IT203 Unit 9: Database Security II Is It Secure? Copyright © 2012 Pearson Education, Inc. Publishing as Prentice HallChapter8.1.

Slides:



Advertisements
Similar presentations
Chapter 1 The Study of Body Function Image PowerPoint
Advertisements

1 Copyright © 2010, Elsevier Inc. All rights Reserved Fig 2.1 Chapter 2.
IT203 Unit 8: Database Security I Is It Secure? Copyright © 2012 Pearson Education, Inc. Publishing as Prentice HallChapter8.1.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
IT203 Unit 3: Database Design
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Jeopardy Q 1 Q 6 Q 11 Q 16 Q 21 Q 2 Q 7 Q 12 Q 17 Q 22 Q 3 Q 8 Q 13
Jeopardy Q 1 Q 6 Q 11 Q 16 Q 21 Q 2 Q 7 Q 12 Q 17 Q 22 Q 3 Q 8 Q 13
Title Subtitle.
Statistics for Managers using Microsoft Excel 6th Edition
CHAPTER 8 The Buying Process and Buyer Behavior.
Copyright © 2010 Pearson Education, Inc. Publishing as Prentice Hall Chapter 5 The Voice of the Customer.
The Office Procedures and Technology
Information Systems Today: Managing in the Digital World
ABC Technology Project
INSERT BOOK COVER 1Copyright © 2011 Pearson Education, Inc. Publishing as Prentice Hall. Exploring Microsoft Office Excel 2010 by Robert Grauer, Keith.
Chapter 4 Database Design Chapter4.1 Copyright © 2014 Pearson Education Inc.
15-1 Copyright © 2013 Pearson Education, Inc. publishing as Prentice Hall Chapter 15 Money and Banking.
The Revenue Cycle: Sales to Cash Collections
© Copyright by Deitel & Associates, Inc. and Pearson Education Inc. All Rights Reserved. 1 Tutorial 12 – Security Panel Application Introducing.
© 2012 National Heart Foundation of Australia. Slide 2.
Skills for Success with Microsoft® Office 2010
Project 6: Working with If Statements Essentials for Design JavaScript Level One Michael Brooks.
25 seconds left…...
Chapter Ten Marketing Communications and Customer Response.
Chapter 9 Understanding Work Teams
We will resume in: 25 Minutes.
International Opportunities
Chapter 12: Project Management and Strategic Planning Copyright © 2013 Pearson Education, Inc. publishing as Prentice Hall Chapter
The Human Resources Management and Payroll Cycle
Statistically-Based Quality Improvement
Chapter 11 Describing Process Specifications and Structured Decisions
Retail Organization and Human Resource Management
20-1 Retail Mgt. 11e (c) 2010 Pearson Education, Inc. publishing as Prentice Hall Integrating and Controlling the Retail Strategy RETAIL MANAGEMENT: A.
 Copyright © 2010 Pearson Education, Inc. Publishing as Prentice Hall Chapter 14 Managing Quality Improvement Teams and Projects.
Organizational Culture, Creativity, and Innovation Chapter Copyright © 2011 Pearson Education, Inc. Publishing as Prentice Hall.
Financial Merchandise Management
With Microsoft Access 2010© 2011 Pearson Education, Inc. Publishing as Prentice Hall1 PowerPoint Presentation to Accompany GO! with Microsoft ® Access.
With Microsoft Excel 2010 © 2011 Pearson Education, Inc. Publishing as Prentice Hall1 PowerPoint Presentation to Accompany GO! with Microsoft ® Excel 2010.
1 Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. by Mary Anne Poatsy, Keith Mulbery, Eric Cameron, Jason Davidson, Rebecca Lawson,
