With increasing attacks and internal data theft the organizations must strengthen their database security beyond the traditional methods, especially those databases which hold private data. This can be done by developing a security strategy which is a framework of control mechanisms for authentication, authorization, and access control mechanisms to enforce role separation, database auditing, monitoring, network and data encryption, data masking according to the needs and environment in the organization. To develop a high-quality security strategy detailed knowledge and understanding about the database control mechanisms is needed. So the main purpose of this paper is to give a detailed description of security mechanisms which are available till today and build a security strategy according to the needs and environment of the organization. Using the knowledge gained a working prototype which is a security strategy is designed, developed and evaluated for an organization according to the scenario described which contains the challenges or threats and present security mechanisms used in the organization. Finally a security strategy is developed which can help the organization in protecting their information assets and private data from inside and outside attacks.
Databases contain sensitive and important information about an organization. The basic element of any organization is to protect these information resources that support the critical operations of the organization from unauthorized access, modification, or disclosure.
The major threat of the organization is securing its gigabytes of data from the prying eyes of unauthorized outsiders and insiders attempting to exceed their authority. A single intrusion that compromises private data such as credit card numbers or financial data can cause immense damage to an organization, either big or small. Databases will be the prime target of such intrusion attacks, largely because they hold the most valuable data and are vulnerable unless carefully secured.
The purpose of this paper is to explain about intrinsic database security mechanisms for the relational database management systems which will minimize these threats. Database security professionals should develop a security strategy which provides not only the basic security features authentication, authorization, and access control but also aligns database security policies with information security policies; ensure well-defined and formalized database security procedures; enforce role separation; and apply advanced security measures such as database auditing, monitoring, database encryption, data masking, and vulnerability assessment to all critical databases that store private data.
In this paper “The inference problem: a survey” [Farkas, 2002] the author states that the access control models protects the data from direct access but not from the indirect access via inference...