Database Management Systems and Asset Protection

Database Security Overview

• Database security is the degree to which all data is protected from unauthorized access, alteration, or destruction.
• Security violations and attacks are increasing globally.
• Database administrators (DBAs) have responsibilities for designing and implementing new security policies and enforcing stringent security policies.
• Implementing functional specifications, like encrypting data or using data masking, is part of these responsibilities.
• Security measures include preventing physical access to servers, using operating system authentication, and implementing security models.
• The DBA manages databases and enforces security policies to protect data assets.

Database Management System (DBMS) Functionalities

• DBMS functionalities are essential for managing databases successfully.
• Organizing data efficiently, including storing and retrieving data, is a key function.
• Data manipulation (updating, deleting) and enforcing referential integrity and consistency are important.
• Implementing data security policies and procedures is crucial.
• Providing backup, recovery, and data restoration capabilities is essential.

Information Systems

• Information systems comprise components working together to produce accurate information.
• These components include data, procedures, hardware, software, networks, and people.
• Data is collected, and facts are used as inputs for system processing.
• Procedures, including rules and policies, govern how the system operates.
• Hardware includes computer systems and devices like disks and printers.
• Software encompasses application codes, database management systems, and operating systems.
• Networks facilitate communication between different parts of the system.
• People, such as users, managers, and system administrators, are key components.
• Information systems are categorized based on usage, into low-level, mid-level, and high-level systems.

Information Security Concepts

• Information is a valuable asset to an organization.
• Information security comprises procedures and measures protecting information systems.
• The C.I.A. triangle (confidentiality, integrity, and availability) is used to balance security policies.
• Confidentiality ensures only authorized users access information. Companies classify information into levels based on the degree to which confidentiality is required.
• Integrity maintains accuracy and consistency in data and protecting it from alterations.
• Availability ensures authorized users have access to the information system. System problems that prevent authorized users from accessing data, or stop the system altogether, reduces availability.

Information Security Architecture

• Information security architecture protects data and physical assets.
• Components range from physical equipment to logical security tools and utilities, including policies, procedures, personnel, detection equipment, monitoring equipment, applications, and auditing tools.
• Security concerns include privacy laws, social issues, and customer concerns..

Database Security Objectives

• Security measures keep information confidential, ensuring data consistency and high availability.
• Organizations must maintain confidentiality, integrity, and availability of their databases.
• Confidentiality safeguards data privacy by limiting authorized access.
• Integrity maintains data accuracy and consistency.
• Availability ensures that data is accessible to authorized users.

Database Security Levels

• Relational databases contain related data files.
• Data files are collections of related tables.
• Tables are collections of related rows (records).
• Rows are collections of related columns (fields).
• Each level of the database structure can be protected by unique security mechanisms. Database objects such as views can help in the protection of columns or other sensitive data within the database structure.

Menaces to Databases

• Database security vulnerabilities are weaknesses in the system, such as user mistakes, software flaws, design issues, or configuration problems.
• Security threats are security violations or attacks that can happen any time because of a security vulnerability. Threats can come from people, technological disasters, malicious code, or even natural disasters.
• Security risks are known security gaps that are left open in the system.

Asset Types and Their Value

• Assets, including physical, logical, and intangible resources, are protected based on their value to the company. Human skills and expertise fall under this category.
• Physical assets include buildings, vehicles, and hardware.
• Logical assets include applications, programs, and databases.
• Intangible assets include reputation and public confidence.

Security Methods

• Various security methods are implemented to protect database environment components (people, applications, network, operating system, databases, data files).
• Methods for database security include physical limits, authentication, access control, policies, training, single sign-on procedures, firewalls, intrusion detection systems, database authentication measures, and data encryption methods.
• Data validation and constraints further protect data.
• Databases often utilize standard procedures, protocols, and policies alongside more common, "everyday" tools or mechanisms to help prevent and detect security risks.

Database Security Methodology

• The database security process involves phases like planning, analysis, design, implementation, evaluation, and auditing.
• These methods are similar to software engineering methodologies but with a strong focus on security.
• Different steps focus on identification, assessment, design, and implementation of the desired security model, evaluating the system for security gaps, implementing those necessary steps, and periodically evaluating the security system for periodic audits, improvements, or fixes.

Quick Quizzes

• Data is processed and transformed to produce information.
• The concept behind an application is based on a customer ordering a service that a business delivers.
• A security access point is a place where database security must be enforced and maintained.
• A security threat is a security violation that can occur at any time due to a vulnerability.
• A security gap is a point where security is missing.

This quiz explores the essential roles of assets in company operations and the protective measures companies employ to safeguard them. It also delves into the relationship between operating systems and database management systems (DBMS), highlighting their differences and functions. Test your knowledge on security policies and the importance of access restrictions in database environments.