With Microsoft ® Office 2010© 2011 Pearson Education, Inc. Publishing as Prentice Hall1 PowerPoint Presentation to Accompany GO! with Microsoft ® Office.
Copyright © 2011 Pearson Education, Inc. Publishing as Prentice Hall Process Specifications and Structured Decisions Systems Analysis and Design, 8e Kendall.
Getting Started Chapter One DAVID M. KROENKE and DAVID J. AUER DATABASE CONCEPTS, 5 th Edition.
Getting Started with Microsoft SQL Server 2012 Express Edition Appendix A DAVID M. KROENKE and DAVID J. AUER DATABASE CONCEPTS, 6 th Edition.
By Mary Anne Poatsy, Keith Mulbery, Eric Cameron, Jason Davidson, Rebecca Lawson, Linda Lau, Jerri Williams Chapter 10 Using Macros and SQL in Access 1.
Copyright ©2014 Pearson Education, Inc. Chapter 8 Is it Secure? Chapter8.1.
Copyright ©2014 Pearson Education, Inc. Chapter 3 Requirements and Business Rules Chapter3.1.
Getting Started with Oracle Database 11g Release 2 Express Edition Appendix B DAVID M. KROENKE and DAVID J. AUER DATABASE CONCEPTS, 6 th Edition.
Copyright © 2011 Pearson Education, Inc. Publishing as Prentice Hall.
Getting Started Chapter One DAVID M. KROENKE and DAVID J. AUER DATABASE CONCEPTS, 6 th Edition.
INSERT BOOK COVER 1Copyright © 2011 Pearson Education, Inc. Publishing as Prentice Hall. Exploring Microsoft Office Access 2010 by Robert Grauer, Keith.
Copyright © 2010 Pearson Education, Inc. Publishing as Prentice Hall 1 Committed to Shaping the Next Generation of IT Experts. Chapter 1: Finding Your.
1 Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. by Mary Anne Poatsy, Keith Mulbery, Lynn Hogan, Amy Rutledge, Cyndi Krebs, Eric.
INSERT BOOK COVER 1Copyright © 2011 Pearson Education, Inc. Publishing as Prentice Hall. Exploring Microsoft Office Excel 2010 by Robert Grauer, Keith.
INSERT BOOK COVER 1Copyright © 2011 Pearson Education, Inc. Publishing as Prentice Hall. Exploring Microsoft Office Excel 2010 by Robert Grauer, Keith.
GO! with Office 2013 Volume 1 By: Shelley Gaskin, Alicia Vargas, and Carolyn McLellan Access Chapter 3 Forms, Filters, and Reports.
© 2011 Pearson Education, Inc. Publishing as Prentice Hall 1 Chapter 14 Using Relational Databases to Provide Object Persistence (Overview) Modern Database.
Integrating Word, Excel,
Getting Started Chapter One DAVID M. KROENKE and DAVID J. AUER DATABASE CONCEPTS, 4 th Edition.
© 2012 Pearson Education, Inc. publishing Prentice Hall. Note 9 The Product Life Cycle.
Chapter 3 Requirements and Business Rules Copyright © 2012 Pearson Education, Inc. Publishing as Prentice HallChapter3.1.
© 2013 Pearson Education, Inc. Publishing as Prentice Hall1 with Microsoft ® Office for Mac 2011 Common Features Using the Common Features of Microsoft.
© 2012 Pearson Education, Inc. publishing Prentice Hall. Note 16 What is a Marketing Strategy?
Copyright © 2011 Pearson Education, Inc. Publishing as Prentice Hall Process Specifications and Structured Decisions Systems Analysis and Design, 8e Kendall.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
PT2520 Unit 9: Database Security II
PT2520 Unit 8: Database Security I
Getting Started Chapter One DATABASE CONCEPTS, 5th Edition
Getting Started Chapter One DATABASE CONCEPTS, 4th Edition
Presentation transcript:

