1. PT2520 Unit 9: Database Security II
Is It Secure?
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

2. Analyzing Security Needs
One way to analyze the security needs of a database is to look at the security requirements of each type of database user.
You can analyze those needs in terms of specific permissions on tables and objects.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

3. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Analysis Example
Table name
SELECT
INSERT
UPDATE
DELETE
Constraints
Student
Tutor X
A public subset of tutor info
Course
StudentCourse
Ethnicity
Session X*
*Only for own sessions
Request
RequestNote
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

4. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Threat Analysis
Threat analysis involves identifying all the ways a database can be harmed and then finding strategies to mitigate those threats.
Databases can also be damaged by accidental actions.
Analyzing threats is a complex and ongoing task.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

5. Threat Analysis Example
Role
Student
Threat
Description
SELECT
See private information of other students
INSERT
False or inaccurate information in Student table
UPDATE
False or inaccurate information in the Session table, removing other students from scheduled sessions
DELETE
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

6. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Disaster Recovery
Disaster recovery means planning for the worst.
Disasters can be manmade, such as an attack by a hacker, or a major mistake by an administrator.
Disasters can also be natural. Fires, floods, and earthquakes can destroy data.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

7. Disaster Recovery Plan
A disaster recovery plan is a plan for how to recover data and its availability after various possible disasters.
A disaster recovery plan consists of policies and procedures for disaster prevention and recovery.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

8. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Policies
Policies are rules for how to do things.
For instance, a business could have a rule that all databases are backed up twice a day.
Another policy could be that all backups are kept off-site in some secure place.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

9. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Procedures
Procedures are step-by-step instructions for how to do things.
In a disaster plan, procedures are the step-by-step instructions for implementing a policy.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

10. Backup Procedure Example
Maintain four portable hard drives.
Each morning, retrieve the two drives with the oldest backup date.
Perform a full database backup to one of the drives at 11:00 AM.
Backup the log files to the hard drive.
Record the current date and time of the backup on the hard disk.
Send an employee to deposit the hard drive in a safety deposit box at Westlake Security Co.
At closing, around 5:00 PM, do a full backup to the second hard disk.
Back up the log files to the hard disk.
Record the date and time on the hard disk.
Send an employee to deposit the hard drive in a safety deposit box at Westlake Security Co. (Westlake is open until 7 PM.)
If Westlake is closed, the employee is to take the disk home and deposit it when he or she drives in to work the next work day.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

11. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Finding Solutions
Implementing effective security measures can be very complex.
You can use a mixture of schema roles and permissions.
One approach is to build a layer of views and stored procedures to manage all user access.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

12. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Views
Views are essentially stored queries.
Ideally, each view corresponds to a particular “view” that a user has of the data.
Views can be used to hide the underlying structure of the database.
Views are accessed just like tables.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

13. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Syntax for a View
CREATE VIEW <ViewName> AS <Select query>
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

14. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
View Example
CREATE VIEW vw_Sessions AS SELECT TutorLastName AS [Tutor], StudentKey AS [Student], SessionDateKey AS [Date], SessionTimeKey AS [Time], CourseKey AS [Course] FROM Tutor t INNER JOIN [Session] s ON t.TutorKey=s.TutorKey WHERE SessionDateKey >=GetDate()
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

15. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Stored Procedures
Stored procedures consist of one or more SQL commands.
They can take parameters from the user.
They allow all the commands to be executed as a unit.
They allow error checking and validation to help ensure a safe transaction.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

16. Stored Procedure Syntax
CREATE PROC <Procedure Name> <Parameter list> AS <SQL statements>
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

17. Stored Procedure Example
CREATE PROCEDURE nchar(10) AS IF EXISTS (SELECT * FROM student WHERE BEGIN SELECT studentLastName FROM Student WHERE END
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

18. A Few Stored Procedure Notes
The following slides discuss a few of the features of stored procedures, specifically:
Parameters
Variables
If/else and blocks
Transactions and try/catch blocks
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

19. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Parameters
A parameter is a value passed to the stored procedure from the user.
Parameters are listed after the CREATE Statement and before the AS.
All parameters start with symbol and must be given a data type:
@studentKey nchar(10)
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

20. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Variables
Variables are declared after the AS keyword and must be assigned values internally.
Variables are declared with the DECLARE keyword.
Variables can be assigned values with the SET or SELECT keywords.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

21. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Variable Examples
NCHAR(10) FROM [Session] WHERE AND Date
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

22. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
IF, ELSE, BEGIN, END
It is possible to select among possibilities by using the IF and ELSE keywords.
IF sets up the condition and what to do if the condition is true.
ELSE describes what to do if the condition is false.
BEGIN is used to mark the start of an IF or ELSE block.
END is used to mark the end of the block.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

23. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
If Example
IF EXISTS
(SELECT *
FROM student
WHERE
BEGIN
SELECT studentLastName
FROM Student
WHERE
END
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

24. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
TRY CATCH TRANS
TRY CATCH blocks can be used with transactions to catch any errors.
The TRY tests the code for errors.
If there are no errors, the statements are committed to the database.
If there are errors, the execution will go to the CATCH block and roll back the transaction.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

25. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
TRY CATCH Example
BEGIN TRAN BEGIN TRY UPDATE [Session] SET WHERE AND COMMIT TRAN END TRY BEGIN CATCH ROLLBACK TRAN END CATCH
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

26. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
Documentation
It is crucial to document the security setup.
Authentication types and policies should be spelled out.
All roles and schema should be described.
All stored procedures and views should be described.
Disaster plans and all policies and procedures should be documented and readily available.
Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall

27. Copyright © 2012 Pearson Education, Inc. Publishing as Prentice Hall
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher. Printed in the United States of America.
Copyright © 2012 Pearson Education, Inc.
Publishing as Prentice Hall