Database Security | EssayIvy.com

Running head: DATABASE SECURITY 1

Database Security

Student Name

Institutional Affiliation

DATABASE SECURITY 2

Abstract

This paper focuses on various aspects of database security, possible threats with their

solutions, and the advantages of securing a database among other critical issues. A detailed step

by step procedure of securing a database starting from laying proper authentication procedures

that limit the access control to the information stored in database forms the basic part of this

discussion. There various aspects of access control allowed to people in various levels in an

organization depending on the type of information they need to access. To secure a database an

administrator should be aware of all possible threats to the data stored and the general database

software vulnerabilities. These threats should be subjected to Database audition in order to

establish the nature of damage they are likely to cause and how they can be mitigated(Rhodes-

Ousley, 2013). Various aspects of database auditing are hereby discussed in detail. Once all the

initial steps of threat identification are completed, data encryption process is the first step in

securing a database. Here priority issues must be identified depending on the nature of

information stored and the possible threats. Consequently, the process of monitoring the database

and blocking any possible threats is also a key step in ensuring database security. Finally, this

paper explains the various reasons why organization databases should be secured.

Introduction

Database security refers to protective measures and policies adopted to ensure that a

database including the software program and the information stored is free from cybersecurity

threats or unauthorized access. Ensuring database security requires a number of protective

procedures, tools, and other mechanisms within a database system to be properly secured from

any possible damage and malicious attacks(Rhodes-Ousley, 2013). Database security entails

DATABASE SECURITY 3

protection of the information storage components which include the actual data, the servers, the

applications that ensure a smooth workflow of the database, and the Database Management

system. A database administrator is solely responsible for ensuring database security by

implementing the security procedures such as restriction of access through strict multifactor

access mechanisms and the capacity testing procedures to protect the database from crashing in

the event of a Denial of Service (DoS) or system overload(Chakrabarti, 2015). Moreover, the

database administrator is responsible for ensuring that the physical equipment that maintains the

database is secure from any form of damage. Routine testing of any possible vulnerability is also

a part of database security procedures to enable the administrator to develop proper mitigation

plans in the event of an attack.

Authentication

In accessing a database server, an individual has to go through an authentication process

that verifies the identity of the person depending on the degree of access they are requesting.

Proper configuration of the database authentication process prevents easy access by an attacker.

For instance, some databases that store highly sensitive data have implemented multi-level

procedures of authentication of maximizing the degree of security by imposing strict access

requirements incorporating various customized identification features. Basic authentication

requirement for all databases requires strong passwords in the case of the simplest username-

password authentication procedure. This ensures that a password contains at least 8 characters

containing numbers, characters, and even symbols to make the password stronger. Most

DATABASE SECURITY 4

databases have special software to assist in checking the strength of a password and prevent the

repetition of similar passwords or use of a common password.

Access Control

One of the most effective ways of protecting a database is ensuring limited access to the

stored data. Therefore, implementing strict authentication and authorization procedures for each

user accessing the database is very necessary. This is implemented by assigning distinct

usernames and passwords for all people accessing the database. However, the level of access

should vary from one person to another due to the differences in privileges set by the data access

requirements. For this reason, some users are given the read-only access while other users have

full access such that they can manipulate the database content. The differential access control

helps in securing the database such that most attackers who manage to infiltrate the security

levels, they will most probably have read-only access.

Database access control can be primarily implemented in various security levels that

include;

1. Discretionary access control- The level of access varies with the user privileges

depending on some pre-determined discretionary procedures set by an organization. This allows

the users to limit access to data by other users since they are at liberty of adding or removing the

permissions.

2. Content-based access control-This level of access is allowed depending on the

database contents. This level of access, therefore, permits the user to access only content in their

field of specialization.

DATABASE SECURITY 5

3. Fine-grained access control- The user at this level can access and manipulate the

database content in various levels due to their privileges on the database access

4. Mandatory access control- Based on the types of database users and the class of

data objects, the users are categorized in different access classes whose security levels vary

according to either read-only access or read and write access permissions.

Database Threats

According to a recent research, the rate of database access threats has significantly

increased in many organizations. This calls for the implementation of extra security levels on

databases to ensure that data is protected from unauthorized access(Rohilla & Mital, 2013).

Some of the most common database threats include;

a. Excessive access privileges- This becomes a threat once some users are allowed

access greater than their responsibility needs within an organization. The risk in granting

excessive access to a worker in an organization is that they can decide to use the privilege to

steal sensitive company data when not on good terms with the company management.

b. Privilege abuse- Some users with database access in an organization may decide to

misuse the accorded privilege on the data for activities that do not serve interests of the

organization

c. SQL injection- This threat functions by adding some malicious program segments

into the source fields of a database application. This gives the hackers a backdoor access to the

contents of this particular database.

DATABASE SECURITY 6

d. Malware- This refers to some programs used in phishing that is sent to a user email

by a hacker. Once the user opens the link in the email, a manipulative program attaches itself to

the database allowing for further manipulation.

e. Denial of service- This type of attack occurs when a server is overloaded with

queries that occupy much of the database resources thus limiting access to network devices. This

failure makes the database server non-responsive and shuts down the entire system. This is

usually a very serious threat that requires proper mitigation procedures.

Database Auditing

This helps to find the database vulnerabilities existing in the system and developing

proper procedures to fix them(Boshyan et al., 2017). Database auditing can be classified into

various levels as listed below;

• Access and authentication level of auditing that records the logs of all people who

access the database within a specified period of time. This security level displays all details of

the access ranging from the time of access to content accessed and methods used by the user.

