Authentication and Password Security - Implementing Database Security and Auditing - page 96

Figure 4.1

Authentication as
the base of the
security model.

Also, from your perspective, there really is no difference what identity
method your organization is using, and the differences will be transparent
to the database environment, because they will all be taken care of in lower
levels of the software stack. The identity is merely something that the party
signing on has, and the authentication process is that in which you inspect
what the entity has and decide if this proves that they are who they say
they are.
The first part of this chapter introduces you to the various authentica-
tion categories that the main database vendors support. You will learn what
authentication options make your environment inherently insecure and
what type of authentication options you should consider. You should
always remember that if your authentication setup is insecure, nothing else
matters. Once you understand how to configure for strong authentication,
you will also learn what activities you should perform on an ongoing basis
to ensure that authentication and identities remain secure.

4.1 Choose an appropriate authentication option

Every database has an authentication procedure—the procedure by which
a user is challenged to provide a set of credentials and in which the data-
base verifies whether the user is who they claim to be. Once authenti-
cated, the database knows who the user is and can assign a set of
privileges, but this is already outside the scope of authentication and is
part of the authorization mechanism.