Database Security: What Students Need to Know

Database security is a growing concern evidenced by an increase in the number of reported incidents of loss of or unauthorized exposure to sensitive data. As the amount of data collected, retained and shared electronically expands, so does the need to understand database security. The Defense Information Systems Agency of the US Department of Defense (2004), in its Database Security Technical Implementation Guide, states that database security should provide controlled, protected access to the contents of a database as well as preserve the integrity, consistency, and overall quality of the data. Students in the computing disciplines must develop an understanding of the issues and challenges related to database security and must be able to identify possible solutions. At its core, database security strives to insure that only authenticated users perform authorized activities at authorized times. While database security incorporates a wide array of security topics, notwithstanding, physical security, network security, encryption and authentication, this paper focuses on the concepts and mechanisms particular to securing data. Within that context, database security encompasses three constructs: confidentiality or protection of data from unauthorized disclosure, integrity or prevention from unauthorized data access, and availability or the identification of and recovery from hardware and software errors or malicious activity resulting in the denial of data availability. In the computing discipline curricula, database security is often included as a topic in an introductory database or introductory computer security course. This paper presents a set of sub-topics that might be included in a database security component of such a course. Mapping to the three constructs of data security, these topics include access control, application access, vulnerability, inference, and auditing mechanisms. Access control is the process by which rights and privileges are assigned to users and database objects. Application access addresses the need to assign appropriate access rights to external applications requiring a database connection. Vulnerability refers to weaknesses that allow malicious users to exploit resources. Inference refers to the use of legitimate data to infer unknown information without having rights to directly retrieve that information. Database auditing tracks database access and user activity providing a way to identify breaches that have occurred so that corrective action might be taken. As the knowledge base related to database security continues to grow, so do the challenges of effectively conveying the material. This paper addresses those challenges by incorporating a set of interactive software modules into each sub-topic. These modules are part of an animated database courseware project designed to support the teaching of database concepts. The courseware covers the domains of Database Design, Structured Query Language, Database Transactions, and Database Security. The Security Module, presented in this paper, allows students to explore such areas as access control, SQL injections, database inference, database auditing, and security matrices. The courseware was developed as part of a National Science Foundation grant and has been made freely available at http://adbc.kennesaw.edu

Multifaceted Faculty Network Design and Management: Practice and Experience Report

We report on our experience on multidimensional aspects of our faculty's network design and management, including some unique aspects such as campus-wide VLANs and ghosting, security and monitoring, switching and routing, and others. We outline a historical perspective on certain research, design, and development decisions and discuss the network topology, its scalability, and management in detail; the services our network provides, and its evolution. We overview the security aspects of the management as well as data management and automation and the use of the data by other members of the IT group in the faculty.Comment: 19 pages, 11 figures, TOC and index; a short version presented at C3S2E'11; v6: more proofreading, index, TOC, reference

Supporting the clinical trial recruitment process through the grid

Patient recruitment for clinical trials and studies is a large-scale task. To test a given drug for example, it is desirable that as large a pool of suitable candidates is used as possible to support reliable assessment of often moderate effects of the drugs. To make such a recruitment campaign successful, it is necessary to efficiently target the petitioning of these potential subjects. Because of the necessarily large numbers involved in such campaigns, this is a problem that naturally lends itself to the paradigm of Grid technology. However the accumulation and linkage of data sets across clinical domain boundaries poses challenges due to the sensitivity of the data involved that are atypical of other Grid domains. This includes handling the privacy and integrity of data, and importantly the process by which data can be collected and used, and ensuring for example that patient involvement and consent is dealt with appropriately throughout the clinical trials process. This paper describes a Grid infrastructure developed as part of the MRC funded VOTES project (Virtual Organisations for Trials and Epidemiological Studies) at the National e-Science Centre in Glasgow that supports these processes and the different security requirements specific to this domain

Publishing patterns within the UK accounting and finance academic community

This study reports on publishing patterns in the UK and Irish accounting and finance academic community for the 2-year period 1998-1999 using the data contained in the BAR Research Register. It is found that the community has been growing modestly since 1991, with a doubling in the number of PhD-qualified staff (to 30%) and a reduction in the number with a professional qualification (from 81 to 58%). Nearly half of all outputs appear in other than academic journals. The mean number of publications is 1.76 per capita, with significantly more staff active in publishing than in 1991 (44% compared to 35%). However, only 17% publish in a subset of 60 'top' journals. Just over half of all articles are published in the core discipline journals, the rest appearing mainly in management, economics, sociology, education and IT journals. This may indicate a growing maturity in the disciplines, whereby applied research findings are flowing back into related foundation and business disciplines. Nearly two-thirds of academic articles are co-authored, with 25% of contributions coming from outside the community, indicating an openness to interdisciplinary collaboration, collaboration with overseas academics and collaboration with individuals in practice. The findings of this study will be of assistance to those making career decisions (either their own career or decisions involving other people's careers). They also raise awareness of the way in which the accounting and finance disciplines are developing

Detection of the Security Vulnerabilities in Web Applications

The contemporary organizations develop business processes in a very complex environment. The IT&C technologies are used by organizations to improve their competitive advantages. But, the IT&C technologies are not perfect. They are developed in an iterative process and their quality is the result of the lifecycle activities. The audit and evaluation processes are required by the increased complexity of the business processes supported by IT&C technologies. In order to organize and develop a high-quality audit process, the evaluation team must analyze the risks, threats and vulnerabilities of the information system. The paper highlights the security vulnerabilities in web applications and the processes of their detection. The web applications are used as IT&C tools to support the distributed information processes. They are a major component of the distributed information systems. The audit and evaluation processes are carried out in accordance with the international standards developed for information system security assurance.security, vulnerability, web application, audit

Development of Information Technology Auditing Teaching Modules: An Interdisciplinary Endeavor between Seidenberg and Lubin Faculty

The original goals of the project were to develop interdisciplinary Information Technology (IT) Auditing teaching modules, to be integrated into courses offered by both Business and Information Technology disciplines during Fall 2009 and Spring 2010. IT Auditing is an interdisciplinary field which requires understanding audit, control, technology and security concepts in accordance with audit standards, guidelines, and best practices. Thus, IT Auditing requires interdisciplinary knowledge across IT and Accounting/Auditing domains. With increasing use of IT in business processes, the demand for IT Auditors is increasing rapidly, offering a lucrative career path. Acquiring IT Audit related knowledge and skills will help our students improve their career opportunities by exploring this growing field. Based upon the curriculum content areas of the CISA Exam as well as the ISACA Model Curriculum, we proposed the following three interdisciplinary teaching modules for IT Auditing: 1) IT Auditing Frameworks & Business Continuity; 2) IT Lifecycle Management & Service Delivery; and 3) Protection of Information Assets. We had developed the three teaching modules. Each individual module can be covered in one to two weeks. The entire set of three IT Auditing modules can then be covered in 3-4 weeks of class time. For each of the individual modules, we had developed presentation slides, reading lists and online quizzes based on the CISA Exam. We had also identified an overarching case study to be used throughout the three individual modules for continuity reasons

Tutorial: Teaching Database Security using a set of Software Animations

This workshop introduces a set of software animations developed to support the teaching of database security concepts. The animations are part of an animated database courseware project supported by an NSF Course, Curriculum and Laboratory Improvement grant. The courseware has been made publicly available and may be accessed at http://adbc.kennesaw.ed