Database Security 1-1
Chapter 1
Security and Information Technology
At a Glance
Instructor’s Manual Table of Contents
Overview
Objectives
Teaching Tips
Quick Quizzes
Class Discussion Topics
Additional Projects
Additional Resources
Key Terms
,Database Security 1-2
Lecture Notes
Overview
This chapter will cover the measures that can be taken to detect and diminish the probability of
cyberattacks and natural disasters. Database security is defined and our enemies are identified.
There is no such thing as guaranteed security, but armed with the knowledge provided in this
chapter, major risks can be minimized.
Objectives
Define the nature of database and information systems security
Identify the three main security objectives when protecting information systems
Identify security threats
Define and identify the characteristics of viruses and how they infiltrate systems
Identify specific types of operational security and describe how to implement them
Describe the information security life cycle
Describe the multilayered nature of security architecture
Teaching Tips
Why Database Security?
1. Begin the discussion by noting that more time is spent communicating through
computer networks than any other medium available and most of the transactions
conducted online involve some type of database.
2. Advancements in technology have enabled individuals to use network databases to
preserve their most critical infrastructures. Water supplies, electricity grids, and gas and
oil production processes depend on a computer network to thrive. It is important for
students to understand that a breach to one of these data storage structures could have a
disastrous impact on our livelihood.
Teaching The following article discusses the importance of incorporating security into
Tip databases, not just at the perimeter of networks:
http://www.cioinsight.com/c/a/Latest-News/CyberAttacks-Highlight-Need-to-
Focus-on-Stronger-Database-Security-342260/.
,Database Security 1-3
A Secure Data Environment
1. Explain that the deployment of multiple layers of security within critical database
environments is the most effective approach to minimizing the risk of a data breach. In
multilayer-secured environments, an intruder who might compromise the first layer will
have to find a way to bypass the second and even a third in order to obtain access,
making intrusion more complex and time-consuming.
2. Note that in multilayer-secured environments, an intruder who might compromise the
first layer will have to find a way to bypass the second and even a third in order to
obtain access, making intrusion more complex and time-consuming.
3. The following topics should also be discussed:
Computer Security: This is a set of established procedures, standards, policies, and
tools that are used to protect a computer from theft, misuse, and unwanted
intrusions, activities, and attacks.
Network Security: This is a set of established procedures, standards, policies, and
tools that are used to protect a network from theft, misuse, and unwanted intrusions,
activities, and attacks.
Database Security Objectives
1. Security measures should keep information private from an outside view, be steadfast in
their efforts to maintain the consistency of data, and ensure that resources remain at a
high degree of availability. Note that the key to achieving an effective data security
architecture relies in an organization’s efforts to maintain the confidentiality, integrity,
and availability of its environment. Use Figure 1-1 to aid the discussion.
2. The following topics should also be discussed:
Confidentiality: For a system to provide confidentiality, it needs to do two things:
ensure that information maintains its privacy by limiting authorized access to
resources; block unauthorized access to resources.
Integrity: This refers to the efforts taken through policy, procedure, and design in
order to create and maintain reliable, consistent, and complete information and
systems.
Availability: This refers to the efforts taken through policy, procedures, and design
to maintain the accessibility of resources on a network or within a database. These
resources include, but are not limited to, data, applications, other databases,
computers, servers, applications, files, drives, shares, and network access.
Quick Quiz 1
1. ____ deals with the permission and access to the data structure and the data contained
within it.
Answer: Database security
, Database Security 1-4
2. ____ is an important goal to achieve within security efforts as a breach could result in a
number of disastrous effects.
Answer: Confidentiality
3. Unlike confidentiality and integrity, a business cannot operate without ____, because
not having access to its most critical tools leaves it disabled and unable to complete the
simplest of tasks.
Answer: availability
4. ____ refers to the efforts taken through policy, procedure, and design in order to create
and maintain reliable, consistent, and complete information and systems.
Answer: Integrity
Who Are We Securing Ourselves Against?
1. It can be said that an uninformed security professional is similar to a sight-impaired
watchdog. Both are insecure and eager to protect, having all of the tools necessary to
keep the environment safe, yet they lack the ability to make the distinction between an
intruder and a visitor.
2. Note that databases that are too restrictive are just as ineffective as those that are too
accessible. Databases that are given too much access can lead to issues with security,
integrity, and privacy, while those given little to no access can lead to frustrated and
ineffective users.
Hackers
1. Introduce the terms hacker and cracker. Use Table 1-1 to aid the discussion.
Social Engineers
1. Note that one of the most common ways that intruders gain access to systems is by
asking others for their passwords. By nature, human beings desire to help one another.
This is one of many characteristics that facilitate the success of social engineers.
Computer Users
1. Emphasize that over half of the security breaches that occur on a network involve our
own network users. Lack of education and a total disregard of policy are two major
contributors to outside intrusions.
