DATABASE SECURITY - Database Design and Development: An Essential Guide for IT Professionals - page 504

Special procedures. Run a special authentication program and converse with the
user. System sends a random number m to the user. The user performs a simple set
of operations on the random number and types in the result n . System verifies n by
performing the same algorithm on m . Of course, m and n will be different each time
and it will be hard for a perpetrator to guess the algorithm.
Hang-up and call-back. After input of user-id, the system terminates the input and
reinitiates input at the workstation normally associated with that user. If the user
is there at that customary workstation and answers stored questions for the user-id,
then the system allows the user to continue with the transaction.
Role of the DBA
The database administrator plays a pivotal role in security administration. Along
with user representatives and senior management staff including the DA, the DBA
develops a security policy appropriate for the environment. The DBA is the central
authority executing the security policy by setting up user accounts and granting
access privileges. The DBA has a user account that has extensive access privileges
on all of the database objects.
Let us summarize the responsibilities of the DBA.
Creation of new accounts. Assign user-id and password to each user or group of
users.
Creation of views. Create user views as needed for the purpose of tailoring
security provisions for specific user groups.
Granting of privileges. Grant access privileges for users or user groups to perform
database operations on database objects in accordance with security policy.
Revocation of privileges. Cancel access privileges originally assigned to users or
user groups.
Assignments of security levels. Assign user accounts to proper security classifica-
tion for mandatory access control. Designate security levels to database objects.
Maintenance of audit trail. Extend log file record to include updates with user-ids.
Statistical Databases
Statistical databases pose a great and interesting challenge in the matter of data
security. Statistical databases are usually large databases intended to provide
statistical information and not information about individual entities. Statistical
databases may contain data about large populations of entities.
A census database contains information about the people in specific geographic
areas. The database system of a large international bank holds information about
the savings and checking account activities of significant strata of the population.
Databases of large financial institutions contain profiles of investors. Databases used