: The degree to which data is fully protected from tampering or unauthorized acts.
• Includes: Information system and information security concepts.

Information Systems

• Wise decisions require: Accurate and timely information and information integrity.

• Information system: Components working together to generate accurate information.

• Categorized by usage:

  • Expert systems (ESS) — Long-term goals
  • Decision support systems (DSS) — Middle-level management
  • Management information systems (MIS) — Middle-level management
  • Transaction processing systems (TPS) — Lower-level management

• Components include: Data, Procedures, Hardware, Software, Network, People

Database Management

• Essential for information system success.

• DBMS functionalities:

  • Organize data
  • Store and retrieve data efficiently
  • Manipulate data (update/delete)
  • Enforce referential integrity and consistency
  • Enforce and implement data security policies and procedures
  • Back up, recover, and restore data

• DBMS components include: Data, Hardware, Software, Networks, Procedures, Database servers

Information Security

• Information is a valuable asset.
• Information security: Procedures and measures to protect information systems components.
• C.I.A. triangle: Confidentiality, Integrity, Availability.
• Security policies need balance.

Confidentiality

• Addresses: Prevention of unauthorized access and information disclosure based on classification.
• Classification levels: (e.g., Unclassified, External in-confidence, Internal in-confidence, Restricted, Classified)

Integrity

• Consistent and valid data: Processed correctly, yields accurate information.
• Information has integrity if:
  • It is accurate
  • It has not been tampered with
  • Read consistency: Each user sees only their changes and others committed.

Availability

• Systems must be available: To authorized users.
• Systems determine: User access to information.
• Reasons for system unavailability:
  • External attacks and lack of protection
  • System failure (lack of disaster recovery)
  • Overly stringent/obscure security policies
  • Poorly implemented authentication

Information Security Architecture

• Protects: Data and information
• Overall design: Company's implementation of the C.I.A. triangle
• Components include: Policies, procedures, security staff, detection equipment, security programs, monitoring equipment, auditing procedures & tools.

Database Security

• Enforce security: At all database levels.
• Security access point: Location where database security must be protected and applied.
• Data needs highest protection: Data access points should be small.
• Reducing access point size: Reduces security risks.
• Security gaps, vulnerabilities, threats: Points of missing security, system flaws, and potential breaches, respectively.

Database Security Levels

• Relational database: A collection of related data files.
• Data file: A collection of related tables.
• Table: A collection of related rows (records).
• Row: A collection of related columns (fields).

Menaces (Threats) to Databases

• Security vulnerability: Weakness in any information system component.
• Categories of database security vulnerabilities:
  • User mistakes
  • Software issues
  • Design and implementation flaws
  • Installation and configuration errors
• Security threat: Security violation or attack due to a vulnerability.
• Categories of database security threats:
  • People issues
  • Technological disasters
  • Malicious code
  • Natural disasters
• Security risk: Known security gap intentionally left open.

Asset Types and Their Value

• Security measures based on asset value.
• Types of assets: Physical, Logical, Intangible, Human

Security Methods

• Methods to protect components: (Examples in Table 1-6)

Database Security Methodology

• Database security implementation methodology (Example in Figure 1-16)

Summary

• Security: Level and degree of being free from danger and threats.
• Database security: Degree to which data is protected from unauthorized tampering.
• Information systems: Backbone of daily company operations.
• DBMS: Programs to manage databases.
• C.I.A. triangle: Confidentiality, Integrity, Availability.
• Secure access points, vulnerabilities, threats & risks: Important components for overall security.
• Information security architecture: A model protecting logical and physical assets.