Database Security and Auditing: Protecting Data Integrity and Accessibility

by Afyouni, Hassan A.

• ISBN13: 9780619215590
• ISBN10: 0619215593
• Edition: 1st
• Format: Paperback
• Copyright: 2005-04-06
• Publisher: Course Technology

Summary

This groundbreaking approach to database security will prepare students for business applications in a non-database specific environment.

Table of Contents

Introduction	xiii
Part I
Security Architecture	1	(32)
Introduction	2	(1)
Security	3	(1)
Information Systems	3	(4)
Database Management Systems	7	(2)
Information Security	9	(4)
Confidentiality	10	(1)
Integrity	10	(2)
Availability	12	(1)
Information Security Architecture	13	(1)
Database Security	14	(11)
Database Security Levels	17	(1)
Menaces to Databases	18	(7)
Asset Types and Their Value	25	(1)
Security Methods	26	(2)
Database Security Methodology	27	(1)
Database Security Definition Revisited	28	(1)
Chapter Summary	28	(1)
Review Questions	29	(2)
Hands-on Projects	31	(1)
Case Project	32	(1)
Operating System Security Fundamentals	33	(20)
Introduction	34	(1)
Operating System Overview	34	(2)
The Operating System Security Environment	36	(1)
The Components of an Operating System Security Environment	37	(5)
Services	37	(1)
Files	38	(1)
File Permissions	38	(2)
File Transfer	40	(1)
Sharing Files	41	(1)
Memory	42	(1)
Authentication Methods	42	(2)
Authorization	44	(1)
User Administration	44	(1)
Password Policies	45	(1)
Vulnerabilities of Operating Systems	46	(1)
E-mail Security	47	(1)
Chapter Summary	48	(1)
Review Questions	49	(1)
Hands-on Projects	50	(1)
Case Project	51	(1)
Endnotes	51	(2)
Administration of Users	53	(46)
Introduction	54	(1)
Documentation of User Administration	55	(2)
Operating System Authentication	57	(1)
Creating Users	58	(15)
Creating an Oracle10g User	60	(1)
Identified Clause	60	(1)
BY Password Option	61	(1)
Externally Option	62	(1)
Globally as external_name Option	62	(1)
Default Tablespace tablespace_name Clause	62	(1)
Temporary Tablespace tablespace_identifier Clause	62	(1)
Quota Clause	62	(1)
Profile Clause	63	(1)
Password Expire Clause	63	(1)
Account Clause	64	(1)
Creating an Oracle10g User Using Database Authentication	65	(4)
Creating an Oracle10g User Using External (Operating System) Authentication	69	(3)
Creating an Oracle User Using Global Authentication	72	(1)
Creating a SQL Server User	73	(6)
Windows Integrated (Trusted) Logins	73	(1)
Creating Windows Integrated Logins	73	(3)
SQL Server Login	76	(3)
Removing Users	79	(1)
Removing an Oracle User	79	(1)
SQL Server: Removing Windows Integrated Logins	80	(1)
Modifying Users	80	(3)
Modifying an Oracle User	80	(2)
SQL Server: Modifying Windows Integrated Login Attributes	82	(1)
Default Users	83	(2)
Oracle Server Default Users	83	(1)
SYS and ORAPWD Utility	84	(1)
SQL Server Default Users	85	(1)
Remote Users	85	(1)
Database Links	86	(3)
Authentication Methods	87	(2)
Linked Servers	89	(1)
Remote Servers	90	(1)
Practices for Administrators and Managers	91	(1)
Best Practices	92	(1)
Chapter Summary	93	(1)
Review Questions	94	(1)
Hands-on Projects	95	(1)
Case Projects	96	(3)
Profiles, Password Policies, Privileges, and Roles	99	(66)
Introduction	100	(1)
Defining and Using Profiles	100	(6)
Creating Profiles in Oracle	101	(4)
Creating Profiles in SQL Server 2000	105	(1)
Designing and Implementing Password Policies	106	(10)
What Is a Password Policy?	106	(1)
Designing Password Policies	106	(1)
Implementing Password Policies	107	(9)
Granting and Revoking User Privileges	116	(28)
Privileges in Oracle	116	(12)
Privileges in SQL Server	128	(8)
Table and Database Objects Privileges	136	(5)
Column-level Privileges	141	(3)
Creating, Assigning, and Revoking User Roles	144	(11)
Creating Roles with Oracle	144	(2)
Creating Roles with SQL Server	146	(9)
Best Practices	155	(1)
Chapter Summary	156	(1)
Review Questions	157	(1)
Hands-on Projects	157	(3)
Case Projects	160	(5)
Database Application Security Models	165	(42)
Introduction	166	(1)
Types of Users	166	(1)
Security Models	167	(2)
Access Matrix Model	167	(1)
Access Modes Model	168	(1)
