This essay has been submitted by a student. This is not an example of the work written by our professional essay writers.
To avoid daily basis problems such as misusing data, invalid user access account and accessing unauthorized features database administrators (DBA) need to perform the database maintenance everyday.
For example, employees can only view the employee records, they have no write authority. i.e., employees have read only access to database. Manager can view and update or delete the employee records so they have both read and write access to database. If unauthorized users attempt to access data that exceed their authority, the application needs to decide which access should be allowed to which users. If an employee is wrongly assigned to manager access account then the employee can both view and edit unauthorizedly. Therefore, database audit logs and daily maintenance are very important for database security.
2. Varied security methods for applications
Most of the applications developers will be used to change and utilize the security methods for different applications that are connected to the organization's database. This can lead the organization's sensitive data to be getting access by unauthorized user or application because this can make the production of security policies to be difficult. The developer should not vary often the security method for an application, although the system should keep the latest security methods and current trends such as secret key methods, cryptography, digital signatures and certificates to against the potential threats.
3. Post-upgrade evaluation
Sometimes organizations need to upgrade the database. Whenever there is an upgrade of a database, the database administrator needs to perform a post-upgrade evaluation for the security to ensure that it is consistent and is not compromised. If the post-upgrade evaluation is not performed then the database may cause to allow any unauthorized access, may be attacked and can lead to the issues and threats of database security.
4. Split the position
In an organization, all the positions should be assigned the specific duties accordingly. Sometimes organizations fail to divide the responsibilities clearly between the IT specialist and the database administrator. Instead, the IT specialist has to do everything and take all responsibilities because of some company policies such as it tries to save the wages. If it is so, the database security can compromised definitely. Actually the IT specialist should take just the duty of the managing the database whilst the database administrator is assigned to perform daily maintenance (as described above) of the database.
5. Application spoofing
Spoofing means, in simplest, typing in a various user's credentials by personating a user or program in terms of accessing and changing the contents of a cookie without authorization. Thus, keeping a password or other credentials in a cookie can lead to the issues and threats of database security because a malicious user can easily access it. So, some authentications are required to ensure that someone tried to access to the credential data is a specific authorized user.
If an organization fails to authenticate the user properly, then hackers can create some applications similar to the authorized applications that are already existed and connected to the organization's database. So these applications are difficult to distinguish and allow hackers get access to the database, these are also a big issues and threats of database security.
6. Manage user passwords
Sometimes IT database security managers will forget to remove IDs and access privileges of former users which leads to password vulnerabilities in the database. Password rules and maintenance needs to be strictly enforced to avoid opening up the database to unauthorized users.
Database password rules and maintenance should be avoided firmly unauthorized users access. If database administrator forgets to eliminate the former users' IDs and access privileges, then the database can face password vulnerabilities such as organizational or end-user vulnerabilities (i.e. lack of password policies within organization and lack of responsiveness on the part of end user) and technical vulnerabilities (i.e. insecure storage of passwords and weak encryption methods on computer system ).
7. Windows OS flows
An organization will not get an effectively secure application by using the windows operation systems as the database security. Nevertheless it can use windows integrated security such as Visual SourceSafe Database to restrict access to the organization's database and manage permissions in the VSS database. However, DBA still need to take daily maintenance to avoid daily basis issues and problems.