Security Flashcards
Why is data a concern ?
Data is a valuable resource, it should be controlled and managed. most data has customer info, product info analytics.
Security is used to protect against international and accidental threats.
Breaches may affect other components like hardware, software, people
What are the different types of threats ?
Theft and fraud
Loss of confidentiality
Loss of privacy
loss of integrity
Loss of availability
Aims to minimize the losses caused by anticipated events in cost-effective manner without constraining the users
What are threats ?
any situation intentional/ accidental that may adversely affect a system and consequently an organisation
TANGIBLE:
Hardware, Software, Data
INTANGIBLE:
reputation, Client confidence
To mitigate against threats we identify weaknesses , test system security, monitor access.
Write a summary about threats
HARDWARE:
Fire bombs
Data corruption due to power surge
Theft of equipment
DBMS and app software:
Program alteration
Failure of security mechanism
DATABASE:
Theft of data
Data corruption due to power surge
COMMUNICATION NETWORKS:
Wire tapping
Electronic radiation
PROGRAMERS:
Creating trap doors
Program alteration
USERS:
Using other person access
Blackmail
Intro of viruses
what is CounterMeasure- computer based controls
Can include physical control and administrative procedures
Despite these security can only be as good as OS.
There are six measures
What is authorization and authentication ?
- AUTHORIZATION
Granting of rights which enables a subject to legitimately have access to a system or its object(DB, view)
AUTHENTICATION:
A mechanism that determines whether a user is who they claim to be. Password protection, 2 factor authentication
What is access control ?
- ACCESS CONTROL
provide access controls for a DB system based on granting and revoking privileges.
PRIVILIGES allow users to create/access (read/write/modify) or run some DBMS utilities.
Are often granted to a user so they can do their work.
DISCRETIONARY ACCESSS CONTROL(DAC):
Users use GRANT & REVOKE commands for privilege.
MANDATORY ACCESS CONTROL(MAC)
System wide policies that cannot be changes by users.
Each object has a security class and each user has a clearance.
What are views ?
3.VIEWS
A virtual relation that doesn’t exist in DB but is produced upon request by user at time of request.
It can hide parts of DB from certain users.
Can be defined over several relations with users being granted privilege to use.
Users only query and modify data they can see.
What is backup and journaling ?
4.BACKUP
Process of periodically taking a copy of DB log file and possibly programs to offline storage media.
JOURNALING
process of keeping and maintaining a log file of all changes made to DB to enable effective recovery in event of a failure.
What is replica ?
Replica: each node that stores a copy of a DB.
we are given multiple replicas how to be sure data ends on al replicas
solution- leader based replication
What is synchronous and asynchronous replication ?
SYNCHRONOUS:
Ensure leaders are forced to wait until followers are complete before continuing processing writes.
Advantage:
Followers guaranteed up-to-date copy of data.
Disadvantage:
followers not responding, writers cant be processed by leader
ASYNCHRONOUS:
allow leader to proceed processing queries without confirmation from followers.
Advantage:
no waiting for leader for followers to complete replications.
Disadvantage:
if leader fails, no guarantee of a node with most up-to-date copy of data.
What is semi synchronous replication ?
if DB enables sync it means a single follower is sync while others are async.
if sync follower becomes unavailable one of async followers are made sync.
How to set up new follower ?
Copying data from one node to other is insufficient.
Data is always in flux ,standard copies would read diff parts at diff time
Done as follows:
1. Take consistent snapshots of leader DB at some point in time
2.Copy snapshot to follower node
3. Follower connects to leader and request all data changes since snapshot
4.When follower processes backlog, it is said to be caught up
how to handle node outages ?
Any node can fail. Goal is to keep system running despite nodes failing.
FOLLOWER FAILURE(Catch up recovery):
Follower local disk keeps log of data changes from leaders. If follower node fails , they can recover by querying the leader of subsequent changes.
What is leader failure(Failover) ?
once follower needs to be promoted as new leader, client need to reconfigure to send writes to new leader and other followers need to start consuming changes from new leader.
Following steps:
1.Determine if leader has failed: if node doesnt respond it is assumed dead
2. Choosing a new leader: election process or a new leader is appointed by an election controller. Best candidate usually have most up to date changes.
3. Reconfiguring the system: clients now send their write requests to new leader. If old leader comes back it may still believe it is the leader.