Application Types	169	(5)
Client/Server Applications	169	(2)
Web Applications	171	(1)
Data Warehouse Applications	172	(1)
Other Applications	173	(1)
Application Security Models	174	(20)
Security Model Based on Database Roles	174	(10)
Security Model Based on Application Roles	184	(3)
Security Model Based on Application Functions	187	(2)
Security Model Based on Application Roles and Functions	189	(2)
Security Model Based on Application Tables	191	(3)
Data Encryption	194	(6)
Chapter Summary	200	(2)
Pharmacy Application	201	(1)
Review Questions	202	(1)
Hands-on Projects	202	(2)
Case Projects	204	(2)
Endnotes	206	(1)
Virtual Private Databases	207	(50)
Introduction	208	(1)
Overview of Virtual Private Databases	208	(2)
Implementing a VPD Using Views	210	(8)
Hiding Rows Based on the Current User	215	(3)
Implementing a VPD Using Application Context in Oracle	218	(7)
Implementing Oracle Virtual Private Databases	225	(15)
Viewing VPD Policies and Application Context Using the Data Dictionary	240	(1)
Viewing VPD Policies and Application Contexts Using Policy Manager	241	(2)
Implementing Row- and Column-level Security with SQL Server	243	(9)
Row-based Security Using Access Levels	243	(3)
Row-based Security Using Application Functions	246	(1)
Column-based Security	246	(6)
Chapter Summary	252	(1)
Review Questions	253	(1)
Hands-on Projects	253	(2)
Case Projects	255	(2)
Part II
Database Auditing Models	257	(26)
Introduction	258	(1)
Auditing Overview	259	(2)
Definitions	259	(1)
Auditing Activities	260	(1)
Auditing Environment	261	(3)
Auditing Process	264	(1)
Auditing Objectives	265	(1)
Auditing Classifications and Types	266	(3)
Audit Classifications	267	(1)
Audit Types	268	(1)
Benefits and Side Effects of Auditing	269	(1)
Auditing Side Effects	269	(1)
Auditing Models	269	(11)
Simple Auditing Model 1	271	(3)
Simple Auditing Model 2	274	(1)
Advanced Auditing Model	275	(2)
Historical Data Model	277	(1)
Auditing Application Actions Model	278	(1)
C2 Security	279	(1)
Chapter Summary	280	(1)
Review Questions	281	(1)
Hands-on Projects	281	(1)
Case Projects	282	(1)
Application Data Auditing	283	(66)
Introduction	284	(1)
DML Action Auditing Architecture	284	(2)
Oracle Triggers	286	(4)
SQL Server Triggers	290	(6)
Creating Triggers	290	(3)
Implementation of an Historical Model with SQL Server	293	(1)
Implementation of Application Actions Model with SQL Server	294	(2)
Fine-grained Auditing (FGA) with Oracle	296	(6)
DML Statement Audit Trail	302	(35)
DML Action Auditing with Oracle	302	(4)
Data Manipulation History	306	(1)
History Auditing Model Implementation Using Oracle	307	(7)
DML Auditing Using Repository with Oracle (Simple 1)	314	(10)
DML Auditing Using Repository with Oracle (Simple 2)	324	(13)
Auditing Application Errors with Oracle	337	(4)
Oracle PL/SQL Procedure Authorization	341	(3)
Chapter Summary	344	(1)
Review Questions	345	(1)
Hands-on Projects	345	(2)
Case Projects	347	(2)
Auditing Database Activities	349	(32)
Introduction	350	(1)
Using Oracle Database Activities	350	(1)
Creating DLL Triggers with Oracle	351	(6)
Example of LOGON and LOGOFF Database Events	352	(3)
Auditing Code with Oracle	355	(2)
Auditing Database Activities with Oracle	357	(11)
Auditing DDL Activities	358	(9)
Oracle Alert Log	367	(1)
Auditing Server Activity with Microsoft SQL Server 2000	368	(1)
Implementing SQL Profiler	368	(1)
Security Auditing with SQL Server	369	(8)
Data Definition Auditing	374	(1)
Database Auditing with SQL Server	375	(1)
Database Errors Auditing with SQL Server	376	(1)
Chapter Summary	377	(1)
Review Questions	378	(1)
Hands-on Projects	378	(2)
Case Project	380	(1)
Endnotes	380	(1)
Part III
Security and Auditing Project Cases	381	(10)
Introduction	382	(1)
Case 1: Developing an Online Database	382	(1)
Case 2: Taking Care of Payroll	383	(3)
Case 3: Tracking Town Contracts	386	(2)
Case 4: Tracking Database Changes	388	(1)
Case 5: Developing a Secured Authorization Repository	389	(2)
Appendix A Database Security Checklist	391	(4)
Appendix B Database Auditing Checklist	395	(4)
Glossary	399	(6)
Bibliography	405