Teaching database security and auditing

Abstract

Hands-on laboratory experiences are essential critical for students to understand concepts and gain real-world insights in database security and auditing. We are developing a set of hands-on labs to integrate theories of database security into practices. Our designed labs do not require purchasing any commercial software or pre-configuration. Each lab includes objectives, results, and resources to help students to understand database security concepts including access control, virtual private database, and database auditing etc. We use two major database products (Microsoft SQL Server and Oracle 10g) to design and implement our labs.

Critical Assessment of Auditing Contributions to Effective and Efficient Security in Database Systems

“…This arises from the different regulatory compliance laws enforced by different countries and regions. Yang [6] explain that auditing as a function needs to a play a central role in ensuring compliance because an audit documents actions, practices and conduct of a business or individual. It then measures their compliance to policies, procedure, process and law.…”

“…The level of security that a database system offers is, at least in part measured by the level of auditing that can be implemented with the system. Yang [6] explains that there is no security without auditing; therefore security and auditing should be implemented in an integrated fashion. Auditing database activity and access can help identify security issues and resolve them quickly.…”

First use: Introducing information security in high school oracle academy courses

“…These topics include security concepts (e.g., data confidentiality, integrity and availability), protection methodologies (e.g., access control models, cryptography, and Oracle Label Security), and known attacks (e.g., SQL Injection). Similarly Yang introduces a set of topics to be covered in information security and auditing at the university level; these are "database basics, access control theories, application security, virtual private database (VPD), and database auditing [28]." While Schweitzer and Boleng do not present an approach for teaching these courses, Guimareas et al [12], Shweitzer and Brown [25], and Yang [28] present ideas for interactive learning of security concepts.…”

“…Similarly Yang introduces a set of topics to be covered in information security and auditing at the university level; these are "database basics, access control theories, application security, virtual private database (VPD), and database auditing [28]." While Schweitzer and Boleng do not present an approach for teaching these courses, Guimareas et al [12], Shweitzer and Brown [25], and Yang [28] present ideas for interactive learning of security concepts. The proposed tools to teach security concepts were developed by the authors and do not require the purchase of vendor products.…”

Evaluating Tools for Execution and Management of Authorization Business Rules

“…Information security is defined as the preservation of three foundational qualities: confidentiality, integrity and availability of information (ISO, 2005). Data confidentiality is handled by data access control mechanisms (SANDHU et al, 1996;YANG, 2009;CALI & MARTINENGHI, 2008;MURTHY & SEDLAR, 2007), which assure that a special type of business rules, named action assertion authorization, are applied.…”