Database Security Quiz
47 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What are the three main areas affected by common database threats?

  • Integrity, Flexibility, Privacy
  • Scalability, Availability, Cost
  • Performance, Accessibility, Security
  • Integrity, Availability, Confidentiality (correct)

Loss of confidentiality occurs when secret information is accessed by unauthorized users.

True (A)

What is the role of a Database Administrator (DBA) in database security?

To grant privileges and ensure overall system security.

The main objective of database security is to protect sensitive data from __________ access.

<p>unauthorized</p> Signup and view all the answers

Which type of access control allows users to manage their own access rights?

<p>Discretionary Access Control (DAC) (D)</p> Signup and view all the answers

Policy management in database security involves setting rules on which data should be available to users.

<p>False (B)</p> Signup and view all the answers

Name one strategy to protect databases from unauthorized access.

<p>Access control.</p> Signup and view all the answers

Match the following threats with their definitions:

<p>Loss of Integrity = Unauthorized changes to data Loss of Availability = Users cannot access data when needed Loss of Confidentiality = Sensitive information is exposed to unauthorized users</p> Signup and view all the answers

Which strategy focuses on managing who can access and modify database information?

<p>Access Control (C)</p> Signup and view all the answers

Inference Control helps prevent unauthorized discovery of private data even when some data is publicly available.

<p>True (A)</p> Signup and view all the answers

What is the primary objective of Flow Control?

<p>To prevent sensitive data from being accessed or leaked to unauthorized users.</p> Signup and view all the answers

Data _____ encodes information to protect it during storage and transmission.

<p>encryption</p> Signup and view all the answers

Match the following strategies with their definitions:

<p>Access Control = Ensures only authorized users can access data Inference Control = Prevents extraction of private info from public data Flow Control = Prevents unauthorized access or leakage of data Data Encryption = Encodes data for secure storage and transmission</p> Signup and view all the answers

Which of the following is an example of Inference Control?

<p>Masking salary data published by departments (D)</p> Signup and view all the answers

Covert channels are intended measures to leak information without anyone noticing.

<p>False (B)</p> Signup and view all the answers

Give an example of Access Control in a university database.

<p>Professors can access and modify grades, while students can only view them.</p> Signup and view all the answers

What is one of the key responsibilities of a Database Administrator (DBA)?

<p>Granting privileges to users (A)</p> Signup and view all the answers

What is the primary purpose of data encryption?

<p>To protect sensitive information from unauthorized access (A)</p> Signup and view all the answers

Mandatory Security Mechanisms (MSM) are flexible and can be adjusted by administrators.

<p>False (B)</p> Signup and view all the answers

A DBA account has the same capabilities as regular database users.

<p>False (B)</p> Signup and view all the answers

What is the role of a database administrator (DBA)?

<p>To manage and control access rights to the database.</p> Signup and view all the answers

What must users do to access the database?

<p>Apply for an account.</p> Signup and view all the answers

Data is encoded using an __________ to make it unreadable.

<p>encryption algorithm</p> Signup and view all the answers

The DBA is responsible for classifying data and users based on their __________.

<p>sensitivity</p> Signup and view all the answers

Match the following security methods with their characteristics:

<p>Discretionary Security Mechanisms = Controlled by administrators, flexible access rights Mandatory Security Mechanisms = Strict rules based on data sensitivity Database Administration = Managing user permissions and security Data Encryption = Transforming data into a secure format</p> Signup and view all the answers

Match the following DBA account capabilities with their descriptions:

<p>Account Creation = Controls access to the DBMS system Privilege Granting = Gives specified roles and resource access Privilege Revocation = Removes access when necessary Security Level Assignment = Determines access to confidential data</p> Signup and view all the answers

Which of the following is an example of a discretionary security mechanism?

<p>A professor modifying course grades (C)</p> Signup and view all the answers

What is essential for ensuring that only authorized personnel can access the database?

