Database

Security

Curriculum

In

Infosec

Program

Database

Security

course

is

an

important

part

of

the

InfoSec

curriculum

In

many

institutions

this

is

not

taught

as

an

independent

course

Parts

of

the

contents

presented

in

this

paper

are

usually

incorporated

in

other

courses

such

as

Network

Security

The

importance

of

database

security

concepts

stems

from

the

fact

that

a

compromise

of

data

at

rest

could

expose

an

organization

to

a

greater

security

threat

than

otherwise

Database

vulnerabilities

exposed

recently

in

several

high

profile

incidents

would

be

a

good

reason

to

dedicate

a

full

course

to

this

important

topic

In

this

paper

we

present

key

topics

such

as

technologies

for

database

protection

access

control

multilevel

security

database

vulnerabilities

and

defenses

privacy

and

legal

issues

impact

of

policies

and

some

well

known

secure

database

models

H.

-LSB-

General

-RSB-

Security

Integrity

and

protection

D.

-LSB-

Security

and

Protection

-RSB-

Access

controls

Authentication

K.

-LSB-

Security

and

Protection

-RSB-

Physical

security

Information

Security

curriculum

is

receiving

greater

attention

from

many

institutions

thanks

to

the

standardization

efforts

by

the

Committee

on

National

Security

Systems

-LRB-

CNSS

-RRB-

The

CNSS

members

come

from

the

National

Security

Agency

Department

of

Defense

and

the

Department

of

Homeland

Security

among

others

The

CNSS

standardization

efforts

are

based

on

the

Presidential

Decision

Directive

-LSB-

-RSB-

issued

in

for

training

professionals

to

protect

the

nation

's

critical

infrastructure

To

achieve

this

goal

CNSS

has

developed

five

major

standards

known

as

the

National

Security

Telecommunications

Information

Systems

Security

Instruction

-LRB-

NSTISSI

-RRB-

The

NSTISSI

standards

are

numbered

and

-LSB-

-RSB-

Additional

standards

under

this

sequence

are

in

the

offing

as

well

The

relevance

of

these

standards

is

that

they

include

a

vast

number

of

topics

that

cover

the

entire

gamut

of

information

assurance

and

database

security

topics

are

included

in

many

of

these

standards

First

we

will

briefly

outline

the

main

content

of

each

of

these

standards

and

then

move

onto

the

main

content

of

this

paper

The

standard

covers

the

information

security

foundation

topics

such

as

wired

and

wireless

communications

basics

operations

security

transmission

security

information

security

from

a

policy

perspective

cryptography

key

management

legal

aspects

of

security

contingency

planning

and

disaster

recovery

risk

management

trust

auditing

and

monitoring

At

present

coverage

of

topics

mentioned

in

this

standard

is

considered

essential

by

CNSS

in

every

InfoSec

curriculum

The

standard

is

primarily

aimed

at

training

Designated

Approving

Authority

personnel

A

quick

look

at

the

following

topics

would

show

the

relationship

of

these

standards

vis

vis

database

security

The

primary

topics

of

this

standard

include

liabilities

legal

issues

security

policy

sensitive

data

access

policy

threats

vulnerabilities

incident

response

life

cycle

management

configuration

management

and

contingency

management

The

purpose

of

standard

is

to

provide

a

minimum

set

of

topics

necessary

for

certifying

Systems

Administrators

in

Information

Systems

Security

Some

of

the

topics

in

this

category

include

development

and

maintenance

of

security

policies

and

procedures

education

training

and

awareness

of

such

policies

development

of

countermeasures

for

known

attacks

as

well

as

development

of

safeguards

Also

configuration

management

is

an

important

part

of

standard

The

standard

for

training

Information

Systems

Security

Officers

is

This

standard

covers

topics

such

as

facilities

planning

business

continuity

and

password

management

access

control

policies

laws

and

regulations

related

to

information

security

privacy

encryption

standards

intrusion

detection

audit

tools

and

security

reviews

The

last

standard

currently

in

place

in

this

series

is

numbered

This

standard

is

for

training

System

Certifiers

Among

the

main

topics

here

are

defining

roles

and

responsibilities

for

personnel

certification

of

systems

identifying

process

Permission

to

make

digital

or

hard

copies

of

all

or

part

of

this

work

for

personal

or

classroom

use

is

granted

without

fee

provided

that

copies

are

not

made

or

distributed

for

profit

or

commercial

advantage

and

that

copies

bear

this

notice

and

the

full

citation

on

the

first

page

To

copy

otherwise

or

republish

to

post

on

servers

or

to

redistribute

to

lists

requires

prior

specific

permission

and/or

a

fee

Information

Security

Curriculum

Development

-LRB-

InfoSecCD

-RRB-

Conference

September

Kennesaw

GA

USA

Copyright

ACM

Permission

to

make

digital

or

hard

copies

of

all

or

part

of

this

work

for

personal

or

classroom

use

is

granted

without

fee

provided

that

copies

are

not

made

or

distributed

for

profit

or

commercial

advantage

and

that

copies

bear

this

notice

and

the

full

citation

on

the

first

page

To

copy

otherwise

or

republish

to

post

on

servers

or

to

redistribute

to

lists

requires

prior

specific

permission

and/or

a

fee

Information

Security

Curriculum

Development

-LRB-

InfoSecCD

-RRB-

Conference

September

Kennesaw

GA

USA

Copyright

ACM

boundaries

integration

security

engineering

and

applications

security

These

five

standards

have

been

in

place

since

and

are

constantly

getting

