Unless deadlocks occur, a transaction is assured of successful completion
5.5 Audit Tracking
Although auditing does not prevent system attacks, it is a vital aid in identifying intruders, attacks in progress, and to diagnose attack footprints (Meier, Mackman, Dunner, Vasireddy, Escamilla and Murukan). It is important to enable Windows operating system level auditing and SQL Server login auditing. SQL Server also offers an auditing capability that complies with the U.S. Government C2 certification. C2 level auditing provides substantially more audit information at the expense of increased disk storage requirements.
5.6 Encryption
SQL Server 2005 will support native database encryption (Songini, 2004). Previous versions had relied on third party tools. Encryption is the conversion of data into a form, called a ciphertext, that cannot be easily understood by unauthorized people. Decryption is the process of converting encrypted data back into its original form, so it can be understood. In order to recover the contents of an encrypted signal, the correct decryption key is required. The key is an algorithm that "undoes" the work of the encryption algorithm. Data encryption adds an important layer of protection because any user trying to access the data needs the right password and the encryption key as well (Database Security and Administration, 2001). One advantage of data encryption is that files are unreadable to people who have access to the database, but no databases privileges.
5.7 Backup and Recovery
Backup and recovery is necessary to restore a database quickly and accurately after loss or damage. SQL Server can back up data in one of three ways: a full database backup, a transaction log backup, and a differential backup ("Backup"). The full option backups the entire database including the transaction log while a differential option backups data between full database backups. A sequence of transaction log backups provides for a continuous chain of transaction information to support recovery forward from database, differential, or file backups. Microsoft SQL Server supports password protection for backup media and backup sets. Using password protection helps safeguard backups against unauthorized restoration of databases, unauthorized appends to the media, and unintentional overwriting of the media.
5.8 SQL Injection Prevention Techniques
SQL Injection is caused by malicious alterations of SQL statements from their intended format, by exploiting weaknesses of a client application that is used to create them (Plicht, 2004, October). Most commonly, this takes place in Internet or intranet scenarios that require users to enter data via text boxes presented through a Web-page interface, which, in turn is used to populate a dynamically formed query.
Policht (2004, October) makes several recommendations for preventing SQL Injection. First, administrators should follow the principle of least privileged access, granting to applications only the rights required to operate properly. It is also important to implement the most secure authentication method possible (refer to section 5.2 in this paper). In cases where the number of applications users is low, creating separate SQL Server logins for each one and using these logins to define connection parameters to the target database from the Web application will make SQL Injection more difficult. Validation of a user's input by testing it for invalid or suspicious characters and checking the type of entered data is also necessary. And, replacing the SQL statement with an equivalent stored procedure, and setting the username and password values as its input parameters will render SQL Injection attacks ineffective. Finally, guarding information that might be revealed via error messages resulting from executing malformed SQL statements is another prevention technique.
Web Securities web-based architecture introduces additional security issues because Web communications are not designed with security in mind; they are stateless and use non-encrypted data transfer. Therefore, Web security measures such as firewalls, secure internet protocols such as SSL and digital certificates are necessary.
6.1 Firewall is a set of related programs, located at a network gateway server that protects the resources of a private network from users from other networks ("Firewall"). A firewall, working closely with a router program, examines each network packet to determine whether to forward it toward its destination. A firewall also includes or works with a proxy server that makes network requests on behalf of workstation users. A firewall is often installed in a specially designated computer separate from the rest of the network so that no incoming request can get directly at private network resources.
6.2 SSL
The Secure Sockets Layer (SSL) is a commonly-used protocol for managing the security of a message transmission on the Internet ("Secure Sockets Layer"). SSL has recently been succeeded by Transport Layer Security (TLS), which is based on SSL. SSL uses a program layer located between the Internet's Hypertext Transfer Protocol (HTTP) and Transport Control Protocol (TCP) layers. Sockets refers to the sockets method of passing...
Database Security Plan and Requirements Definition for a University Department The database security plan and requirements definition were developed. The plan included, at the outset, the inclusion of major stakeholder at the University and described their roles in initiating, implementing, and maintaining the plan. Individuals responsible for daily and other periodic tasks were developed. A major consideration in planning the security was the policy that governs granting of access. The need-to-know,
Database Administrator for Department Store Scenario The department store has expanded in the local region by opening five more bookstores, and the bookstore has launched a series of marketing campaign to increase sales and attract new customers. The objective of this technical report is to develop a plan to create and maintain an enterprise-wide database system that will assist the bookstore to hold the inventory and sales data. The database design will
Database Development The objective of this study is to recommend three specific tasks that could be performed to improve the quality of datasets using the Software Development Life Cycle (SDLC) methodology and to recommend the actions that could be performed to optimize record selections and to improve database performance from a quantitative data quality assessment. Finally, this work will suggest three maintenance plans and three activities that could be performed in
Database Design for Spa/Hotel Booking System The WR (Woodlands Retreat) is a medium sized organization currently intending to build a database system to integrate modern IT (information systems) in its business operation to enhance its dynamic and innovative business operations. Although, the Woodlands Retreat has an IT system, however, the current systems are not capable of keeping book records as well as not capable of managing all data for the company
Design criteria exist at the levels of the technical, system integration aspects of the database to other systems through XML. This integration is critically important to ensure that the applications created can be effectively used over time and not have any scalability issues. There is also the need for designing the databases at the presentation layer to provide for scalability and flexibility of being able to create applications relatively quickly
Database Data Warehousing Design Data warehousing is a powerful tool that business organizations use to enhance competitive advantages. Data warehousing supports business decision by collecting, organizing and consolidating data for analysis and reporting using tools such as OLAP (online analytical processing ) and data mining. Typically, the relational database technology is generally being used to design a data warehousing and a relational database is a database having collection of tables, and
Our semester plans gives you unlimited, unrestricted access to our entire library of resources —writing tools, guides, example essays, tutorials, class notes, and more.
Get Started Now