SECURITY PART II:

AUDITING DATABASE
SYSTEMS
Two General Approaches to Data
Management

 1. Flat-File Approach
 most often associated with so-called legacy systems
 promotes a single-user view approach to data management whereby end users own their data files
rather than share them with other users.

The replication of essentially the same data in multiple files is called data redundancy and contributes to
three significant problems in the flat-file environment:
 Data storage
 Data updating
 Currency of information
 Task-data dependency
 Figure 4.1
Flat-File Model
Two General Approaches to Data
Management

 2. Database Approach
 Access to data resource is controlled by a database management systems (DBMS).
 DBMS – a special software system that is programmed to know which data elements
each user is authorized to access
Through data sharing, the traditional problems associated with the flat-file approach may be
overcome:

 Elimination of Data Storage Problem Elimination of Data Update Problem

 Elimination of Currency Problem Elimination of Task-Data Dependency
 Figure 4.2
Database Model
 Key Elements of the Database
Environment
 1. Database Management Systems (DBMS)
 central element of the database approach
 provides a controlled environment to assist access to the database and to efficiently manage the
data resource

Typical Features:
a. Program development
b. Backup and recovery
c. Database usage reporting
d. Database access
 Figure 4.3
Elements of the Database
Concept
 Key Elements of the Database
Environment

 Data Definition Language (DDL)

 programming language used to define the database to the DBMS
 has 3 levels (called views): physical internal view, conceptual view, and user view

Internal view – lowest level of representation, which is one step removed from the physical
database

Conceptual view (Schema) – describes the entire database

– represents the database logically and abstractly, rather than the way it is physically stored
User view (Subschema) – defines the user’s section of the database
 Figure 4.4
Overview of DBMS
Operation
 Key Elements of the Database
Environment
 2. Users
 Formal Access: Application Interfaces
 Informal Access: Query Language

Data Manipulation Language (DML) – proprietary programming language that a particular DBMS uses to retrieve, process,
and stores data

Query – an ad hoc access methodology for extracting information from a database

Structured Query Language (SQL) – fourth-generation, non-procedural language with many commands that allow users to
input, retrieve, and modify data easily.

The SELECT command is a powerful tool for retrieving data.

 Figure 4.5
Example of
SELECT
Command
Used to Query
an Inventory
Database
 Key Elements of the Database
Environment

 3. Database Administrator (DBA)

- In large organizations, DBA function may consist of an entire department of technical personnel under the
database administrator.
The duties of DBA fall into the following areas:
 Database planning Database growth and change
 Database design Database implementation, operation, and maintenance

Data dictionary – describes every data element in the database

– enables all users (and programs) to share a common view of the data resource, thus greatly facilitating the
analysis of user needs
Table 4.1 Functions of Database
Administrator
 Figure 4.6
Organizational
Interactions of the
Database Administrator
 Key Elements of the Database
Environment
 4. Physical Database
 lowest level of database approach and the only level that exists in physical form
 consists of magnetic spots on metallic coated disks

Data structures– the bricks and mortar of the database

– allows records to be located, stored, and retrieved

Data organization – refers to the way records are physically arranged on the secondary storage device
– either sequential or random

Data access methods – techniques used to locate records and to navigate through the database
 DATABASE MODEL
- A data model is an abstract representation of the entities, including resources, events and
agents and their relationship in an organization.

3 COMMON MODELS OF DBMS

• HIERARCHICAL
• NETWORK
• RELATIONAL
HIERARCHICAL MODEL

Thiswas a popular method of data

representation because it reflected,
more or less faithfully, many aspects
of an organization that are
hierarchical in relationship.
NETWORK MODEL

 Like the hierarchical model, the network

model is a navigational database with
explicit linkages between records and files.
 Most
popular example of network model is
IDMS (integrated database management
system).
 RELATIONAL MODEL
The formal model has its
foundations in relational algebra
and set theory, which provide the
theoretical basis for most of the data
manipulation operations used.
CENTRALIZED
DATABASES
DISTRIBUTED DATABASES

PARTITIONED OR
REPLICATED
PARTITIONED DATABASES
Splits the central database into
segments or partitions that are
distributed to their primary users.
The Deadlock Phenomenon
In a distributed environment, it is
possible for multiple sites to look
out to each other from the database,
thus preventing each from
processing its transactions.
Deadlock Resolution
Some of the factors that are considered:
 The resources currently invested in the
transaction.
 The transactions stage of completion.
 The number of deadlocks associated
with the transaction.
 REPLICATED DATABASE