<p>User accounts and login procedures (A)</p> Signup and view all the answers

Revoke access is a function of the DBA that is rarely used.

<p>False (B)</p> Signup and view all the answers

Data flow control is unnecessary for data transmission security.

<p>False (B)</p> Signup and view all the answers

What does the DBMS do to verify a user's access?

<p>Verifies the account ID and password.</p> Signup and view all the answers

Why is data encryption important during online purchases?

<p>It protects credit card information from being accessed by unauthorized users.</p> Signup and view all the answers

What is the primary purpose of system logs?

<p>To record every action performed by users (A)</p> Signup and view all the answers

A database audit is primarily focused on improving database performance.

<p>False (B)</p> Signup and view all the answers

What command is used to grant privileges on a database object?

<p>GRANT</p> Signup and view all the answers

An audit trail is also referred to as a _____ in a database log.

<p>database audit</p> Signup and view all the answers

Match the following commands with their functions:

<p>GRANT = Provide permissions to users REVOKE = Take back permissions from users SELECT = Retrieve data from a database DELETE = Remove data from a database</p> Signup and view all the answers

What might prompt the need for a database audit?

<p>Suspected tampering with the database (C)</p> Signup and view all the answers

The WITH GRANT OPTION allows users to give their granted privileges to others.

<p>True (A)</p> Signup and view all the answers

List two actions that can be granted using the GRANT command.

<p>SELECT, INSERT</p> Signup and view all the answers

What does the GRANT command allow a user to do?

<p>Assign privileges to a database object (B)</p> Signup and view all the answers

The REVOKE command can only take away privileges entirely, not just the ability to grant them to others.

<p>False (B)</p> Signup and view all the answers

What must be specified when using the REVOKE command?

<p>privileges, object, users</p> Signup and view all the answers

In mandatory access control, a user with __________ clearance cannot access secret data.

<p>confidential</p> Signup and view all the answers

Which of the following is NOT an advantage of Discretionary Access Control (DAC)?

<p>It provides rigid security measures (A)</p> Signup and view all the answers

Mandatory Access Control (MAC) offers more flexibility than Discretionary Access Control (DAC).

<p>False (B)</p> Signup and view all the answers

What is the highest security class in the mandatory access control system?

<p>Top Secret</p> Signup and view all the answers

Flashcards

Database Security Systems

Prevents unauthorized access to database information.

Objective of Database Security

Ensures data confidentiality, integrity, and availability.

Loss of Integrity

Unauthorized changes to data by people who shouldn't have access.

Loss of Availability

Preventing authorized users from accessing data when they need it.

Signup and view all the flashcards

Loss of Confidentiality

Revealing private or sensitive information to people who shouldn't see it.

Signup and view all the flashcards

Access Control

A process that regulates who can access what information in a database.

Signup and view all the flashcards

Inference Control

Control mechanisms designed to prevent unauthorized disclosure of sensitive information.

Signup and view all the flashcards

Flow Control

Mechanisms that control the flow of information within a database.

Signup and view all the flashcards

Database Security

Protecting your database against threats like unauthorized access, data leakage, or manipulation.

Signup and view all the flashcards

Data Encryption

Encoding data to protect it during storage and transmission, making it unreadable to unauthorized users.

Signup and view all the flashcards

Covert Channels

Unexpected channels through which sensitive information can leak unnoticed.

Signup and view all the flashcards

Who is the DBA?

The Database Administrator (DBA) is the person responsible for managing and controlling a database system.

Signup and view all the flashcards

What does the DBA do with privileges?

The DBA assigns specific permissions to users based on their roles and responsibilities.

Signup and view all the flashcards

How does the DBA classify data and users?

The DBA categorizes data and users into groups based on their sensitivity level and clearance.

Signup and view all the flashcards

What makes the DBA account special?

The DBA account has special capabilities beyond regular user accounts, including creating accounts, granting and revoking access, and managing security levels.

