Database security in database management.pptx

Database security in database management.pptx

• 1.
  Database security By –Harsh Kumar 210BBA009
• 2.
  What is Database Security? Database:It is a collection of information stored in a computer. Security: It is being free from danger. Database Security: It is the mechanisms that protect the database against intentional or accidental threats. Def. Database Security is defined as the process by which “Confidentiality, Integrity and Availability” of the database can be protected.
• 3.
  Why need ofDatabase Security? • Compromised intellectual property: Your intellectual property—trade secrets, inventions, proprietary practices—may be critical to your ability to maintain a competitive advantage in your market. If that intellectual property is stolen or exposed, your competitive advantage may be difficult or impossible to maintain or recover. • Damage to brand reputation: Customers or partners may be unwilling to buy your products or services (or do business with your company) if they don’t feel they can trust you to protect your data or theirs. • Business continuity (or lack thereof): Some business cannot continue to operate until a breach is resolved.
• 4.
  Concepts of DatabaseSecurity • Secrecy or Confidentiality • Integrity • Availability Three are 3 main aspects:
• 5.
  Secrecy/ Confidential It is protectingthe database from unauthorized users. Ensures that users are allowed to do the things they are trying to do. Encryption is a technique or a process by which the data is encoded in such a way that only that authorized users are able to read the data.
• 6.
  Integrity Protecting the databasefrom authorized users. Ensures that what users are trying to do is correct. For example, an employee should be able to modify his or her own information.
• 7.
  Availability • Database musthave not unplanned downtime. • To ensure this ,following steps should be taken. • Restrict the amount of the storage space given to each user in the database. • Limit the number of concurrent sessions made available to each database user. • Back up the data at periodic intervals to ensure data recovery in case of application users.
• 8.
  Threats and challenges •Insider threats An insider threat is a security threat from any one of three sources with privileged access to the database: •A malicious insider who intends to do harm •A negligent insider who makes errors that make the database vulnerable to attack An infiltrator—an outsider who somehow obtains credentials via a scheme such as phishing or by gaining access to the credential database itself. Human error • Accidents, weak passwords, password sharing, and other unwise or uninformed user behaviors continue to be the cause of nearly half (49%) of all reported data breaches. • Human error Accidents, weak passwords, password sharing, and other unwise or uninformed user behaviors continue to be the cause of nearly half (49%) of all reported data breaches. • SQL/NoSQL injection attacks A database-specific threat, these involve the insertion of arbitrary SQL or non-SQL attack strings into database queries served by web applications or HTTP headers. Organizations that don’t follow secure web application coding practices and perform regular vulnerability testing are open to these attacks.
• 9.
  Database Security Requirements Protectionfrom Improper Access Protection from Inference Integrity of the Database User Authentication Multilevel Protection Confinement Management and Protection of Sensitive Data
• 10.
  Security Controls Authorization- privileges,views. Encryption - public key / private key, secure sockets. Authentication – passwords. Logical - firewalls, net proxies.
• 11.
  Firewalls Firewall is dedicatedsoftware on another computer which inspects network traffic passing through it and denies (or) permits passage based on set of rules. Basically, it is a piece of software that monitors all traffic that goes from your system to another via the Internet or network and Vice Versa. Database Firewalls are a type of Web Application Firewalls that monitor databases to identify and protect against database specific attacks that mostly seek to access sensitive information stored in the databases.
• 12.
  Abstraction • It enablesto encrypt sensitive data, such as credit card numbers, stored in table columns. • Encrypted data is decrypted for a database user who has access to the data. • Data encryption helps protect data stored on media in the event that the storage media or data file gets stolen.
• 13.
  Advantages of Data Encryption As asecurity administrator, one can be sure that sensitive data is safe in case the storage media or data file gets stolen. You do not need to create triggers or views to decrypt data. Data from tables is decrypted for the database user. Database users need not be aware of the fact that the data they are accessing is stored in encrypted form. Data is transparently decrypted for the database users and does not require any action on their part. Applications need not be modified to handle encrypted data. Data encryption/decryption is managed by the database.
• 14.
  Privileges in Database •Select: allows read access to relation, or the ability to query using the view • Insert: the ability to insert tuples • Update: the ability to update using the SQL update statement • Delete: the ability to delete tuples.
• 15.
  THANK YOU