DB & WebApp Security

Question 1

Main Concepts

Answer 1

Secrecy

Integrity

Availability

Question 2

Secrecy

Answer 2

Users should not be able to see things that they are not supposed to

Question 3

Integrity

Answer 3

Users should not be able to modify things they are not supposed to

Question 4

Availability

Answer 4

Users should be able to see and modify things they are allowed to

Question 5

Encryption

Answer 5

A way of scrambling data so that only authorized parties can understand the information.

Question 6

Symmetric Encryption

Answer 6

Encryption Key = Decryption Key –>All authorized users know decryption key

Question 7

• Public-Key Encryption

Answer 7

o User’s encryption key: public

o User’s decryption key: secret

Question 8

SSL

Answer 8

Secure Sockets Layer

Question 9

Digital Signature

Answer 9

A digital signature is a mathematical technique used to validate the authenticity and integrity of a message, software or digital document. It’s the digital equivalent of a handwritten signature or stamped seal, but it offers far more inherent security.

Question 10

Two Main Security Mechanisms at DBMS Level

Answer 10

Discretionary access control: creator of a table automatically gets all privileges on it

Mandatory access control: Each DB object is assigned a security class

Question 11

GRANT

Answer 11

•	GRANT privileges On object TO users [WITH GRANT OPTION]:
o	SELECT
o	INSERT
o	DELETE
o	REFERENCES

Question 12

Bell-LaPadula Model

Answer 12

Objects
• tables, views, tuples, …
Subjects
• users, user programs, …
Security classes: TS > S> C > U
• Top secret (TS), secret (S), confidential (C), unclassified (U)
Each object and subject is assigned a class
• Simple Security Property:
Subject S can read object O only if class(S) >= class(O))
• *-Property:
Subject S can write object O only if class(S) <= class(O)

Question 13

Bell-LaPadula Model: Intuition

Answer 13

Idea: ensure that
• information can only be read
from higher to lower security levels
• Information can only be written
from lower to higher security level

Question 14

Common Internet Attack

Answer 14

• Spear-phishing : acquire information by masquerading as a trustworthy entity
• Man in the middle: eavesdropping. Victims believe they talk directly to each other
• Watering-hole: Observe sites which group often uses and infect these and infect users as a consequence.

Question 15

SQL Injection

Answer 15

’; DROP TABLE Users; –

Question 16

3P Security Management

Answer 16

Process, People, Probing your defenses