Signup and view all the flashcards

How does the DBA control access to the database?

The DBA ensures that only authorized users can access the database by creating unique account IDs and passwords.

Signup and view all the flashcards

How does the DBA protect the database?

The DBA manages database security by controlling access, monitoring user accounts, and auditing database activities.

Signup and view all the flashcards

What is discretionary authorization?

Discretionary authorization refers to the process of granting and revoking access to specific resources based on user roles.

Signup and view all the flashcards

What is mandatory authorization?

Mandatory authorization is a system that restricts access to information based on pre-defined security levels, regardless of individual user permissions.

Signup and view all the flashcards

What is Data Encryption?

A security method that transforms sensitive data into an unreadable format, requiring a key for decryption.

Signup and view all the flashcards

Decryption

The process of converting encoded data back into its original form using the decryption key.

Signup and view all the flashcards

Discretionary Security Mechanisms (DSM)

Security mechanisms controlled by administrators, allowing them to assign specific access rights (read, insert, delete, update) to different users.

Signup and view all the flashcards

Mandatory Security Mechanisms (MSM)

Security mechanisms controlled by predefined rules based on data sensitivity and user clearance levels.

Signup and view all the flashcards

What is Database Security?

Preventing unauthorized access to and misuse of sensitive data stored in databases.

Signup and view all the flashcards

What is a database log?

A detailed record of all actions performed on a database, including user logins, data updates, deletions, and queries.

Signup and view all the flashcards

What is a database audit?

A review of database logs over a specific time period to verify all database activities.

Signup and view all the flashcards

What is discretionary access control?

A process that allows database administrators to grant and revoke specific permissions or privileges to users or groups on database objects.

Signup and view all the flashcards

What is the GRANT command?

A command used to grant specific privileges to users on database objects, allowing them to perform certain actions.

Signup and view all the flashcards

What is the REVOKE command?

A command used to revoke previously granted privileges from users on database objects.

Signup and view all the flashcards

What is an audit trail?

A security measure that tracks all database actions, providing a record of who did what and when. This record is often used for auditing purposes.

Signup and view all the flashcards

Why are system logs important for security?

A system log is important for security because it helps track all database activity for auditing and troubleshooting purposes.

Signup and view all the flashcards

When are database audits used?

Database audits are performed when tampering with the database is suspected.

Signup and view all the flashcards

GRANT Command

A SQL command that grants specific privileges to a user, allowing them to perform operations like SELECT, INSERT, and UPDATE on a database object. It can also be used to grant the user the ability to delegate these privileges to others.

Signup and view all the flashcards

REVOKE Command

A SQL command that revokes previously granted privileges from a user, preventing them from performing operations on a database object.

Signup and view all the flashcards

WITH GRANT OPTION

An optional clause in the GRANT and REVOKE commands that enables a user to delegate the granted privileges to other users.

Signup and view all the flashcards

Mandatory Access Control (MAC)

A security model where data and users are categorized based on their sensitivity levels. Access is granted only to those with appropriate security clearances.

Signup and view all the flashcards

Discretionary Access Control (DAC)

A security model where the owner of a database object has the authority to determine who can access it and what privileges they have.

Signup and view all the flashcards

Flexibility (DAC Advantage)

The ability to customize access controls according to specific needs and requirements.

Signup and view all the flashcards

Security Sensitivity in MAC

Data and users are classified based on their security sensitivity.

Signup and view all the flashcards

User Access Control in MAC

A user can only access data if their security level is appropriate.