A database approach in which the central

database is replicated at each site

Effectivein companies with a high degree of

data sharing but there is no primary user
 REPLICATED
DATABASE
Ensures data access Causes difficulty in
for query purposes maintaining current
Minimizes lockouts versions of the
and delays due to database at each
data traffic site
 CONCURRENCY CONTROL

A system that ensures that transactions

processed at each site are accurately
reflected in the databases at all other sites
 CONCURRENCY CONTROL

A system that ensures that transactions

processed at each site are accurately
reflected in the databases at all other sites
CONTROLLING AND
AUDITING DATABASE
MANAGEMENT
SYSTEMS
 ACCESS CONTROLS

Controls that ensure that only authorized

personnel have access to the firm’s assets
Are designed to prevent unauthorized
individuals from viewing, retrieving,
corrupting, or destroying the entity’s data
 BACKUP CONTROLS

Controls that ensure that in the event of

data loss due to unauthorized access,
equipment failure, or physical disaster,
the organization can recover its files and
databases
 ACCESS CONTROL RISKS IN THE
SHARED DATABASE ENVIRONMENT

Corruption of data
Theft of data
Misuse of data
Destruction of data
 1. USER VIEWS
DATABASE
2. DATABASE
CONTROL AUTHORIZATION
FEATURES TABLE
3. USER-DEFINED
THAT MITIGATE PROCEDURES
ACCESS 4. DATA ENCRYPTION
CONTROL 5. BIOMETRIC DEVICES
RISKS 6. INFERENCE
CONTROLS
DATABASE CONTROL FEATURES
THAT MITIGATE ACCESS
CONTROL RISKS
1. USER VIEW (SUBSCHEMA)
 A subset of the total database that defines
the user’s data domain and provides access
to the database
 The database administrator is primarily
responsible for defining user views.
DATABASE CONTROL FEATURES
THAT MITIGATE ACCESS
CONTROL RISKS
2. DATABASE AUTHORIZATION TABLE
 A table containing rules that limit the
actions a user can take
DATABASE CONTROL FEATURES
THAT MITIGATE ACCESS
CONTROL RISKS
3. USER-DEFINED PROCEDURES
 Procedure that allows the user to create a
personal security program.
 It provides a more positive user
identification than a single password.
DATABASE CONTROL FEATURES
THAT MITIGATE ACCESS
CONTROL RISKS
4. DATA ENCRYPTION
 Use of an algorithm to scramble selected
data, making it unreadable to an intruder
browsing the database
 DATABASE CONTROL FEATURES THAT
MITIGATE ACCESS CONTROL RISKS

5. BIOMETRIC DEVICES
 Devices that measure various personal
characteristics, such as finger, voice, or retina
prints, or other signature characteristics.
 DATABASE CONTROL FEATURES THAT
MITIGATE ACCESS CONTROL RISKS

6. INFERENCE CONTROLS
 Controls that prevent users from inferring
specific data values that they are
unauthorized to access through query
features
TYPES OF DATABASE COMPROMISES THAT
INFERENCE CONTROLS ATTEMPT TO
PREVENT
POSITIVE NEGATIVE APPROXIMATE
The user The user The user is able to
determines the determines that a estimate the value
specific value of a data item does not of a data item with
data item. have a specific sufficient accuracy.
value.
 BACKUP  GPC BACKUP
CONTROLS IN TECHNIQUE
THE  DIRECT
FLAT-FILE
ACCESS FILE
ENVIRONMENT
BACKUP
 OFF-SITE STORAGE

Storage procedure used to safeguard the

organization’s critical resources
Backup files created under either of the
two approaches should be stored off-site
in a secured location.
BACKUP CONTROLS IN THE
DATABASE ENVIRONMENT
BACKUP CONTROLS IN THE
DATABASE ENVIRONMENT
 BACKUP: Makes a periodic backup of
the entire database.
 TRANSACTION LOG (JOURNAL):
Provides an audit trail of all processed
transactions.
 BACKUP CONTROLS IN
THE
DATABASE ENVIRONMENT
 CHECKPOINT FEATURE: Suspends
all data processing while the system
reconciles the transaction log and the
database change log against the
database.
 BACKUP CONTROLS IN
THE
DATABASE ENVIRONMENT
 RECOVERY MODULE: Uses the logs
and backup files to restart the system
after a failure.
 “If you’re not willing to learn, no one
can help you. If you’re determined to
learn no one can stop you.”

THANKS FOR LISTENING!

ALOC, MARY MICHELLE
FALLENA, MARY ROSE
MERCADO, ALMIRA