Scribd
Upload
8 views

Database Security 1

Uploaded by

chatimuri
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
8 views

Database Security 1

Uploaded by

chatimuri
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 4

Database Security

Database security refers to the measures taken to protect a database from unauthorized access, misuse,
and threats such as cyberattacks, data leaks, and breaches. It ensures confidentiality, integrity, and
availability (CIA) of data stored in the database.

2. Importance of Database Security

• Prevents unauthorized access – Protects sensitive data from cybercriminals.

• Maintains data integrity – Ensures that data is not altered or corrupted.

• Ensures availability – Protects against attacks that can bring the system down.

• Legal and regulatory compliance – Helps organizations adhere to laws like GDPR, HIPAA, and
PCI DSS.

3. Threats to Database Security

Databases face various threats that can compromise data security:

A. External Threats

1. SQL Injection Attacks – Attackers inject malicious SQL queries to manipulate or extract data.

2. Denial of Service (DoS) Attacks – Overloads the database, making it unavailable.

3. Malware and Ransomware – Malicious software that encrypts or damages data.

4. Phishing Attacks – Trick users into revealing database credentials.

B. Internal Threats

1. Insider Threats – Employees or administrators misusing their access.

2. Weak Authentication – Using simple passwords or no multi-factor authentication.

3. Human Errors – Accidental data deletion or misconfigurations.

4. Unauthorized Privilege Escalation – Users gaining higher privileges than assigned.

4. Database Security Models

Security models define how databases enforce access control and security policies.

A. Discretionary Access Control (DAC)

• The database owner assigns permissions.

• Uses Access Control Lists (ACLs) to manage access.

• Flexible but vulnerable to privilege misuse.


• Example: Granting a user access to only specific tables in MySQL.

B. Mandatory Access Control (MAC)

• Access is restricted based on security labels and levels.

• Users cannot change access permissions.

• Commonly used in military and government environments.

• Example: Classifying data as Top Secret, Confidential, Public.

C. Role-Based Access Control (RBAC)

• Access is granted based on the user’s role within the organization.

• Reduces the risk of privilege misuse.

• Example: A database administrator has full access, while employees can only read data.

D. Attribute-Based Access Control (ABAC)

• Access is based on attributes such as user location, device type, time of access.

• Dynamic and flexible security model.

• Example: A user can only access a database during work hours from an office network.

5. Database Security Techniques

A. Authentication and Access Control

1. Strong Passwords & Multi-Factor Authentication (MFA) – Protects database credentials.

2. Role-Based Access Control (RBAC) – Restricts access based on roles.

3. Least Privilege Principle – Users get only the minimum permissions needed.

B. Data Encryption

• At Rest Encryption: Encrypting stored data using AES-256.

• In Transit Encryption: Protecting data in transmission using SSL/TLS.

C. Database Auditing and Monitoring

• Tracks who accessed, modified, or deleted data.

• Uses database logs and Security Information and Event Management (SIEM) systems.

D. Backup and Recovery

• Regular backups prevent data loss in case of cyberattacks or hardware failures.

• Full, incremental, and differential backups are used.


E. Intrusion Detection and Prevention Systems (IDPS)

• Detects and blocks unauthorized access.

• Example: Using Snort IDS for monitoring database activity.

6. Database Security Best Practices

1. Use Firewalls and Network Security Measures – Prevent direct database access from the
internet.

2. Apply Security Patches and Updates – Protect against known vulnerabilities.

3. Limit User Privileges – Follow the Principle of Least Privilege (PoLP).

4. Disable Unnecessary Features – Turn off unused database services.

5. Regular Security Audits – Identify potential security loopholes.

7. Example: Implementing Basic Database Security in MySQL

A. Creating a Secure User with Limited Privileges

sql

CopyEdit

CREATE USER 'secure_user'@'localhost' IDENTIFIED BY 'StrongPassword123!';

GRANT SELECT, INSERT ON company_db.* TO 'secure_user'@'localhost';

FLUSH PRIVILEGES;

• The user secure_user can only read and insert data in company_db.

B. Encrypting Data in MySQL

CREATE TABLE employees (

id INT PRIMARY KEY,

name VARCHAR(100),

salary VARBINARY(255) NOT NULL

);

INSERT INTO employees VALUES (1, 'John Doe', AES_ENCRYPT('5000', 'encryption_key'));

SELECT name, AES_DECRYPT(salary, 'encryption_key') FROM employees;

• Encrypts salary data before storing it.

You might also like