2. Discuss the following common errors made by users on a network:
Poor habits
Password error
Disregard for company policy
Opening unknown e-mails
Inappropriate disclosure
Procrastination
Chapter 1
Security and Information Technology
At a Glance
Instructor’s Manual Table of Contents
Overview
Objectives
Teaching Tips
Quick Quizzes
Class Discussion Topics
Additional Projects
Additional Resources
Key Terms
,Database Security 1-2
Lecture Notes
Overview
This chapter will cover the measures that can be taken to detect and diminish the probability of
cyberattacks and natural disasters. Database security is defined and our enemies are identified.
There is no such thing as guaranteed security, but armed with the knowledge provided in this
chapter, major risks can be minimized.
Objectives
Define the nature of database and information systems security
Identify the three main security objectives when protecting information systems
Identify security threats
Define and identify the characteristics of viruses and how they infiltrate systems
Identify specific types of operational security and describe how to implement them
Describe the information security life cycle
Describe the multilayered nature of security architecture
Teaching Tips
Why Database Security?
1. Begin the discussion by noting that more time is spent communicating through
computer networks than any other medium available and most of the transactions
conducted online involve some type of database.
2. Advancements in technology have enabled individuals to use network databases to
preserve their most critical infrastructures. Water supplies, electricity grids, and gas and
oil production processes depend on a computer network to thrive. It is important for
students to understand that a breach to one of these data storage structures could have a
disastrous impact on our livelihood.
Teaching The following article discusses the importance of incorporating security into
Tip databases, not just at the perimeter of networks:
http://www.cioinsight.com/c/a/Latest-News/CyberAttacks-Highlight-Need-to-
Focus-on-Stronger-Database-Security-342260/.
,Database Security 1-3
A Secure Data Environment
1. Explain that the deployment of multiple layers of security within critical database
environments is the most effective approach to minimizing the risk of a data breach. In
multilayer-secured environments, an intruder who might compromise the first layer will
have to find a way to bypass the second and even a third in order to obtain access,
making intrusion more complex and time-consuming.
2. Note that in multilayer-secured environments, an intruder who might compromise the
first layer will have to find a way to bypass the second and even a third in order to
obtain access, making intrusion more complex and time-consuming.
3. The following topics should also be discussed:
Computer Security: This is a set of established procedures, standards, policies, and
tools that are used to protect a computer from theft, misuse, and unwanted
intrusions, activities, and attacks.
Network Security: This is a set of established procedures, standards, policies, and
tools that are used to protect a network from theft, misuse, and unwanted intrusions,
activities, and attacks.
Database Security Objectives
1. Security measures should keep information private from an outside view, be steadfast in
their efforts to maintain the consistency of data, and ensure that resources remain at a
high degree of availability. Note that the key to achieving an effective data security
architecture relies in an organization’s efforts to maintain the confidentiality, integrity,
and availability of its environment. Use Figure 1-1 to aid the discussion.
2. The following topics should also be discussed:
Confidentiality: For a system to provide confidentiality, it needs to do two things:
ensure that information maintains its privacy by limiting authorized access to
resources; block unauthorized access to resources.
Integrity: This refers to the efforts taken through policy, procedure, and design in
order to create and maintain reliable, consistent, and complete information and
systems.
Availability: This refers to the efforts taken through policy, procedures, and design
to maintain the accessibility of resources on a network or within a database. These
resources include, but are not limited to, data, applications, other databases,
computers, servers, applications, files, drives, shares, and network access.
Quick Quiz 1
1. ____ deals with the permission and access to the data structure and the data contained
within it.
Answer: Database security
, Database Security 1-4
2. ____ is an important goal to achieve within security efforts as a breach could result in a
number of disastrous effects.
Answer: Confidentiality
3. Unlike confidentiality and integrity, a business cannot operate without ____, because
not having access to its most critical tools leaves it disabled and unable to complete the
simplest of tasks.
Answer: availability
4. ____ refers to the efforts taken through policy, procedure, and design in order to create
and maintain reliable, consistent, and complete information and systems.
Answer: Integrity
Who Are We Securing Ourselves Against?
1. It can be said that an uninformed security professional is similar to a sight-impaired
watchdog. Both are insecure and eager to protect, having all of the tools necessary to
keep the environment safe, yet they lack the ability to make the distinction between an
intruder and a visitor.
2. Note that databases that are too restrictive are just as ineffective as those that are too
accessible. Databases that are given too much access can lead to issues with security,
integrity, and privacy, while those given little to no access can lead to frustrated and
ineffective users.
Hackers
1. Introduce the terms hacker and cracker. Use Table 1-1 to aid the discussion.
Social Engineers
1. Note that one of the most common ways that intruders gain access to systems is by
asking others for their passwords. By nature, human beings desire to help one another.
This is one of many characteristics that facilitate the success of social engineers.
Computer Users
1. Emphasize that over half of the security breaches that occur on a network involve our
own network users. Lack of education and a total disregard of policy are two major
contributors to outside intrusions.
2. Discuss the following common errors made by users on a network:
Poor habits
Password error
Disregard for company policy
Opening unknown e-mails
Inappropriate disclosure
Procrastination
