Midterm Flashcards
(83 cards)
Define Database Security:
Protecting the database from unauthorized access, modification, or destruction.
what is a database designers responsibility with data security?
To protect the privacy of individuals about whom data is kept.
What is privacy?
Privacy is the right of individuals to have some control over information about themselves.
What is the CIA model of security and what is stands for?
Confidentiality, which requires that only select authorized users have access to information. Integrity, which requires that only select authorized users be allowed to modify data(maintaining consistency and trustworthiness). Availability, which requires that information be available to select authorized users when needed.
Name 2 of the 6 important laws and standards requiring control on access, disclosure and modifications.
- The Federal Information Security Manage Act(FISMA)
- The European General Data Protection Regulation(DGPR)
- The US Health Insurance Portability and Accountability Act(HIPAA)
- The US Sarbanes-Oxley(SOX) Act
- The US Gramm-Leach-Bliley Act(GLBA)
- The Worldwide Payment Card Industry Data Security Standard(PCIDSS)
What are the two types of security threats?
Accidental and deliberate.
List some example accidental security threats.
An unauthorized user may unintentionally request and be granted an object for which they are not authorized.
etc.
List some example deliberate security threats.
Writing application programs with code that preforms unauthorized operations.
etc.
How should access control methods be defined?
To restrict access to company resources as well as employee and client data.
What is authorization?
Authorization requires defining who has access to the system and the specific data they are allowed to access.
What is user authorization?
A method by which users are assigned rights to use database objects.
What is another phrase for data control language and/or what does it do?
Authorization language, they specify users rights by means of authorization rules. these dictate what information and operations they have access to.
What does the development of an information system access control entail?
Authorization, identification, authentication and accountability
What is a common way users are identified?
A user ID
What is authentication and how is it often done?
The process of verifying the identity of a user through the use of a password or question verification.
What is accountability?
The need to capture and maintain user log files that can be used to retrace a users operations.
What is a security log?
A journal or record of all attempted security violations.
What is an audit trail?
A record of all access to the database included users, operations, locations used and objects interacted with.
What is often used to set up an audit trail?
Triggers
CREATE OR REPLACE TRIGGER EnrollAuditTrail BEFORE UPDATE OF grade ON Enroll FOR EACH ROW BEGIN INSERT INTO EnrollAudit VALUES(SYSDATE, USER, :OLD.stuId, :OLD.ClassNumber, : OLD,grade, \:NEW.grade); END;
What is a privilege?
An action that a user is permitted to preform on a database object such as create or read.
What is the SQL statement to grant a privilege to a user?
GRANT {ALL PRIVILEGES | privilege list}
ON {object-name}
TO {PUBLIC | user-list | role-list} [WITH GRANT OPTION};
How would someone grant multiple privileges to multiple users with the grant option?
GRANT SELECT, INSERT, UPDATE ON Student TO U101, U102 WITH GRANT OPTION;
In a grant diagram or authorization graph, what does a node represent? Double arrowhead? Solid outline?
Each node represents a new combination of privilege and user. A solid outline means a user has received a grant option for that privilege. A double arrowhead means with grant, one means without.
What is a role?
A role can be thought of as a set of operations that should be preformed by an individual or a group of individuals as part of a job.
