19DBSecurity

Database Security

Outline

What is Database Security ?
Threats
Countermeasures
Authorization and authentication
Access Control
Encryption

Database security, means protection of a database against unauthorized access, either intentional or unintentional.

Database security requires the mechanisms, that protect a database against the intentional or accidental threats. Such mechanisms affect hardware, software, people and data.

Database security protects against: theft and fraud, Theft and fraud happens, when data is taken from a database without a permission and when false data is sold instead of the original one.

Database security protects against: Loss of confidentiality. Loss of confidentiality happens, when confidential data is revealed to the public.

Database security protects against: Loss of privacy. Loss of privacy happens, when personal data is revealed to the public.

Database security protects against: Loss of integrity. Loss of integrity happens, when data is modified in a way, that violates the logical consistency constraints.

Database security protects against: Loss of availability. Loss of availability happens, when data is intentionally or unintentionally permanently deleted from a database or when, access to data is sabotaged through utilization of the technical weaknesses of a database system.

What is Database Security

Database security means protection of a database against unauthorized access, either intentional or unintentional
Database security requires the mechanisms, that protect a database against the intentional or accidental threats
Such mechanisms affect the hardware, software, people, and data components of a database management system
Database security protects against:
- Theft and fraud,
- Loss of confidentiality
- Loss of privacy
- Loss of integrity
- Loss of availability

Database Security

A threat is a situation or event, whether intentional or accidental, that may adversely affect a database system. Sample threats include the following real wold situations.

Unauthorised amendment or copying of data. It happens when, a random user makes the unauthorised modifications of data or copies data to unprotected locations.

Using another person's means of access. It happens when, a password is leaked or stolen and it allows an unauthorised user to access confidential data.

Program alteration. It happens when a programmer intentionally incorporates into the implemented software a bug that can be used to skip the access control systems.

Wire tapping. It happens when, a transmission of data is recorded by electronic means, also called as data sniffing.

Illegal entry by a hacker. It happens when, a hacker discovers a weak password and he/she uses the password to a access a database system.

Blackmail. It happens when, a database administrator is blackmailed by the criminals.

Theft. It happens when, the passwords to the database administration accounts and other user accounts are paper recorded and a document with the passwords is stolen.

Failure of security mechanisms. It happens when, a database system has a software bug, that allows a potential hacker to pass through the data access protections.

And the others …

There are many, many other threats, whose source is the human dishonesty on a side of the intruders and the human naivety on the side of database users and administrators.

Threats

A threat is any situation or event, whether intentional or accidental, that may adversely affect a system
Sample threats:
- Unauthorized amendment or copying of data
- Using another person's means of access
- Program alteration
- Wire tapping
- Illegal entry by hacker
- Blackmail
- Theft
- Failure of security mechanisms
- And the others …

Database Security

Outline

What is Database Security ?
Threats
Countermeasures
Authorization and authentication
Access Control
Encryption

Counter measures to the threats to database systems, range from the physical controls to the administrative controls. It is good to remember, that the security of Database Management System (DBMS) is as good as the security of an operating system running DBMS.

The following are the computer-based security controls in a multiuser environment:

Authorisation and authentication. Authorisation and authentication restrict the total number of users who have access to a database system.

Access control. Access control allows for identification to those who have acccess to what data and in which mode.

Encryption. Encryption hides data in the case of an accidental disclosure or theft.

Views. Relational views allow for categorisation of users and access modes.

Backup and recovery. Backup and recovery mechanisms, provide a chance to restore accidentally or intentionally deleted data,

Integrity. The mechanisms enforcing logical consistency constraints protect data integrity against accidental or intentional corruption.

Countermeasures

Countermeasures range from the physical controls to the administrative controls
Security of Database Management System (DBMS) is as good as security of an operating system running DBMS
We consider the following computer-based security controls in a multiuser environment
- Authorization and authentication
- Encryption
- Views
- Backup and recovery
- Integrity

Database Security

Outline

What is Database Security ?
Threats
Countermeasures
Authorization and authentication
Access Control
Encryption

Authorization and authentication

Authorization means granting a right or a privilege to have a legitimate access to a system or the resources operated by a system
Authorization is usually built into the software and it determines what system or object a user can access and what a user is allowed to do with it
In a process of authorization a subject representing a user or a program requests and obtains access to an object, that represent relational table, relational view, etc
A process of authorization requires authentication of a subject

Authorization and authentication

Authentication is a mechanism, that determines whether a user is who he or she claims to be
A system administrator is responsible for allowing the users to have access to a computer system by creating the individual user accounts
When an account is created a user is given a unique identifier and a user picks a password associated with the identifier
To reduce the total number of user names and passwords it is possible to authenticate user's access to a database system through earlier authentication of access to an operating system
Such solution is not as safe as two separate passwords and it is consistent with a principle saying, that simplification of data access always reduces data security

Database Security

Outline

What is Database Security ?
Threats
Countermeasures
Authorization and authentication
Access Control
Encryption

A typical way to control access to a database system, is based on granting and revoking privileges. A privilege allows a user to create, to drop or to access in read or write mode some database objects like for example, relational tables, relational views, indexes and the others, to perform certain operations on data.

The minimal set of privileges should be granted to the users to accomplish their tasks.

The excessive set of privileges can compromise the data security.

A user who creates a database object becomes an owner of the object and he/she automatically gets all privileges on the object.

Database Management Systems keeps track of all granted privileges to ensure, that only the authorized users can access and can perform operations on the database objects.

