Database Security Mechanisms Research Articles

Digital Forensics Readiness Framework (DFRF) to Secure Database Systems

Database systems play a significant role in structuring, organizing, and managing data of organizations. In this regard, the key challenge is how to protect the confidentiality, integrity, and availability of database systems against attacks launched from within and outside an organization. To resolve this challenge, different database security techniques and mechanisms, which generally involve access control, database monitoring, data encryption, database backups, and strong passwords have been proposed. These techniques and mechanisms have been developed for certain purposes but fall short of many industrial expectations. This study used the design science research method to recommend a new Digital Forensic Readiness Framework, named DFRF, to secure database systems. DFRF involves risk assessments, data classification, database firewalls, data encryption, strong password policies, database monitoring and logging, data backups and recovery, incident response plans, forensic readiness, as well as education and awareness. The proposed framework not only identifies threats and responds to them more effectively than existing models, but also helps organizations stay fully compliant with regulatory requirements and improve their security. The design of the suggested framework was compared with existing models, confirming its superiority.

A guiding framework for enhancing database security in state-owned universities in Zimbabwe

This study sought to design a framework to enhance database security in state-owned universities. Database security has been a cause for concern for state-owned universities following many reported cases of state-owned universities that were repeatedly hacked locally and the fact that internationally and there seems to be no strategy in place to guide database security mechanisms in state-owned universities. The study followed a positivist research philosophy using a hypothetical model to test various hypotheses. Through the lens of activity, Social Technology System and deterrence theories, using a survey method to gather the information, the hypotheses were tested and analyzed to further understand security vulnerabilities, security controls and ideal architectural requirements of database security. Quantitative data were collected from 104 respondents using questionnaires. A deductive approach was employed to ensure that the proposed strategy was designed after collecting the necessary data. The quantitative data were analyzed using SPSS version 22. The research findings highlighted the following issues that affect database security: human factor, work environment and technology in use. These issues lead to data exposure, data theft, data corruption, loss of revenue and loss of goodwill. Finally, a framework was proposed that would enhance database security in state-owned universities.

Anomalous query access detection in RBAC-administered databases with random forest and PCA

Relational databases are created for the purpose of handling and organizing sensitive data for organizations as well as for individuals. Although database security mechanisms and network intrusion detection systems (IDSs) are present, they have been found to be inadequate or unsuitable in detecting threats specifically directed toward the database application layer. Therefore, an IDS especially for the database is needed. In this paper, we propose random forest with weighted voting (WRF) and principal components analysis (PCA) as a feature selection technique, for the task of detecting database access anomalies, assuming that the database has a role-based access control (RBAC) model in place. PCA produces uncorrelated and relevant features, and, at the same time, reduces dimensionality for easier integration with large databases. RF exploits the inherent tree-structure syntax of SQL queries, and its weighted voting scheme further minimizes false alarms. Experiments showed that not only does the WRF result in improved false-positive and false-negative rates, but it is also fast in terms of model building and anomaly detection time. Moreover, for a given query, RF classification accuracy was found to be significantly affected by the type of command and the tables accessed, which, in turn, explains the confusion between some role classes. Lastly, both RF and PCA outperforms other state-of-the-art data mining techniques for the task of database anomaly detection, and WRF achieved the best performance, even on very skewed data.

Controlling The False Alarm In An Intrusion Tolerant Database System Using Significance Degrees Of Data Objects

Traditional database security mechanisms focus on either protection or prevention. However, in practice all attacks are not avoidable. To solve this problem, Intrusion Tolerant Database Systems (ITDBs) were introduced. An ITDB uses new generation database security mechanisms to guarantee specified levels of data availability, integrity and confidentiality in the presence of successful attacks. A key part of an ITDB is the intrusion detection (ID) which informs the system about attacks. One of the problems in using ID is the false alarm that will lead to the reduction of the “availability” or “integrity”. This paper presents an intelligent method to control false alarm. In this method, we will use the significance degrees of data objects to determine the anomaly threshold adaptively, as the “availability” and “integrity” required by the data objects are satisfied.

CRYPTOGRAPHY

To prevent the dissemination of sensitive information from the database to unauthorized users or outside competitive or hostile agents, an organization must establish effective security policies. The art of protecting information by transforming it into an unreadable format, called cipher text. Only those who possess a secret key can decipher (or decrypt) the message into plain text. Encrypted messages can sometimes be broken by cryptanalysis, also called codebreaking, although modern cryptography techniques are virtually unbreakable. Database security policies are guidelines for present and future decisions regarding the maintenance of the database security. Database security mechanisms are the functions used to enforce the database security policies. There are number of security policies that can be applied on data in order to protect the data against unauthorized access. Protecting the data is the prime need of an organization.

Lightweight Symmetric Encryption Algorithm for Secure Database

Virtually all of today’s organizations store their data in huge databases to retrieve, manipulate and share them in an efficient way. Due to the popularity of databases for storing important and critical data, they are becoming subject to an overwhelming range of threats, such as unauthorized access. Such a threat can result in severe financial or privacy problems, as well as other corruptions. To tackle possible threats, numerous security mechanisms have emerged to protect data housed in databases. Among the most successful database security mechanisms is database encryption. This has the potential to secure the data at rest by converting the data into a form that cannot be easily understood by unauthorized persons. Many encryption algorithms have been proposed, such as Transposition-Substitution-Folding-Shifting encryption algorithm (TSFS), Data Encryption Standard (DES), and Advanced Encryption Standard (AES) algorithms. Each algorithm has advantages and disadvantages, leaving room for optimization in different ways. This paper proposes enhancing the TSFS algorithm by extending its data set to special characters, as well as correcting its substitution and shifting steps to avoid the errors occurring during the decryption process. Experimental results demonstrate the superiority of the proposed algorithm, as it has outperformed the well-established benchmark algorithms, DES and AES, in terms of query execution time and database added size.

