DBMS Security

What are the 3 issues of DBMS Security?

1. Availability (to authorized users)

2. Confidentiality(data only seen by allowed)

3. Integrity (prevent data corruption)

2 Goals of Availability

1. Making access easy for authorized users

2. Making unauthorized access hard

What is DAC?

Discretionary Access Control- users set rules on who can access their data

What is MAC?

Mandatory Access Control- Access controlled by pre defined rules like in the military

DAC features in SQl are implemented with what and what is the idea behind DAC

views, they give users necessary information without revealing the origin of the data. Form of security by obscurity.

What is the syntax for create user , grant, and revoke?

Create user Mandy identified by 1233423

Grant select on table to public with grant option

Revoke all privileges on table from public.

How is MAC implemented.

Usually as a hierarchy of security classes

What are the two groups in the Bella-LaPadula Model and what does each group have?

1. Subject has clearance

2. Object has classification

What is Bella LaPadula 2 restrictions?

1. Simple Security property (S can only read Y if S(clearance)>= Y(classification)

2. Star property S can only write to Y if S(clearance)<= Y(classification)

What is required to keep confidentiality?

1. Quality Passwords

2. Data encryptions (dig signatures , encrypted keys)

What is the idea of integrity?

Being able to recover DBs after accidents or disasters

What are the 3 approaches to integrity in DBMS security?

1. Maintain offsite backups

2. log DBMS actions

3. use a non zero RAID level

list 2 oracle security features

user auth, DB auditing

What is SQL injection

When a user tries to add SQL into an incomplete query in hopes of getting the DBMS to reveal more info

How to prevent SQL injections, 3 ways

1. Check all user inputs

2. Trim excess characters

3. Only accept Raw input when needed.

How does DAC protect against DoS?

user storage limits and CPU limits

What are some ways SQL limits what a user can do under DAC?

user privileges, roles. views