Database Security Advanced Database Dr. AlaaEddin Almabhouh

Introduction to DB Security  Secrecy: Users should not be able to see things they are not supposed to.  E.g., A student can’t see other students’ grades.  Integrity: Users should not be able to modify things they are not supposed to.  E.g., Only instructors can assign grades.  Availability: Users should be able to see and modify things they are allowed to.

Access Controls  A security policy specifies who is authorized to do what. [to achieve secrecy, integrity, availability]  A security mechanism allows us to enforce a chosen security policy.  Two main mechanisms at the DBMS level:  Discretionary access control [supported in SQL]  Mandatory access control [does not supported by SQL  OBJECT – SECURITY CLASS; USER – CLEARANCE (SECURITY CLASS)

Data Control Language (DCL)  The Data Control Language (DCL) is a subset of the Structured Query Language (SQL) that allows database administrators to configure security access to relational databases.  DCL consists of only three commands:  GRANT  REVOKE  DENY

GRANT Command  The following privileges can be specified:  GRANT SELECT ON Orders TO Art  GRANT SELECT, INSERT ON Orders, Products TO Bob  GRANT SELECT, UPDATE, DELETE ON Orders, Products TO Smith, Adam GRANT privileges ON object TO users, groups [WITH GRANT OPTION]  can pass to another person The GRANT command is used by database administrators to add new permissions to a database user. It has a very simple syntax, defined as follows:

GRANT Command (cont’d)  If a user has a privilege with the GRANT OPTION, can pass privilege on to other users (with or without passing on the GRANT OPTION ).  GRANT SELECT ON Orders TO Art WITH GRANT OPTION (executed by Joe)  Only owner can execute CREATE, ALTER, and DROP.

GRANT Command (cont’d)  GRANT INSERT, SELECT ON Sailor TO rusty  rusty can query Sailors or insert tuples into it  GRANT DELETE ON Sailors TO Yuppy WITH GRANT OPTION  Yuppy can delete tuples, and also authorize others to do so. Sailor

 GRANT UPDATE (rating) ON Sailors TO guppy  guppy can update (only) the rating field of Sailors tuples.  GRANT SELECT ON ActiveSailors TO Guppy, Yuppy  This does NOT allow them both to query Sailors directly!  REVOKE: When a privilege is revoked from X, it is also revoked from all users who got it solely from X. GRANT Command (cont’d)

GRANT/REVOKE on Views  If the creator of a view loses the SELECT privilege on an underlying table, the view is dropped!  If the creator of a view loses a privilege held with the grant option on an underlying table, (s)he loses the privilege on the view as well; so do users who were granted that privilege on the view!

Views and Security  Views can be used to present necessary information (or a summary), while hiding details in underlying relation(s).  Creator of view has a privilege on the view if (s)he has the privilege on all underlying tables.  GRANT SELECT ON Sailors TO Art WITH GRANT OPTION (executed by Joe)  GRANT SELECT ON Sailors TO Bob WITH GRANT OPTION (executed by Art)  GRANT SELECT ON Sailors TO Art WITH GRANT OPTION (executed by Bob)  GRANT SELECT ON Sailors TO Cal WITH GRANT OPTION (executed by Joe)  GRANT SELECT ON Sailors TO Bob WITH GRANT OPTION (executed by Cal)  REVOKE SELECT ON Sailors FROM Art CASCADE (executed by Joe) Draw a authorization graph

REVOKE command  The following privileges can be specified:  REVOKE SELECT ON Employees FROM Joe  REVOKE SELECT, INSERT ON Orders, Products From Bob  REVOKE SELECT, UPDATE, DELETE ON Orders, Products From Smith, Adam REVOK privileges ON object FROM users, groups The REVOKE command is used to remove database access from a user previously granted such access. The syntax for this command is defined as follows:

DENY command  The following privileges can be specified:  GRANT DELETE ON Employees To Emps  DENY DELETE ON Employees To Joe DENY privileges ON object TO users, groups The DENY command may be used to explicitly prevent a user from receiving a particular permission. This is helpful when a user may be a member of a role or group that is granted a permission and you want to prevent that user from inheriting the permission by creating an exception. The syntax for this command is as follows:

Slide 81 (of 82) Q & A