Midterm Flashcards
Define Database Security:
Protecting the database from unauthorized access, modification, or destruction.
what is a database designers responsibility with data security?
To protect the privacy of individuals about whom data is kept.
What is privacy?
Privacy is the right of individuals to have some control over information about themselves.
What is the CIA model of security and what is stands for?
Confidentiality, which requires that only select authorized users have access to information. Integrity, which requires that only select authorized users be allowed to modify data(maintaining consistency and trustworthiness). Availability, which requires that information be available to select authorized users when needed.
Name 2 of the 6 important laws and standards requiring control on access, disclosure and modifications.
- The Federal Information Security Manage Act(FISMA)
- The European General Data Protection Regulation(DGPR)
- The US Health Insurance Portability and Accountability Act(HIPAA)
- The US Sarbanes-Oxley(SOX) Act
- The US Gramm-Leach-Bliley Act(GLBA)
- The Worldwide Payment Card Industry Data Security Standard(PCIDSS)
What are the two types of security threats?
Accidental and deliberate.
List some example accidental security threats.
An unauthorized user may unintentionally request and be granted an object for which they are not authorized.
etc.
List some example deliberate security threats.
Writing application programs with code that preforms unauthorized operations.
etc.
How should access control methods be defined?
To restrict access to company resources as well as employee and client data.
What is authorization?
Authorization requires defining who has access to the system and the specific data they are allowed to access.
What is user authorization?
A method by which users are assigned rights to use database objects.
What is another phrase for data control language and/or what does it do?
Authorization language, they specify users rights by means of authorization rules. these dictate what information and operations they have access to.
What does the development of an information system access control entail?
Authorization, identification, authentication and accountability
What is a common way users are identified?
A user ID
What is authentication and how is it often done?
The process of verifying the identity of a user through the use of a password or question verification.
What is accountability?
The need to capture and maintain user log files that can be used to retrace a users operations.
What is a security log?
A journal or record of all attempted security violations.
What is an audit trail?
A record of all access to the database included users, operations, locations used and objects interacted with.
What is often used to set up an audit trail?
Triggers
CREATE OR REPLACE TRIGGER EnrollAuditTrail BEFORE UPDATE OF grade ON Enroll FOR EACH ROW BEGIN INSERT INTO EnrollAudit VALUES(SYSDATE, USER, :OLD.stuId, :OLD.ClassNumber, : OLD,grade, \:NEW.grade); END;
What is a privilege?
An action that a user is permitted to preform on a database object such as create or read.
What is the SQL statement to grant a privilege to a user?
GRANT {ALL PRIVILEGES | privilege list}
ON {object-name}
TO {PUBLIC | user-list | role-list} [WITH GRANT OPTION};
How would someone grant multiple privileges to multiple users with the grant option?
GRANT SELECT, INSERT, UPDATE ON Student TO U101, U102 WITH GRANT OPTION;
In a grant diagram or authorization graph, what does a node represent? Double arrowhead? Solid outline?
Each node represents a new combination of privilege and user. A solid outline means a user has received a grant option for that privilege. A double arrowhead means with grant, one means without.
What is a role?
A role can be thought of as a set of operations that should be preformed by an individual or a group of individuals as part of a job.
What is the SQL statement to create a role? How could a privilege be granted to a role?
CREATE ROLE AdvisoryRole;
GRANT SELECT ON Student TO AdvisorRole;
What is the SQL statement to revoke a privilege?
REVOKE INSERT ON Student FROM U101;
How can a privilege revoke cascade?
If a user has a privilege or grant option revoke on a privilege they granted, those subsequent privileges are also revoked.
What is database recovery?
The process of restoring the database to a correct state in the event of a failure.
What is concurrency control?
The ability to manage simultaneous processes involving a database concurrently.
What is a transaction?
An indivisible(atomic) unit of work that contains one or more SQL statements. It is the entire series of steps necessary to accomplish work in order to bring the database to a new consistent state.
What are the two ways a transaction can end/terminate?
The transaction can be committed if successful or aborted and then rolled back if unsuccessful. A committed transaction cannot be rolled back.
How is committed transaction undone?
A compensating transaction(the opposite transaction) is committed.
What is the process of a transaction?
It begins with a begin transaction statement until it reaches an end transaction statement. The dbms then confirms that no concurrency protocol or constraints are violated during the partially committed stage. Then the transaction is committed. An entry log is made of the transaction.
