Chapter 13: Data Security & Disaster Recovery Database Management Systems

2 Agenda Data security threat locations & consequences. Data Security Management: Controls Data Security Plan Information Privacy Security in MS Access & SQL Server Global state of data security (PWC survey) Database back-up & recovery Virginia ILIE, Ph.D.

3 Data Security What is happening?  Stolen customer/student/health records.  Online fraud  Corporate espionage  Phising….viruses….how long can this list get? FBI report: 3,000 clandestine organizations in the US with a sole purpose: steal secrets and acquire technology for foreign organizations. Virginia ILIE, Ph.D.

4 Data Security: Threats Location Virginia ILIE, Ph.D.

5 Data Security: Consequences Loss of privacy (personal data) Loss of confidentiality (corporate data) Loss of data integrity Loss of availability Loss of money Above all: Loss of Credibility, Reputation… Virginia ILIE, Ph.D.

6 Authorization table for subjects (e.g. “Salespeople”) Authorization table for objects (e.g. “Orders”) Data Security Controls: Authorization Restrict access to data & actions that people can take on the data. Virginia ILIE, Ph.D.

7 Data Security Controls: Authentication What is authentication?  First line of defense: Passwords.  Two factor authentication–e.g. Token/Card plus PIN.  Three factor authentication–e.g. Token/Card, PIN, biometrics. Advantages and disadvantages of each? Virginia ILIE, Ph.D.

8 Data Security Controls: Encryption - The encoding of the data by a special algorithm that renders the data unreadable by any program without the decryption key. - Commonly used in online transactions. - Two key-encryption: employs a public & private key. Virginia ILIE, Ph.D.

9 Data Security Controls: Non-Computer-Based Controls Physical access controls  Equipment locking, check-out procedures, security cameras Personnel controls  The “Insider threat”  84% of attacks originate from current/former employees (40% originate from hackers). Source: CIO Magazine. Maintenance controls  Maintenance agreements, access to source code, quality and availability standards Virginia ILIE, Ph.D.

10 Client/Server Security Network security controls. Server security controls. Client workstation security controls. Virginia ILIE, Ph.D.

11 Data Security Plan Identify assets and estimate their value: hardware, software, data, networks Threat assessment Vulnerability assessment Calculate the impact of each threat/vulnerability on each asset (qualitatively or quantitatively) Select and apply appropriate controls based on the value of the asset:  Computer-based controls  Non-computer based controls Evaluate effectiveness of the control measures Virginia ILIE, Ph.D.

12 Data Security Plan: Outcomes Managerial Decisions:  Accept the risk  Mitigate the risk  Ignore the risk Virginia ILIE, Ph.D.

13 Security in MS Access: Use of a Password Virginia ILIE, Ph.D.

14 MS Access Permissions Virginia ILIE, Ph.D.

15 MS Access Permissions Virginia ILIE, Ph.D.

16 Security in SQL Server: Permissions Virginia ILIE, Ph.D.

17 Global State of Data Security Global survey of about 8,000 IT & security executives (PricewaterhouseCoopers, 2005, 2006, 2007) 63 countries and 6 continents, 7200 respondents. ____% reported they had a security strategy in place. ____% said they are considering security in the year(s) to come. Virginia ILIE, Ph.D.

18 Security: Strategic vs. Tactical Data Security is a “wildfire”  “ When you spend all that time fighting fires, you don’t even have time to come up with new ways to build things so that they don’t burn down” (Security analyst PWC). Reactive versus Proactive approach to managing data security. Bias toward technology.  Technology is largely reactive! Virginia ILIE, Ph.D.

19 Data Security: Industry Analysis Financial sector versus others. Why the gap? Virginia ILIE, Ph.D.

20 What about Security in India?

Trends  CISOs and CSOs employed continues to rise.  More firms conduct enterprise risk assessments. Encryption is at an all-time high - 72% of firms use it (2007) compared to 48% (2006). Security investment must shift from the tactical, technology- heavy approach to an intelligence-centric, risk analysis and mitigation philosophy. Address the human element not only the technological one. 21 Virginia ILIE, Ph.D.

22 Data Security Many times it is a LEGAL requirement. Sarbanes-Oxley act of 2002 (section 404) Health Insurance Portability and Accountability Act (HIPAA). State Security Breach Notification Laws The Family Educational Rights and Privacy Act (FERPA) Virginia ILIE, Ph.D.

23 Compliance? Percentage of US organizations admitting they are in compliance with security practices in 2006: SOX: 28% HIPAA: 40% California breach notification act: 15% Other state/local privacy regulations: 32% Is the door open for criminal charges & lawsuits & fines & and more? Virginia ILIE, Ph.D.

24 Database Backup & Recovery Backup vs. Recovery  WHY?  Human error or sabotage  Hardware failure  Invalid data  Application program errors  Viruses  Natural disasters and more… Virginia ILIE, Ph.D.

25 Database Backup & Recovery Back-up Strategies:  Full shut-down  Selective shut-down  Incremental back-up Recovering Strategies:  Disk Mirroring: Allows for fastest recovery. Great for applications that require high data availability.  Restore/Rerun Not a very good solution. Virginia ILIE, Ph.D.

26 Database Backup & Recovery Virginia ILIE, Ph.D.

27 Disaster Recovery “The best way of crisis management is preparation” (Mitroff, 2005) Have a clear plan that can be implemented in case of disaster.  Establish secure back-up center at an off-site location.  Schedule periodic back-ups at that location.  Establish recovery team and procedures. Virginia ILIE, Ph.D.

28 Cost of Downtime Estimated cost of downtime by Availability Estimated cost of downtime by type of business Virginia ILIE, Ph.D.

29 Next… Discuss some of the articles related to data security implementation in organizations… Emphasis is on how security controls implementation is managed in organizations. Virginia ILIE, Ph.D.