Signup and view all the flashcards

Study Notes

Database Security

  • Database security involves legal, ethical, policy, and technical dimensions
  • Legal and ethical considerations ensure only authorized users access sensitive information
  • Policy management establishes rules for confidential data
  • Technical aspects involve setting up security at different system levels (hardware, OS, DBMS) to prevent unauthorized access and breaches

Common Threats

  • Loss of Integrity: Unauthorized or incorrect modifications to data
  • Loss of Availability: Legitimate users cannot access required data due to blocking
  • Loss of Confidentiality: Sensitive information is accessed by unauthorized individuals

Strategies to protect Databases

  • Access Control: Only authorized users can access data
  • Inference Control: Prevents users from discovering secret information from available data
  • Flow Control: Manages data paths to prevent unauthorized access
  • Data Encryption: Protects data during storage and transmission, so only authorized users can read it

Access Control

  • Objective: Ensure only authorized users access the database
  • How it works in databases: Setting up rules and permissions to restrict unauthorized access.
  • Methods: Using user IDs and passwords to manage permissions
  • Example: University database allows professors to modify grades, while students can only view them.

Inference Control

  • Definition: Prevents extraction of private information from publicly available data
  • Importance: Prevents unauthorized discovery of private data
  • Example: Salary data is published without naming individuals.
  • Inference Control: Mask or aggregate data to prevent guessing individual salaries.

Flow Control

  • Definition: Measures to prevent unauthorized data access.
  • Covert Channels: Unexpected ways information leaks
  • Importance: Preventing sensitive data leakage outside authorized pathways
  • Example: Employee uses a shared printer to view restricted documents

Data Encryption

  • Definition: Method to protect sensitive data (e.g., credit card numbers)
  • How it works: Data is transformed into a secure format that can only be accessed with a special key (encryption and decryption).
  • Importance: Protects sensitive information during transmission, preventing unauthorized access and theft
  • Example: Online purchases encrypt credit card information during transmission.

Types of Database Security Mechanisms

  • Discretionary Security Mechanisms (DSM): Flexible, controlled by administrators. Allows assignment of specific access rights to users
  • Example: Professor can modify course grades, but a student can only view them.
  • Mandatory Security Mechanisms (MSM): Strict, controlled by predefined rules. Enforces rules based on data sensitivity and user clearance levels
  • Example: Classified information requires matching security clearance for access.

Database Security and the DBA

  • Definition of DBA: Central authority for managing a database system
  • Key Responsibilities
    • Granting privileges: Assigning permissions to users based on roles
    • Classifying data and users: Organizing data and users based on sensitivity and clearance levels.
  • DBA is responsible for overall database security.

Access Control, User Accounts, and Database Audits

  • DBA manages security using Access Control, User Accounts, and Database Audits
  • User Account Creation: Unique account ID and password for each user
  • Login Process: Users log in with their credentials, DBMS verifies
  • Database Audits: Track database activities (e.g., login, updates, deletions); aids in security and error diagnosis/recovery
  • Database log, audit trail

Discretionary Access Control

  • Discretionary access control is based on the granting and revoking of privileges
  • Grant Command (e.g., GRANT privileges ON object TO users [WITH GRANT OPTION])
  • Revoke Command (e.g., REVOKE [GRANT OPTION FOR] privileges ON object FROM users)

Mandatory Access Control

  • A stricter security measure
  • Data and users are classified based on security sensitivity
  • Users can only access data with matching security levels
  • Top Secret (TS), Secret (S), Confidential (C), Unclassified (U). TS > S ≥ C ≥ U

Comparing Discretionary and Mandatory Access Control

  • Discretionary Access Control (DAC):
    • Advantages: Flexible, customizable, easily adapt to different applications
    • Disadvantages: Security risks due to potential vulnerabilities to attacks
  • Mandatory Access Control (MAC):
    • Advantages: High degree of security, prevents unauthorized data flow
    • Disadvantages: Can be rigid, may not be suitable for dynamic environments

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Related Documents

IS 221 Database Management Lecture 8 PDF

Description

Test your knowledge on key concepts of database security. This quiz covers various strategies to protect sensitive data, the role of a Database Administrator, and access control mechanisms. Enhance your understanding of how to safeguard databases from common threats.

More Like This

Use Quizgecko on...
Browser
Open
Browser
Browser