SECURITY II

Question 1

Describe authorization and authentication

Answer 1

The granting of a right or privilege that enables a subject to have legitimate access to a system or a system’s object is called Authorization. Authorization controls can be built into the software, and govern not only what system or object a specified user can access, but also what the user may do with it. The process of authorization involves authentication of user/program requesting access to Database objects

A mechanism that determines whether a user (he/she) claims to be part of Database system is called Authentication. A system administrator is usually responsible for allowing users to have access to a computer system by creating individual user accounts.
Each user is given a unique identifier, which is used by the operating system to determine who they are. Associated with each identifier is a password, chosen by the user and known to the operating system, which must be supplied to enable the operating system to verify (or authenticate) who the user claims to be.

Question 2

Describe Access controls

Answer 2

Access Control is a privilege which allows a user to create or access (i.e., read, write, or modify) some database object (such as a relation, view, or index) or to run certain DBMS utilities. As excessive granting of unnecessary privileges can compromise security. A privilege should only be granted to a user if that user cannot accomplish his or her work without that privilege. The DBMS subsequently keeps track of how these privileges are granted to other users, and possibly revoked, and ensures that at all times only users with necessary privileges can access an object.

Some of the Access Controls are:
Discretionary Access Control (DAC): . The SQL standard supports DAC through the GRANT and REVOKE commands. The GRANT command gives
privileges to users, and the REVOKE command takes away privileges.
Mandatory Access Control (MAC): It is based on system-wide policies that cannot be changed by individual users. In this approach each database object is assigned a security class and each user is assigned a clearance for a security class, and rules are imposed on reading and writing of database objects by users.

Question 3

Describe views as a security measure

Answer 3

A view is the dynamic result of one or more relational operations operating on the base relations to produce another relation. A view is a virtual relation/table that does not actually exist in the database, but is produced upon request by a particular user, at the time of request. The view mechanism provides a powerful and flexible security mechanism by hiding parts of the database from certain users. The user is not aware of the existence of any attributes or rows that are missing from the view. A view can be defined over several relations with a user being granted the appropriate privilege to use it, but not to use the base relations

Question 4

Describe backup and recovery

Answer 4

The process of periodically taking a copy of the database and log files on to offline storage media is called Backup. DBMS should provide backup facilities to assist with the recovery of a database following failure. It is always advisable to make backup copies of the database and log files at regular intervals and to ensure that the copies are in a secure location. In the event of a failure that renders the database unusable, the backup copy and the details captured in the log file are used to restore the database to the latest possible consistent state.

The process of keeping and maintaining a log file (or journal) of all changes made to the database to enable recovery to be undertaken effectively in the event of a failure is called Journaling. A DBMS should provide logging facilities, sometimes referred to as journaling, which keep track of the current state of transactions and database changes, to provide support for
recovery procedures. The advantage of journaling is that, in the event of a failure, the database can be recovered to its last known consistent state using a backup copy of the database and the information contained in the log file. If no journaling is enabled on a failed system, the only means of recovery is to restore the database using the latest backup version of the database.

Question 5

What does the cryptosystem include?

Answer 5

• An encryption key to encrypt the data (plaintext).
• An encryption algorithm that, with the encryption key, transforms the plaintext into cipher-text.
• A decryption key to decrypt the cipher-text.
• A decryption algorithm that, with the decryption key, transforms the cipher-text back into plaintext

Question 6

Give four possible countermeasures to ab SQL injection attack

Answer 6

1. Validate User Inputs
   A common first step to preventing SQL injection attacks is validating user inputs. First, identify the essential SQL statements and establish a whitelist for all valid SQL statements, leaving unvalidated statements out of the query. This process is known as input validation or query redesign.
2. Sanitize Data By Limiting Special Characters
   Another component of safeguarding against SQL injection attacks is mitigating inadequate data sanitization. Because SQLi attackers can use unique character sequences to take advantage of a database, sanitizing data not to allow string concatenation is critical.
3. Enforce Prepared Statements And Parameterization
   It’s critical organizations also use prepared statements with parameterized queries, also known as variable binding, for writing all database queries. By defining all SQL code involved with queries, or parameterization, you can distinguish between user input and code.
4. Use Stored Procedures In The Database
   Similar to parameterization, using stored procedures also requires variable binding. Unlike the prepared statements approach to mitigating SQLi, stored procedures reside in the database and are called from the web application. Stored procedures are also not immune to vulnerabilities if dynamic SQL generation is used
5. Actively Manage Patches And Updates
   Like so many cybersecurity threats, it’s vital organizations stay in tune with the most recent news and apply patches and updates as soon as practical. For SQLi purposes, this means keeping all web application software components, including database server software, frameworks, libraries, plug-ins, and web server software, up to date.