Bài giảng Bảo mật cơ sở dữ liệu: Security models - Trần Thị Kim Chi

Chia sẻ: Hấp Hấp | Ngày: | Loại File: PPTX | Số trang:141

Thêm vào BST

Báo xấu

82
lượt xem 6
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

Bài giảng "Bảo mật cơ sở dữ liệu: Security models" trình bày các nội dung: Access control, types of Access control, mandatory access control, rules based access control, authentication methods, operating system authentication,... Mời các bạn cùng tham khảo.

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: Bài giảng Bảo mật cơ sở dữ liệu: Security models - Trần Thị Kim Chi

SECURITY MODELS Operating System Security Fundamentals Tiếp theo bài 1 bắt đầu từ Slide 10 Giảng Viên: Trần Thị Kim Chi © FPT Software 1
Agenda a. Access control b. Inference and covert channels c. Open/close policy d. Database Application Security Models Discretionary/mandatory access control © FPT Software 2
Access control • Access control is a security technique that can be used to regulate who or what can view or use resources in a computing environment. • Access control systems perform authorization identification, authentication, access approval, and accountability of entities through login credentials includingpasswords, personal identification numbers (PINs), biometric scans, and physical or electronic keys. © FPT Software 3
Types of Access control • There are two main types of access control: – Physical, – logical. • Physical access control limits access to campuses, buildings, rooms and physical IT assets. • Logical access limits connections to computer networks, system files and data. © FPT Software 4
Types of Access control The four main categories of access control are: • Mandatory access control • Discretionary access control • Role-based access control • Rule-based access control © FPT Software 5
Mandatory access control (MAC) • Mandatory access control (MAC) is a system- controlled policy restricting access to resource objects (such as data files, devices, systems, etc.) based on the level of authorization or clearance of the accessing entity, be it person, process, or device. • http:// searchsecurity.techtarget.com/definition/mandatory-a © FPT Software 6
Discretionary access control (DAC) • Discretionary access control (DAC) is a type of access control defined by the Trusted Computer System Evaluation Criteria "as a means of restricting access to objects based on the identity of subjects and/or groups to which they belong. The controls are discretionary in the sense that a subject with a certain access permission is capable of passing that permission (perhaps indirectly) on to any other subject (unless restrained by mandatory access control )". • Discretionary access control is commonly discussed in contrast to mandatory access control (MAC, sometimes termed non-discretionary access control). © FPT Software 7
Role-based access control (RBAC) • Role-based access control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within an enterprise... • http:// searchsecurity.techtarget.com/definition/role-based-access-co • http:// searchsecurity.techtarget.com/tip/Role-based-access-control-f © FPT Software 8
Rules Based Access Control • Rules Based Access Control is a strategy for managing user access to one or more systems, where business changes trigger the application of Rules, which specify access changes. • Implementation of Rules Based Access Control systems is feasible so long as the number of triggering business events and the set of possible actions that follow those events are both small. • - See more at: http://hitachi- id.com/concepts/rules_based_access_control.html#sthas h.TJMhLiGM.dpuf © FPT Software 9
Authentication Methods • Authentication: – Verifies user identity – Permits access to the operating system • Physical authentication: – Allows physical entrance to company property – Magnetic cards and biometric measures • Digital authentication: verifies user identity by digital means © FPT Software 10
Authentication Methods • Digital certificates: digital passport that identifies and verifies holder of certificate • Digital token (security token): – Small electronic device – Displays a number unique to the token holder; used with the holder’s PIN as a password – Uses a different password each time © FPT Software 11
Authentication Methods • Digital card: – Also known as a security card or smart card – Similar to a credit card; uses an electronic circuit instead of a magnetic strip – Stores user identification information • Kerberos: – Developed by MIT – Uses tickets for authentication purposes © FPT Software 12
Authentication Methods • Lightweight Directory Access Protocol (LDAP): – Developed by the University of Michigan – A centralized directory database stores: • Users (user name and user ID) • Passwords • Internal telephone directory • Security keys – Efficient for reading but not suited for frequently changing information © FPT Software 13
Authentication Methods • NTLM: – Developed and used by Microsoft – Employs a challenge/response authentication protocol • Public Key Infrastructure (PKI): – User keeps a private key – Authentication firm holds a public key – Encrypt and decrypt data using both keys © FPT Software 14
Authentication Methods • RADIUS: used by network devices to provide a centralized authentication mechanism • Secure Socket Layer (SSL): authentication information is transmitted over the network in an encrypted form • Secure Remote Password (SRP): – Password is not stored locally – Invulnerable to brute force or dictionary attacks © FPT Software 15
Authorization • Process that decides whether users are permitted to perform the functions they request • Authorization is not performed until the user is authenticated • Deals with privileges and rights © FPT Software 16
Operating System Authentication • Many databases (including Microsoft SQL Server 2000) depend on OS to authenticate users • Reasons: – Once an intruder is inside the OS, it is easier to access the database – Centralize administration of users • Users must be authenticated at each level © FPT Software 17
User Administration • Create user accounts • Set password policies • Grant privileges to users • Best practices: – Use a consistent naming convention – Always provide a password to an account and force the user to change it at the first logon – Protect passwords – Do not use default passwords © FPT Software 18
Creating a SQL Server User • Create a login ID first; controls access to SQL Server system • Associate login ID with a database user • Must be member of fixed server roles (SYSADMIN or SECURITYADMIN) • Two types of login IDs: – Windows Integrated (trusted) login – SQL Server login © FPT Software 19
Creating Windows Integrated Logins • Command line: – SP_GRANTLOGIN system stored procedure – Can be associated local, domain, group usernames • Enterprise Manager: – Use the Security container – Logins -> New Login © FPT Software 20