Physical Design and Implementation Essay

Submitted By lutaurus23
Words: 1576
Pages: 7
Open Document
Assigment 6: Physical Design and Implementation

Explain the security mechanisms available for a database and how the data will be protected.
Database security is the most important component of any information system; it is the responsibility of team members and all staff managers, not just information technology professionals. Social engineering is the mother cause of having a compromised information system. Especially when employees are not properly informed about information and security processes, they become a security liability, it is therefore important that the organization set clear security policy guidelines to it members by communicating to them fully.
As a member chosen to guide on security plan part of it includes account types. Database accounts should be set up so that users and applications have the access they need and no more. Allowing a web application to use the database’s root administrator account is a huge security violation. The web account should generally not have access to modify the database schema. Likewise, developers should not necessarily have access to drop tables or delete live data.
In addition, database security can be increased by encapsulating business transactions into procedure-driven database transactions. By using custom, stored database procedures and functions, the processes of the database are not exposed to the server-side code. If the web-server is compromised and an attacker views the code, they will not be able to see the actual table names, field names, or which or how many tables are involved in any given transaction. They will only be able to see the name of a custom procedures, which is useless outside of the database server. Putting the database server on a separate machine that sits behind a firewall will effectively eliminate an attacker from gaining vital information about database schema.
SQL Injection Attacks:
According to Barnett Article (2008), SQL Injection is the most common type of attack on a modern database-driven information system. Attackers can use SQL Injection to steal data and to destroy data and data schemas. This poses a significant threat to an organization’s well-being.
However, the good news about SQL Injection it is predictable. It is not a new threat and it should not be a surprise to any serious organization. Steps can be taken to completely eliminate the threat altogether. The first initiative should emphasis data-cleansing. All data that is entered into an information system from an outside source should be cleansed. This involves escaping quote characters and encoding any HTML or script tags. In addition, data should be validated based on content. For instance, a numeric field should not contain non-numeric data. Developers are responsible for cleansing before sending database.
However, data cleansing assumes that the software developers and programmers who worked on the system correctly implemented data cleansing in a way that will prevent SQL injection. Most organization do not wish to put the security of their data on the shoulders of only the software developers. Messmer in his 2008, described SQL Injection attack on a web site.it described how attacks were devastating to the company and how the organization had to prevent such future occurences.This included the purchase and installation of a third-party utility that would screen data before permitting it to be sent to the database server. This required that the database server and the web server existed on two different machines.
While SQL Injection certainly poses a serious through to data security and integrity. It is easily mitigated with the use of professional, security-focused development and security tools.

SQL:
CREATE TABLE Chef ( chef_id NUMBER PRIMARY KEY, first name VARCHAR2(50) NOT NULL, last name VARCHAR2(50) NOT NULL, title VARCHAR2(50) NOT NULL, salary NUMBER(8,2) NOT NULL, address VARCHAR2(200) NOT NULL, city VARCHAR2(100) NOT NULL,
Show More

Related Documents: Physical Design and Implementation Essay

Security: Security and Information Essay

passive entity in the information system that receives or contains information. Risk - the probability that something can happen. Security Blueprint - the plan for the implementation of new security measures in the organization. Security Model - a collection of specific security rules that represents the implementation of a security policy. Security Posture or Security Profile - a general label for the combination of all policies, procedures, technologies, and programs that make up the…

Words 1032 - Pages 5

System Development Life Cycle Essays

System Development Life Cycle Irene Anderson CMGT/582 - CIS Security and Ethics June 23, 2014 Krystal Hall System Development Life Cycle “Both risk governance and regulatory requirements emphasize the need for an effective risk management plan. And to effectively manage risk, it is important that definitions of the risk management plan objectives are clear from the start, so that the plan can head in the right direction. Risk management of information assets also provides a strong basis for…

Words 1247 - Pages 5

INDP Final Project

March 16, 2015 Eddie Horton INDP Final Project The network requirements by Patton-Fuller have a few more points to add to the plan. There is an explanation on the final network design to include a timeline for the project. The design approach and rationale is covered briefly as well as an analysis of the detailed design. There was a specific requirement of 20MBps which led to a further explanation of various network data transmission rates. Security is the predominant aspect to this paper and it…

Words 2119 - Pages 9

Assignment 2: Logical Design Part 1 Essay

Assignment 2: Logical Design Part 1 Strayer University Professor Mark Cohen CIS-111 January 20 2013 Benefits of Relational Model A relational model helps to organize data in the form of tables. A relational model is composed of three main components a. A set of domains and sets which represents data structure. b. Integrity rules which ensures data protection c. Operations that will be carried on data i.e. process of data manipulation For Acme Global Consulting…

Words 722 - Pages 3

Work Related Project Analysis Essay

Part III, Implementation University of Phoenix Systems Analysis and Design BSA/376 October 25, 2010 Work-Related Project Analysis, Part III, Implementation Mastec Incorporated has been working in the past month on a project designed to reduce time spent on the phone trying to activate receivers. The project is a necessity for the organization and that was reflected in the feasibility report. The design process was also successful and now the organization is ready for implementation. Implementation…

Words 1435 - Pages 6

Course Notes Essay

the parent table if it has related records in a child table, unless you first delete the records in the child table. Physical design The design of the database within a particular DBMS. The physical design takes account of file systems and disk locations as well as DBMS-specific data types. Logical design The design of a database without regard to the physical implementation of the database Null A null is an unknown value. It is not the same as a 0 or an empty string. As an unknown, it cannot…

Words 664 - Pages 3

Cs251 Fundamantals of Database Systems Ip 1 - 5 Essay

Outline 3 Description of the Database Design Life Cycle 4 The Entity Relationship Diagram 7 The Logical Model and Normalization 9 The Microsoft Access Database 11 The Microsoft Access Database Application 14 References: 18 Project Outline My idea for a project concept is for a granite fabrication and installation company called MasterStoneWorks. We will perform counter sales, contractor and walk-in customer kitchen and bath design, templates, fabrication, installation, and…

Words 1684 - Pages 7

quiz1 Information Security Essay

core functions. UNIX DOX Correct! MULTICS ARPANET Question 2 4 / 4 pts ____ security addresses the issues necessary to protect the tangible items, objects, or areas of an organization from unauthorized access and misuse. Correct! Physical Personal Object Standard Question 3 4 / 4 pts A(n) ____ attack is a hacker using a personal computer to break into a system. indirect Correct! direct software hardware Question 4 0 / 4 pts A computer is the…

Words 814 - Pages 4

Product And Service Marketing Mix

2.1.7 Marketing mix The concept of marketing mix divided into product and service marketing mix. The service marketing mix consists of Product, Price, Place, Promotion, People, Physical Evidence, and Process, simply called 7P’s. The product marketing mix consists of Product, Price, Place, and Promotion, simply called 4P’s (Hartono, 2010 ) Product is defined as anything that can be offered into a market for attention, use, or consumption that might satisfy a need (Armstrong & Kotler, 2006). According…

Words 1001 - Pages 5

Rapid Application Development and Information Systems Essay

information system development process reinforces the information system building blocks that were introduced in Chapter 2. A hypothetical methodology called FAST (Framework for the Application of System Techniques) is used to teach a representative, implementation of a system development process. This chapter provides a “phase-level” overview. Later chapters provide “activity-level” descriptions and coverage of tools and techniques. The methodology as presented supports all contemporary paradigms including…

Words 9177 - Pages 37