Edgar Weippl · IGI Global eBooks · 2009
In this article we will present an introduction to issues relevant to database security and statistical database security. We will briefly cover various security models, elaborate on how data analysis in data warehouses (DWH) might compromise an individual’s privacy, and explain which safeguards can be used to prevent attacks. In most companies, databases are an essential part of IT infrastructure since they store critical business data. In the last two decades, databases have been used to process increasing amounts of transactional data, such as, a complete account of a person’s purchases from a retailer or connection data from calls made on a cell phone. As soon as this data became available from transactional databases and online transactional processing (OLTP) became well established, the next logical step was to use the knowledge contained in the vast amounts of data. Today, data warehouses (DWH) store aggregated data in an optimal way to serve queries related to business analysis.
Cited by 0
Edgar Weippl · IGI Global eBooks · 2009
In this article we will present an introduction to issues relevant to database security and statistical database security. We will briefly cover various security models, elaborate on how data analysis in data warehouses (DWH) might compromise an individual’s privacy, and explain which safeguards can be used to prevent attacks. In most companies, databases are an essential part of IT infrastructure since they store critical business data. In the last two decades, databases have been used to process increasing amounts of transactional data, such as, a complete account of a person’s purchases from a retailer or connection data from calls made on a cell phone. As soon as this data became available from transactional databases and online transactional processing (OLTP) became well established, the next logical step was to use the knowledge contained in the vast amounts of data. Today, data warehouses (DWH) store aggregated data in an optimal way to serve queries related to business analysis. In recent years, most people have begun to focus their attention on security. Early OLTP applications were mainly concerned with integrity of data during transactions; today privacy and secrecy are more important as databases store an increasing amount of information about individuals, and data from different systems can be aggregated. Thuraisingham (2002) summarizes the requirements briefly as “However, we do not want the information to be used in an incorrect manner.” All security requirements stem from one of three basic requirements: confidentiality (aka secrecy), integrity, and availability (CIA). Confidentiality refers to the requirement that only authorized subjects, that is, people or processes should be permitted to read data. Integrity means that unauthorized modifications must not be permitted. This includes both modifications by unauthorized people and incorrect modification by authorized users. To correctly perform the services requested, the system needs to remain available; a denial-of-service compromises the requirement of availability. Other security requirements may include privacy, non-repudiation, and separation of duties. These requirements are, however, composite requirements that can be traced back to one of the three basic requirements. Privacy, for instance, is the non-disclosure (=confidentiality) of personal data; non-repudiation refers to the integrity of transaction logs and integrity of origin. Throughout this article we will focus only on technical attacks and safeguards and not on social engineering. Social engineering is often the easiest and, in many cases, a very successful attack vector. For an in-depth coverage of social engineering we recommend (Böck, 2007). In Section 2 we cover the most relevant access control models; in Section 3 we provide an overview of security in statistical databases. Finally, in Section 4 we highlight the essentials of securing not only the transactional and the statistical databases but the entire system.
Cited by 0
George I. Davida, D.J. Linton, C.R. Szelag et al. · IEEE Transactions on Software Engineering · 1978
Databases may be compromised by asking a set of queries which return only statistical information and making inferences about a specific entry from the results of the set of queries. We present methods of constructing the set of queries to compromise a database where all the queries in the set return the maximum of a set of k elements, or all queries return the mean of a set of k elements. In the case of the mean query, all elements involved will be compromised. We also consider bounds on the number of queries required to compromise the database.
Cited by 21
David K. Hsiao, Douglas S. Kerr, Stuart Madnick · Elsevier eBooks · 1979
Cited by 0
Apress eBooks · 2007
Oracle has made numerous enhancements to Oracle Database 11g security. In fact, Oracle has taken security more seriously than ever. Starting with Oracle Database 11g, passwords are now case-sensitive, and the password algorithm has changed to Secure Hash Algorithm (SHA-1) instead of the Data Encryption Standard (DES)-based hash algorithm. There is a significant amount of out-of-the-box security improvements geared to providing a higher sense of security for corporate environments. Oracle Database 11g introduces the concept of tablespace-level encryption to attack the data-at-rest concerns while addressing performance and feasibility concerns. Oracle Database 11g can govern fine-grained network access from the database. Enterprise Manager Database Console fully supports transparent data encryption and the majority of the security features introduced in Oracle Database 11g. Large Objects (LOBs) are completely reengineered for performance and security, including the ability to be encrypted.KeywordsAdvance Encryption StandardData Encryption StandardSecurity SettingOracle DatabaseAccess Control ListThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.
