Scribd Logo
Upload

Welcome to Scribd!

  • 4K views

    Week 1 Lecture

    Uploaded by

    Grantham University
    The document discusses database security. It identifies the key components that must be protected, including data, hardware, software, networks, procedures, and users. Security objectives aim to protect these components from vulnerabilities and threats. The document also outlines security functions around confidentiality, integrity and availability of data. It discusses authentication, authorization, access control and auditing as important methods for enforcing database security controls and preventing data breaches. Finally, the document presents a security methodology involving identification, assessment, design, implementation, evaluation and auditing of security policies and components.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content

    You might also like

    Week 1 Lecture

    Uploaded by

    Grantham University
    4K views3 pages
    The document discusses database security. It identifies the key components that must be protected, including data, hardware, software, networks, procedures, and users. Security objectives aim to protect these components from vulnerabilities and threats. The document also outlines security functions around confidentiality, integrity and availability of data. It discusses authentication, authorization, access control and auditing as important methods for enforcing database security controls and preventing data breaches. Finally, the document presents a security methodology involving identification, assessment, design, implementation, evaluation and auditing of security policies and components.

    Original Description:

    IS481 Week 1 Lecture

    Original Title

    Week1Lecture.docx (1)

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document discusses database security. It identifies the key components that must be protected, including data, hardware, software, networks, procedures, and users. Security objectives aim to protect these components from vulnerabilities and threats. The document also outlines security functions around confidentiality, integrity and availability of data. It discusses authentication, authorization, access control and auditing as important methods for enforcing database security controls and preventing data breaches. Finally, the document presents a security methodology involving identification, assessment, design, implementation, evaluation and auditing of security policies and components.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    4K views3 pages

    Week 1 Lecture

    Uploaded by

    Grantham University
    The document discusses database security. It identifies the key components that must be protected, including data, hardware, software, networks, procedures, and users. Security objectives aim to protect these components from vulnerabilities and threats. The document also outlines security functions around confidentiality, integrity and availability of data. It discusses authentication, authorization, access control and auditing as important methods for enforcing database security controls and preventing data breaches. Finally, the document presents a security methodology involving identification, assessment, design, implementation, evaluation and auditing of security policies and components.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    of 3

    Overview

    Whenlookingatsecurityobjectiveswemustidentifythedatawhichmustbe
    protectedandwhyitmustbeprotected.Securityobjectivesneedtoidentifyany
    potentialapplicationdesignproblems.Inthesecurityprocessanorganizationmust
    definethesecurityobjectivesandlocatethesecurityholeswithinanapplication.
    Duringthesecurityplanningprocesstheorganizationwilldevelopsecuritypolicies.

    Ithasbeensaidyoursecurityisasstrongastheweakestlink.Whenlookingat
    securitywemustconsiderallthecomponentsinvolvednotjustthedatabase.The
    componentsofaninformationsystemincludedata,procedures,hardware,software,
    networkandpeople.ThesesystemscanbebrokendownintotheTransaction
    ProcessingSystems(TPSs),DecisionSupportSystems(DSSs),orExpertSystems
    (ESs).

    Securityinlayersprovidesanoverallbenefit.Itisimportanttodesignyoursystem
    withmultiplelayersofsecuritywhereverpossible,sothattheremovalofonelayer
    bycompromiseormisconfigurationdoesnotexposetheentiresystem.Duringour
    coursewewilllookatthevariouscomponentswithsecuritymethodstooffer
    protectionatvariouslayers.

    TheDatabaseManagementSystem
    Thedatabasemanagementsystem(DBMS)isacollectionofprogramsthatmanage
    database.TheDBMSmustprovidefortheorganizationofthedata,storeand
    retrievedataefficientlymanipulatedata(updateanddelete)enforcereferential

    integrityandconsistencyenforceandimplementdatasecuritypoliciesand
    proceduresandbackup,recoverandrestoredata.

    TherequiredcomponentsofaDBMSinordertocompletethesefunctions
    includesthedata,hardware,software,networks,proceduresandthe
    databaseusers.

    SecurityFunctions

    Securityfunctionscanbestrategic,tacticaloroperational.Securityfunctionsare
    implementedintermsoftechnology,processesandpeople.Securityfunctions
    shouldbedocumentedwithaccountabilityagainstorganizationalroles.

    Accountabilityforsecurityfunctionsmaybeconcentratedinasinglesecurity
    group,orallocatedtootherareasthathavecommonobjectives.Forexample,the
    accountabilityforbusinesscontinuitymaybeallocatedtoanoperationalsupport
    group.Asecuritystrategicplanshouldincludeobjectivesforallsecurityfunctions
    regardlessofwheretheyareplacedwithintheorganization

    CIA:Confidentiality,Integrity,Availability

    Confidentialityaddressesthepreventionofunauthorizedaccessandinformation
    disclosurebasedonclassification,Integrityprovidesconsistentandvaliddata
    yieldstoaccurateinformation.Thismeanstheinformationisaccurateandithasnot
    beentamperedwithintentionallyorunintentionally.Availabilitymeansmaking
    surethatasystemmustalwaysbeaccessibletoauthorizedusersandthatitshould
    determinewhatuserscandowiththeinformation.

    DataBreachesandHowtoPreventThem

    Weoftenthinkofthebreachtargetbeingthesensitivecustomerorindividualdata.
    Thedatamightincludethecompanysdigitalcurrency,proprietaryfinancial


    information,andintellectualproperty.Wecanbreakdowndataintopersonally
    identifiableinformation(PII),protectedhealthinformation(PHI)andproprietary
    informationandintellectualproperty
    Authenticationisthetechniqueusedtoproveauseriswhohesaysheis.
    Authorizationenforcementdetermineswhetherthesystemshouldalloworprevent
    usersfromperformingspecificactionsoraccessingspecificdata.Accesscontrol
    determineswhogetsaccesstowhat.Databasesecuritycontrolsenforceaccess
    betweenuseranddata.Theenforcementcontrolsaresupposedtoalignwiththe
    authorizations.Auditingcapturesactionsuccessesandfailuresforaccountability
    purposes.

    SecurityMethodology

    Securitymethodologycanbebrokendownintothesesteps:
    1. Identification
    2. Assessment
    3. Design
    4. Implementation
    5. Evaluation
    6. Auditing

    Securitypolicycomponentsinclude:
    1. Policiesandprocedures
    2. Securitypersonnelandadministrators
    3. Detectionequipment
    4. Securityprograms
    5. Monitoringequipment
    6. Monitoringapplications
    7. Auditingproceduresandtools

    Wewilldiscussthesecuritymethodologiesandcomponentsinvolvedindatabase
    securityasweprogressthroughthecourse.

    You might also like