Access Control

A typical way to control access to a database system is based on granting and revoking privileges
A privilege allows a user to create, to drop, or to access in read or write mode some database objects like relational tables, relational views, index, etc or to perform certain operations
The privileges are granted to a user to accomplish their task
The excessive privileges can compromise security
A user who creates a database object becomes an owner of the object and he/she automatically gets all privileges on the object
DBMS keeps track of all granted privileges to ensure that only selected user can access and can perform operations on the database objects

There are two different strategies of access control: Discretionary Access Control (DAC) and Mandatory Access Control (MAC).

In the Discretionary Access Control, each user is given the access rights, also called as privileges, on the specific database objects. A user obtains the privileges when, he she creates an object and the access of other users to the object is at the discretion of the owner. It is an effective system with some weaknesses.

For example, consider the following scenario. A user Alice creates a new relational table: R, and grants write access to such table to a user Bob. A user Bob owns a relational table: S, which is not accessible by a user Alice. A user Alice modifies software used by a user Bob, such that it copies the contents of a table: S, to a table: R. A user Alice returns software used by a user Bob to its original state. The contents of a relational table: S, is available to a user Alice.

Access Control

There are two different strategies of access control:
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
In Discretionary Access Control each user is given the access rights (privileges) on the specific database objects
A user obtains the privileges in a moment when he/she creates an object and the access of other users to the object is at a discretion of an owner
It is an effective system with some weaknesses, for example:
- a user Alice creates a new relational table R and grants write access to such table to a user Bob
- a user Bob owns a relational table S, which is not accessible to a user Alice
- a user Alice modifies a software used by a user Bob, such that it copies the contents of a table S to a table R
- user Alice returns a software used by user Bob to its original state

Access Control

There are two different strategies of access control:
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
Mandatory Access Control is based on system-wide policies that cannot be changed by the individual users
Each database object is assigned a security class and each user is assigned a clearance for a security class and the rules are imposed on reading and writing the database objects by the users
DBMS determines whether a user can read or write a database object based on certain rules, that involve a security level of the object and a clearance of the user

A popular Mandatory Access Control Model is the Bell-LaPadula model, proposed by Bell and LaPadula in 1974.

The model is based on a concept of objects: such as relational tables, relational views, indexes and others and a concept of subjects: such as users, programs and others.

The security classes are attached to the objects and the clearance classes are attached to subjects.

In the present slide a user has a clearence class X.

A database is divided into four security levels: unclassified, confidential, secret and top secret. A clearance class X allows the user to read data from an unclassified level. A clearance class X allows the user to write data to: a confidential, secret and top secret levels. It means that a user, that has a clearance class X can obtain information (read it) only from the levels lower than its clearance class X. However, a user that has a clearance class X can distribute its information (write it) to a level X and all security levels above X.

Note, that a user is not allowed to read from the security levels higher than its clearance level. It seem to be quite obvious, because otherwise a user would get access to information located above its clearance level.

Also note, that a user is not allowed to write to the security levels lower than its clearance levels. Such constraint prevents the leak of information from the higher security levels to the lower security levels.

A diagram in the present slide visualises the security levels and access control rules, for a user at clearence level X.

Access Control

A popular model for MAC is Bell-LaPadula model (Bell and LaPadula 1974)
The model uses the terms of objects (relations, views, indexes, etc), subjects (users and programs), and security classes and clearances

JOIN

The principles of the Bell La Padula Mandatory Access Control model are the following.

Each database object is assigned a security class.

A subject (a user) is assigned clearance class.

The security classes are ordered, from the most secure class to the least secure class, for example, top secret T S, secret S, confidential C, and unclassified U.

A security: class top secret, is higher than a security class: secret.

A security class: secret, is higher than a security class: confidential.

A security class: confidential, is higher than a security class: unclassified.

The Simple Security Property says, that a subject S is allowed to read object O only if a class of subject S is higher than a class of object O.

The Star Property says, that a subject S is allowed to write object O only if class of S is lower or equal to class of object O.

Access Control

The principles of Bell-LaPadula model are the following:
- Each database object is assigned a security class
- Each subject is assigned a clearance class
- The security classes are ordered, with the most secure class and the least secure class, e.g. top secret (TS), secret (S), confidential (C), and unclassified (U)
- TS > S > C > U
- Simple Security Property: A subject S is allowed to read an object O only if class of subject S > class of O
- * Property: A subject S is allowed to write an object O only if class of S ≤ class of O

Database Security

Outline

What is Database Security ?
Threats
Countermeasures
Authorization and authentication
Access Control
Encryption

Encryption

Encryption of data means encoding of data by a special algorithm, that renders the data unreadable by any program without the decryption key
Sensitive data can be encoded to protect it against external threats or access
Some DBMS provide special facilities to encrypt data and to access encrypted data after decoding it
Usually there is a degradation in performance because of time needed to decode data
A typical cryptosystem includes:
- An encryption key to encrypt data (plaintext)
- An encryption algorithm that with the encryption key transfroms plaintext into ciphertext
- A decryption key to decrypt the ciphertext
- A decryption algorithm to use decryption key with cipher text and to create the original plaintext

References

C. Coronel, S. Morris, A. Basta, M. Zgola, Data Management and Security, Chapters 7 and 8, Cengage Compose eBook, 2018, eBook: Data Management and Security, 1st Edition
T. Connoly, C. Begg, Database Systems, A Practical Approach to Design, Implementation, and Management, Chapters 20.1 Database Security, 20.2 Countermeasures - Computer-Based Controls (except 20.2.7), Pearson Education Ltd, 2015