New challenges in teaching database security

Abstract

Traditional Database Security has focused primarily on creating user accounts and managing user privileges to database objects. The wide spread use of databases over the web, heterogeneous client-server architectures, application servers, and networks creates an urgent need to widen this focus. This paper will provide an overview of the new and old database security challenges.Section one provides an overview of the Database Security concerns. It emphasizes Database Applications as the greatest concern and describes the SQL Slammer Worm, an example of not patching the Database Management System (DBMS)The second section explains in detail three Database topics: SQL injection [1], Multilevel Security [2] and Data Warehouse/Data Mining/Statistical security. The reason for focusing on these topics is because they are new Database Security issues (at least not taught in traditional database courses) and they are not topics that student will learn in any other course.The last topic provides guidelines for when to teach each Database Security topic and concludes by emphasizing the need for developing a Database Security Plan. Emphasis on a Database Security Plan resulted from interviewing Database Administrators and Security Specialists.