Database Security

1
Database Security
2
Database Security

• Database system
• Secure data handling
• Secure connections
• Security policies

3
Database System

• Data
• Database engine
• Query language
• Applications
• Forms
• Reports
• Web interfaces

4
Data

• Data collection techniques
• Data storage architecture
• Data integrity
• Concurrency control
• Access privileges

5
Database Engine

• Data processing method
• Operations
• Built-in functions
• Distributed database
• Data manipulation
• Insert
• Delete
• Update

6
Query Language

• Query format
• Query optimization
• Procedure
• Package

7
Applications

• Forms
• Controlled input
• Reports
• Summary
• Periodic
• On demand
• Web interfaces

8
Secure Data Handling

• Authentication
• Encryption
• Transaction security
• Audit trail
• Physical security
• Secure storage
• Data backup

9
Authentication

• Password
• Challenge question
• Smart card
• Biometrics

10
Encryption

• Symmetric key
• Asymmetric key
• Key management
• PKI

11
Transaction Security

• Reliable connection
• SSL
• Intrusion Detection

12
Audit Trail

• Mandatory transaction logs
• Login logs
• Backup of data changes

13
Physical Security

• Physical access control
• Limited number of people with access
• Policy enforcement

14
Secure Storage

• Data protection using encryption
• Firewall
• DMZ

15
Data Backup

• Remote backup
• Periodic backup
• Disk mirroring for sensitive data
• Data recovery testing

16
Secure Connection

• Wired and wireless
• Protocols
• Monitor for attacks
• Virus
• Denial of service
• Man in the middle
• Trusted IP addresses
• Role-based security
• Port monitoring

17
Security Policies

• Organization-wide implementation
• People buy-in for enforcement
• Periodic review of policies in place