IT203 Unit 9: Database Security II Is It Secure? Copyright © 2012 Pearson Education, Inc. Publishing as Prentice HallChapter8.1

Analyzing Security Needs One way to analyze the security needs of a database is to look at the security requirements of each type of database user. You can analyze those needs in terms of specific permissions on tables and objects. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.2

Analysis Example Table nameSELECTINSERTUPDATEDELETEConstraints Student TutorX A public subset of tutor info CourseX StudentCourse Ethnicity SessionXX* *Only for own sessions RequestX RequestNoteX Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.3

Threat Analysis Threat analysis involves identifying all the ways a database can be harmed and then finding strategies to mitigate those threats. Databases can also be damaged by accidental actions. Analyzing threats is a complex and ongoing task. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.4

Threat Analysis Example RoleStudent ThreatDescription SELECTSee private information of other students INSERTFalse or inaccurate information in Student table UPDATE False or inaccurate information in the Session table, removing other students from scheduled sessions DELETE-- Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.5

Disaster Recovery Disaster recovery means planning for the worst. Disasters can be manmade, such as an attack by a hacker, or a major mistake by an administrator. Disasters can also be natural. Fires, floods, and earthquakes can destroy data. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.6

Disaster Recovery Plan A disaster recovery plan is a plan for how to recover data and its availability after various possible disasters. A disaster recovery plan consists of policies and procedures for disaster prevention and recovery. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.7

Policies Policies are rules for how to do things. For instance, a business could have a rule that all databases are backed up twice a day. Another policy could be that all backups are kept off site in some secure place. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.8

Procedures Procedures are step-by-step instructions for how to do things. In a disaster plan, procedures are the step-by-step instructions for implementing a policy. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.9

Backup Procedure Example Maintain four portable hard drives. Each morning, retrieve the two drives with the oldest backup date. Perform a full database backup to one of the drives at 11:00 AM. Backup the log files to the hard drive. Record the current date and time of the backup on the hard disk. Send an employee to deposit the hard drive in a safety deposit box at Westlake Security Co. At closing, around 5:00 PM, do a full backup to the second hard disk. Back up the log files to the hard disk. Record the date and time on the hard disk. Send an employee to deposit the hard drive in a safety deposit box at Westlake Security Co. (Westlake is open until 7 PM.) If Westlake is closed the employee is to take the disk home and deposit it when he or she drives in to work the next work day. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.10

Finding Solutions Implementing effective security measures can be very complex. You can use a mixture of schema roles and permissions. One approach is to build a layer of views and stored procedures to manage all user access. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.11

Views Views are essentially stored queries. Ideally, each view corresponds to a particular view that a user has of the data. Views can be used to hide the underlying structure of the database. Views are accessed just like tables. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.12

Syntax for a View CREATE VIEW AS Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.13

View Example CREATE VIEW vw_Sessions AS SELECT TutorLastName AS [Tutor], StudentKey AS [Student], SessionDateKey AS [Date], SessionTimeKey AS [Time], CourseKey AS [Course] FROM Tutor t INNER JOIN [Session] s ON t.TutorKey=s.TutorKey WHERE SessionDateKey >=GetDate() Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.14

Stored Procedures Stored procedures consist of one or more SQL commands. They can take parameters from the user. They allow all the commands to be executed as a unit. They allow error checking and validation to help ensure a safe transaction. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.15

Stored Procedure Syntax CREATE PROC AS Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.16

Stored Procedure Example CREATE PROCEDURE nchar(10) AS IF EXISTS (SELECT * FROM student WHERE BEGIN SELECT studentLastName FROM Student WHERE END Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.17

A Few Stored Procedure Notes The following slides discuss a few of the features of stored procedures, specifically: – Parameters – Variables – If/else and blocks – Transactions and try/catch blocks Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.18

Parameters A parameter is a value passed to the stored procedure from the user. Parameters are listed after the CREATE statement and before the AS. All parameters start with symbol and must be given a data nchar(10) Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.19

Variables Variables are declared after the AS keyword and must be assigned values internally. Variables are declared with the DECLARE keyword. Variables can be assigned values with the SET or SELECT keywords. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.20

Variable Examples NCHAR(10) FROM [Session] WHERE AND Date Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.21

IF, ELSE, BEGIN, END It is possible to select among possibilities by using the IF and ELSE keywords. IF sets up the condition and what to do if the condition is true. ELSE describes what to do if the condition is false. BEGIN is used to mark the start of an IF or ELSE block. END is used to mark the end of the block. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.22

If Example IF EXISTS (SELECT * FROM student WHERE BEGIN SELECT studentLastName FROM Student WHERE END Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.23

TRY CATCH TRANS TRY CATCH blocks can be used with transactions to catch any errors. The TRY tests the code for errors. If there are no errors, the statements are committed to the database. If there are errors, the execution will go to the CATCH block and roll back the transaction. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.24

TRY CATCH Example BEGIN TRAN BEGIN TRY UPDATE [Session] SET WHERE AND COMMIT TRAN END TRY BEGIN CATCH ROLLBACK TRAN END CATCH Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.25

Documentation It is crucial to document the security setup. Authentication types and policies should be spelled out. All roles and schema should be described. All stored procedures and views should be described. Disaster plans and all policies and procedures should be documented and readily available. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall Chapter8.26

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher. Printed in the United States of America. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall