Types Of Security and Integrity Threats | Database Management System
Types Of Security and Integrity Threats |В Database Management System
Types Of Security and Integrity Threats : A database security program should include the regular review of permissions granted to individually owned accounts and accounts used by automated processes. The accounts used by automated processes should have appropriate controls around password storage such as sufficient encryption and access Controls to reduce the risk of compromise.
In addition to features required in the DBMS for Security and integrity, Some extra features have to be supported by the operating System.
In today’s internet environment, data may be accessed by eavesdroppers, wiretappers, and other illegal users. To prevent this type of threat, data transmitted over public communication channels should be in a encrypted form.
In conjunction with a Sound database Security program, an appropriate disaster recovery program should exist to ensure that service is not interrupted during a security incident or any other incident that results in an outage of the primary database environment. An example is that of replication for the primary databases to sites located in different geographical regions. Security and integrity threats can be classified into following two categories:
- Accidental Security and integrity threats
- Intentional or Malicious Security and integrity threats
Accidental Security and integrity Threats
- Unauthorized Access: A user can get access to a portion of the database not normally accessible to that user due to a system error or an error on the part of another user.
- Failures: Failures of various types during normal operation, for example, transaction processing or storage media loss. Proper recovery procedures are normally used to recover from failures occurring during transaction processing.
- Concurrent usage anomalies : Proper Synchronization mechanisms are used to avoid data inconsistencies due to concurrent usage.
- System error : A dial-in user may be assigned the identity of another dial-in user who was disconnected accidentally or who hung up without going through a log-off procedure.
- Improper authorization: The authorizer can accidentally give improper authorization to a user, which could lead to a database security and/or integrity violations.
- Hardware failures: For example, memory protection hardware that fails could lead to software errors and culminate in a database security and/or integrity violation.
Malicious or intentional Security and integrity Threats
- A Computer System operator or System programmer can intentionally bypass the normal security and integrity mechanisms, alter or destroy the data in the database, or make unauthorized copies of sensitive data.
- An authorized user can get access to a secure terminal or the password of an authorized user and Compromise the database. Such users could also destroy the database files.
- Authorized users could pass on sensitive information under influence or for personal gain.
- System and application programmers could bypass normal security in their programs by directly accessing database files and making changes and Copies for illegal use.
- An unauthorized person could get access to the Computer System, physically or by using a communication channel and compromise the database.