Optimizing an Intrusion Tolerant Database System Using Neural Network

Traditional database security mechanisms focus on either protection or prevention. However, these mechanisms have not any strategy in the presence of successful attacks. To solve this problem, the Intrusion Tolerant Database System (ITDB) was introduced. ITDB uses the new generation of database security mechanisms to guarantee specified levels of data availability, integrity and confidentiality in the presence of successful attacks. These mechanisms include Attack Isolation and Multiphase Damage Confinement. In this paper, we will present a practical model to utilize the combination of intrusion tolerance techniques for managing the ITDB architecture. Using this practical model, we will be able to secure the system’s required integrity and availability levels considering the changes in the environment. We will also introduce an intelligent method for determining the significance degrees of data objects in the optimized attack isolation technique.

Minimize the False Positive Rate in a Database Intrusion Detection System

A database intrusion detection system (DIDS) is used to detect potential violations in database security. DIDS follows other traditional database security mechanisms and network security mechanisms such as firewall and network intrusion detection. Therefore, it faces the intrusion from internal users or the intrusion that can be passed through other security layers. This means that the number of intrusion event is rare compared to the number of the normal event. Therefore, it is not efficient to raise a large number of false alarms to achieve a high detection rate. This paper introduces an enhancement for the data dependency model and integrates it with access control to override the high rate of false alarm and increase the detection rate.

Database intrusion detection using sequence alignment

Information is considered to be the most valuable asset of any organization and hence, it should be securely maintained. However, rapid proliferation of the Internet and Web applications has increased the threat of information security breaches. Traditional database security mechanisms are often not sufficient to protect sensitive information against novel attacks. Intrusion detection systems (IDS) are used to detect any such intrusion, once traditional security mechanisms have been compromised. User-level profile is effective for database intrusion detection, but maintaining such profiles is not practical for an organization with a large number of users. Thus, an IDS needs to be flexible enough to choose a profile granularity according to the type of the organization. Further, only intra-transactional pattern matching for intrusion detection is not quite effective for detecting intrusion in a database. We propose an IDS that uses inter-transactional as well as intra-transactional features for intrusion detection. It supports selection of profile and transactional feature granularity as well. We use sequence alignment as a tool for comparing database access patterns of genuine users and intruders.

Real-time data attack isolation for commercial database applications

Traditional database security mechanisms are very limited in defending against data attacks. Authorized but malicious transactions can make a database useless by impairing its integrity and availability. This paper presents the design of a real-time data attack isolation system, denoted DAIS. DAIS isolates likely suspicious actions before a definite determination of intrusion is reported. In this way, the database can be immunized from many malicious transactions. DAIS is a COTS-DBMS-specific implementation of a general isolation algorithm that we developed [Liu P, Jajodia S, McCollum CD. Intrusion confinement by isolation in information systems. Journal of Computer Security, 2000;8(4):243–79]. In this paper, the design of the first DAIS prototype, which is for Oracle Server 9.2, is discussed. DAIS uses triggers and transaction profiles to keep track of the items read and written by transactions, isolates attacks by rewriting user SQL statements, and is transparent to end users. The DAIS design is very general. In addition to Oracle, it can be easily adapted to support many other database application platforms such as Microsoft SQL Server, Sybase, and Informix.

A Real-time Intrusion Prevention System for Commercial Enterprise Databases

Modern intrusion detection systems are comprised of three basically different approaches, host based, network based, and a third relatively recent addition called procedural based detection. The first two have been extremely popular in the commercial market for a number of years now because they are relatively simple to use, understand and maintain. However, they fall prey to a number of shortcomings such as scaling with increased traffic requirements, use of complex and false positive prone signature databases, and their inability to detect novel intrusive attempts. This intrusion detection systems represent a great leap forward over current security technologies by addressing these and other concerns. This paper presents an overview of our work in creating a true database intrusion detection system. Based on many years of Database Security Research, the proposed solution detects a wide range of specific and general forms of misuse, provides detailed reports, and has a low false-alarm rate. Traditional database security mechanisms are very limited in defending successful data attacks. Authorized but malicious transactions can make a database useless by impairing its integrity and availability. The proposed solution offers the ability to detect misuse and subversion through the direct monitoring of database operations inside the database host, providing an important complement to host-based and network-based surveillance. Suites of the proposed solution may be deployed throughout a network, and their alarms managed, correlated, and acted on by remote or local subscribing security services, thus helping to address issues of decentralized management.

Controlling user authorization in relational database management systems

As database management systems have gained widespread acceptance in organizations, an issue that has not received much attention from top management is security of the data maintained by these systems. Data security has a pronounced impact on the integrity and quality of the information that a decision maker must often rely on. Because of the lack of importance accorded to data security, most earlier implementations of database security mechanisms were minimal, inflexible, static, and centralized. With end-users becoming more active in direct manipulation of the data, the need to transfer control and responsibility of their information requirements becomes more evident. To achieve this goal, dynamic authorization mechanisms are needed. While more recent implementations of the relational database systems have included some versions of a dynamic authorization mechanism, they are not completely satisfactory from a security point of view. The paper shows how the notion of bounded propagation can be used to create a dynamic authorization mechanism that is more flexible but at the same time more secure than any other implementations.