Cited by 0
Chea Yan, Yik Ern, Junhao, Guo · 2020
Cited by 0Open access
Computers & Mathematics with Applications · 1996
Cited by 0
M. Kaufmann, Andreas Meier · 2023
Cited by 0
FERRARI, ELENA · IrInSubria (University of Insubria) · 2009
Cited by 0
FERRARI, ELENA · IrInSubria (University of Insubria) · 2009
Cited by 0
2023
Cited by 0Open access
Karlo Čaić · ODRAZ (University of Zagreb Faculty of Humanities and SocialSciences) · 2017
Moderne baze podataka postoje od 60-ih godina prošlog stoljeća i od tada su promijenile način na koji se odnosimo prema podacima. Usporedno s njima, ljudi su koristili razne sustave kategoriziranja i pohranjivanja podataka. Tek s uvođenje računala se sustav drastično mijenja. Ogromne količine podataka se odjednom mogu spremati, dijeliti i organizirati. Mnogi aspekti modernog života su napredovali ili su nastali zbog postojanja i korištenja baza podataka. Banke lakše mogu spremati podatke o računima, rezervacije za avione je moguće organizirati, i mnoge druge. Kako su se baze podataka razvijale tako su i njihove namjene. Razne moderne tehnologije koriste baze podataka, od strujanja multimedijskih zapisa do pohrane na oblaku, od društvenih mreža do vremenske prognoze. Baze podataka nisu jedine zaslužne za navedene tehnologije ali bez njih su teško zamislive. U ovom radu pokušat ću pojasniti s kojim se sve prijetnjama susreću baze podataka i koji načini obrane postaje.
Cited by 0Open access
D E Denning · Annual Review of Computer Science · 1988
Cited by 1
Jan L. Harrington · Elsevier eBooks · 2016
Cited by 1
Teresa F. Lunt, Eduardo B. Fernández · ACM SIGMOD Record · 1990
article Database security Share on Authors: Teresa F. Lunt Computer Science Laboratory, SRI International, Menlo Park, California Computer Science Laboratory, SRI International, Menlo Park, CaliforniaView Profile , Eduardo B. Fernandez Dept. of Computer Engineering, Florida Atlantic University, Boca Raton, Florida Dept. of Computer Engineering, Florida Atlantic University, Boca Raton, FloridaView Profile Authors Info & Claims ACM SIGMOD RecordVolume 19Issue 4Dec. 1990 pp 90–97https://doi.org/10.1145/122058.122069Published:01 December 1990 21citation3,007DownloadsMetricsTotal Citations21Total Downloads3,007Last 12 Months74Last 6 weeks19 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access
Cited by 27
Cameron Parisi, Samantha Renicker · Advances in Engineering Innovation · 2023
In the modern technological tapestry, the security of database systems has burgeoned into a prominent concern for institutional frameworks. This urgency is invigorated by a dual confluence: the shifting industry paradigm which underscores the primacy of expansive data collections, coupled with the proliferation of legislative frameworks that zealously guard the sanctity of individual consumer data. The core aim of this discourse is to furnish a panoramic understanding of indispensable measures to bolster database security, with an amplified emphasis on countering SQL injection threats. The introductory segment delineates essential fortification strategies and succinctly touches upon optimal practices for shaping a database environments network topography and error mitigation methodologies. Subsequent to this panoramic insight, the discourse pivots to spotlight a diverse array of methodologies to discern and neutralize SQL injection forays.
Cited by 0Open access
Silvana Castano, Mariagrazia Fugini, Giancarlo Martella et al. · 1994
Cited by 414
Elena Ferrari · Encyclopedia of Database Systems · 2018
Cited by 0
Michelle Malcher · Apress eBooks · 2017
Now we are at my favorite part of the book where I recruit you all to switch over to the security side. It is an area that you have to be passionate about because some days there is just one grant too many, but if you are a control freak and like solving puzzles, it is definitely something to consider. Wait, did I just call myself a control freak? Well, most DBAs are, but it is part of our superpowers, and we are just using them on the security side.
Cited by 0
Sabrina De Capitani di Vimercati, Pierangela Samarati, Sushil Jajodia et al. · Encyclopedia of Software Engineering · 2002
Abstract All organizations—depend on computerized information systems for carrying out their daily activities. At the heart of each such information system, there is a database . Typically, a database is built to store logically interrelated data representing some aspects of the real world, which must be collected, processed, and made accessible to a given user population. The database is constructed according to a data model that defines the way in which data and interrelationships between them can be represented. The collection of software programs that provide the functionalities for defining, maintaining, and accessing data stored in a database is called a database management system (DBMS). A database can be seen at different abstraction levels. Typically a three‐level view is adopted containing an internal level , describing the physical storage of the database; a conceptual (or logical ) level , providing the users with a high level description of the real world that the database represents; and an external level , describing the views that different users or applications have on the stored data. Each DBMS must also provide security functionalities to ensure the secrecy , integrity , and availability of the stored data. Providing secrecy means ensuring that data will not be disclosed to unauthorized users. Providing integrity means ensuring that data will not be modified in an unauthorized or improper way. In particular, integrity ensures that the stored data correctly reflect the real world. Providing availability means ensuring that the database will always be accessible by legitimate users for the accesses for which they are authorized. Since a database is ultimately mapped to (i.e., stored as) files of the underlying operating system, one may think that a DBMS does not need to deal with security as security functionalities of the operating system would suffice. This is not true, however, since at the operating system level the data interrelationships and their semantics are lost and therefore security restrictions exploiting concepts of the data model cannot be enforced. Some of the differences between databases and operating systems that make it necessary for a DBMS to support security features are as follows: Protection level object differences data interrelationships dynamic versus static objects lifetime of data user views of data.
Cited by 1