• Administrator auditing analyzes the activities by each user and reports all the details

of such activities.

• Security activity monitoring hat keeps a record of the total activity list while sending a

report of any suspicious activity within the database system.

• Auditing of threats and database vulnerability as a key step to identification and fixing

of the security flaws immediately they are identified.

The process of database auditing

DATABASE SECURITY 7

1. Data identification- This process entails identifying of data that requires protection

from threats. Most databases store a wide range of information some of which might not require

multi-level protection(Chaudhari & Bakal, 2015). Therefore, data classification simplifies the

protection procedure.

2. In-built basic Auditing- Most databases have an internal auditing feature that helps to

identify the possible threats and control login data regarding the users. However, the in-built

tools do not perform customized auditing.

3. Use of external auditing software- The use of third-party software to audit databases

through networking helps the user to customize the process and conduct extensive auditing of the

database system. This level of auditing is usually very effective.

Data Encryption

This is a basic step of database protection to ensure both stored data and the information

in the process of transit is secure. This calls for the implementation of various algorithms

depending on the data priority. Some of the algorithms used in data encryption include the DES,

128-bit AES, and the 256-bit AES(Coronel & Morris, 2016). Using secured shell traffic, the data

should be securely transmitted through any encrypted path known as SSH.

Securing a Database

The process of securing a database involves the following steps;

• Determining the actual database to be secured

• Classifying the data depending on the security requirement

DATABASE SECURITY 8

• Screening the database for threats and their possible solutions

• Prioritizing the data that require multi-level protection

• Determining the most effective patches for the system vulnerabilities

• Auditing o confirm the securing process

Monitoring and blocking

• Live threat alerting and blocking- This monitors all the database activity to ensure any

possible data leakage is monitored and controlled as a result of the live alert system(Williams,

2017). If further alerts persist, then the system automatically blocks that specific user.

• Monitoring unusual activity- This monitors all user profiles for any unauthorized

attempt to access sensitive data. Once such a threat is identified, the alert system activates and

blocks that specific user from accessing the content.

• Filtering of user requests- The database system should be programmed to filter and

block all malicious requests to avoid an SQL injection attack(Williams, 2017). Moreover, system

firewalls should be established to monitor all web requests using the HTTP parameters for any

possible malicious access.

• Database monitoring- This is carried out on users such as administrators having full

access to the database to avoid any issues that may compromise them resulting in a database

attack through activities such as phishing.

DATABASE SECURITY 9

• Response timing- The Denial of Service attacks that may end up overloading the

server is monitored through response timer that is implemented to observe and alert in the case of

any event that may shut down the server.

• Activation of connection controls- The rates of connection should be limited to

prevent server overloading in a database system.

Advantages of securing a database

1. A secured database is kept free of attacks from people with malicious intentions who

may compromise the data integrity

2. Securing database prevents attack by viruses and other malware that may damage

data

3. Database protection also entails the physical protection of the equipment against

damage on the servers.

4. Database protection prevents loss of information through errors in the program

implementation and corruption of data files.

Conclusion

The need for secure databases by organizations is the main drive that fuels research on

various threats on the information stored in a database. Due to the sensitivity of some

information, the need to develop mitigation procedures as a protection measure is very essential.

To implement the database security, a detailed process of identification, auditing and fixing of

vulnerabilities must be accomplished. This process requires utmost dedication and efficiency to

guarantee the integrity of information stored in a database.

DATABASE SECURITY 10

There is a great need for database experts who can easily identify the above discussed

depending on the database environment. Unprotected database in an organization can lead to

extensive damage on both the business assets and the organization public image. Database

experts have designed various auditing programs to facilitate the process of risk detection and

alerting for quick solutions and blocking. As a part of the process of securing a database, limiting

access and allowing different levels of access to users depending on their privileges is also

crucial. Database security is an issue of paramount importance in any organization that values

data confidentiality.

DATABASE SECURITY 11

References

Rohilla, S., & Mittal, P. K. (2013). Database Security: Threats and Challenges. International

Journal of Advanced Research in Computer Science and Software Engineering, 3(5).

Rhodes-Ousley, M. (2013). Information security the complete reference. McGraw Hill

Professional.

Boshyan, J., Betz, N., Barrett, L. F., De Vito, D., Fenske, M., Adams Jr, R., & Kveraga, K.

(2017). THREAT-A database of line-drawn scenes to study threat perception. Journal of

Vision, 17(10), 302-302.

Williams, T. D. (2015). The Value of Threat Models in Enterprise Security Testing of Database

Systems & Services.

Chaudhari, M. R. R., & Bakal, J. W. (2015). Overview of Database Auditing for Oracle

Database. Auditing, 4(7).

Coronel, C., & Morris, S. (2016). Database systems: design, implementation, & management.

Cengage Learning.

Chakrabarti, P. P. (2015). Introduction to Database Management Systems.

Place new order. It's free, fast and safe

Paper type

Deadline

Page count

550 words

Total price: $ 15.00

Our customers say

Jeff Curtis

USA, Student

"I'm fully satisfied with the essay I've just received. When I read it, I felt like it was exactly what I wanted to say, but couldn’t find the necessary words. Thank you!"

Ian McGregor

UK, Student

"I don’t know what I would do without your assistance! With your help, I met my deadline just in time and the work was very professional. I will be back in several days with another assignment!"

Shannon Williams

Canada, Student

"It was the perfect experience! I enjoyed working with my writer, he delivered my work on time and followed all the guidelines about the referencing and contents."