Database Reference
In-Depth Information
to whom and when. Operational and administrative aspects need to be considered.
How do you allocate passwords, maintain them, and preserve confidentiality?
What about physical controls to prevent problems? Should workstations and
servers be guarded with physical lock-and-key schemes? Are hardware controls
available in your environment to be used for database security? Are there security
schemes in the operating system itself? Finally, what are the security provisions
in your DBMS, and to what extent can your environment take advantage of these
provisions?
To come up with solution options, first it will be worthwhile to classify the types
of security problems likely to be encountered. When you are able to classify the
threats, you will be able to find solutions to each type of problem. Broadly, we may
classify the types of security exposure in a database environment as follows:
Natural disasters.
Fire, floods, and other such catastrophes.
Human carelessness.
Unintended damage caused by authorized users, especially
while running jobs in batch.
Malicious damage.
Sabotage, vandalism, actions of malicious programmers, tech-
nical support staff, and persons performing database administration functions.
Crime.
Theft,
embezzlement,
industrial espionage,
and employees selling a
company's secrets and data for mailing lists.
Privacy invasion.
Casual curiosity, data lookup by competitors, obtaining data for
political or legal reasons.
Let us put together the components of the problems of database protection and
summarize the potential threats. Figure 16-2 presents a summary of threats to data-
base security. Note each component showing the type of threat and its source.
Careless
users
Unintentional
damage
Fire
Flood
physical
damage
Disgruntled
professionals
trap
doors
DATABASE
Protected
Area
data
copying
illegal
access
communications
breakdown
Hackers
Industrial
espionage
Vandals
Figure 16-2
Threats to database security.
Search WWH ::
Custom Search