updated

by

CNSS

Traditionally

the

following

courses

are

considered

as

a

set

of

foundation

courses

Network

Security

Information

Security

and

Cryptography

Usually

these

courses

are

augmented

by

additional

courses

such

as

Operating

System

Security

Database

Security

Secure

E-commerce

and

Security

Management

In

our

curriculum

at

the

University

of

Louisville

we

are

offering

the

three

foundation

courses

listed

above

and

the

Database

Security

course

The

main

purpose

of

this

paper

is

to

identify

several

topics

that

could

be

included

in

a

Database

Security

course

In

the

last

quarter

of

and

the

first

quarter

of

several

incidents

of

theft

or

loss

of

data

from

databases

of

large

organizations

have

brought

to

light

the

vulnerabilities

in

managing

database

systems

Every

organization

depends

heavily

on

databases

both

large

and

small

in

order

to

manage

inventory

human

resources

and

business

functions

on

a

day

to

day

basis

Therefore

in

order

to

mitigate

risk

every

organization

must

take

adequate

steps

to

protect

the

data

that

they

hold

Issues

related

to

technology

as

well

as

policies

are

important

for

the

protection

of

data

Such

topics

form

the

core

of

this

Database

Security

course

which

we

will

discuss

in

greater

detail

in

the

remaining

sections

At

the

University

of

Louisville

-LRB-

U

of

L

-RRB-

InfoSec

courses

are

offered

in

two

departments

The

Computer

Information

Systems

-LRB-

CIS

-RRB-

department

in

the

College

of

Business

offers

an

undergraduate

concentration

in

InfoSec

-LSB-

-RSB-

The

Computer

Science

department

in

the

college

of

Engineering

offers

graduate

courses

in

InfoSec

at

the

masters

and

doctoral

levels

Database

security

course

is

offered

as

the

second

course

in

database

the

first

course

being

the

standard

database

design

and

management

course

Students

taking

the

database

security

course

are

either

juniors

or

seniors

and

are

expected

to

have

experience

with

one

of

the

mainframe

commercial

databases

such

as

Oracle

or

SQL

Server

The

major

course

objectives

were

for

students

to

Learn

the

fundamental

concepts

in

database

security

Understand

how

access

controls

work

in

a

database

Learn

to

develop

and

manage

secure

database

architectures

Be

familiar

with

the

laws

governing

computer

privacy

Understand

the

alternatives

to

encrypting

data

at

rest

Understand

the

security

implementations

and

vulnerabilities

in

commercial

database

systems

such

as

Oracle

and

SQL

Server

Learn

security

audit

methods

Learn

about

multi-level

database

security

The

course

content

was

covered

using

material

from

many

sources

primarily

research

papers

The

Database

Security

book

by

Castano

et

al

is

an

out

of

print

book

as

it

was

originally

developed

in

The

Database

Security

and

Auditing

book

by

Afyouni

was

printed

in

April

and

so

was

not

available

when

the

semester

started

In

the

course

we

used

two

SQL

Server

Security

books

which

were

available

in

print

and

one

Oracle

Security

book

that

was

available

in

electronic

form

through

Safari

books

These

books

contributed

to

reinforcing

concepts

discussed

by

testing

several

attack

methods

Another

special

feature

of

teaching

the

Database

Security

course

was

the

availability

of

a

dedicated

InfoSec

Lab

We

will

discuss

the

contribution

of

the

InfoSec

Lab

later

in

this

paper

The

initial

emphasis

in

the

course

was

on

incorporating

database

security

concepts

during

the

design

phase

The

primary

reason

for

this

emphasis

was

on

the

need

for

integration

of

various

components

of

an

information

system

Since

database

security

is

heavily

dependent

on

network

security

operating

system

security

physical

security

and

other

applications

security

such

an

integrated

approach

is

essential

for

an

appreciation

of

design

decisions

The

course

content

was

arranged

in

such

a

way

that

both

technology

and

policy

aspects

were

equally

emphasized

This

emphasis

was

motivated

by

the

fact

that

there

are

several

legal

requirements

to

be

met

and

people

's

privacy

must

be

protected

A

compromised

database

endangers

the

privacy

of

individuals

by

the

release

of

personal

information

such

as

social

security

number

date

of

birth

credit

card

numbers

and

health

history

An

important

part

of

database

security

is

access

control

There

are

several

types

of

access

controls

that

are

available

for

the

database

administrator

to

work

with

More

importantly

choosing

the

proper

type

of

access

control

enables

the

allocation

and

revocation

of

privileges

to

individuals

for

various

components

of

the

database

The

three

types

of

access

controls

discussed

related

to

Mandatory

Access

Control

-LRB-

MAC

-RRB-

Discretionary

Access

Control

-LRB-

DAC

-RRB-

and

Role-based

Access

Control

-LRB-

RAC

-RRB-

A

simple

example

of

MAC

would

be

that

of

using

a

suitable

password

for

database

access

However

practical

uses

of

databases

always

require

overriding

a

default

access

privilege

for

a

specific

event

In

such

instances

one

uses

Discretionary

Access

Control

Since

database

privileges

sometimes

have

the

inheritance

property

it

becomes

essential

to

understand

how

the

particular

commercial

system

would

handle

DAC

The

most

important

of

access

controls

is

Role-based

Access

Control

Discussion

of

this

topic

showed

the

various

nuances

involved

in

assigning

access

privileges

in

a

timely

manner

without

hindering

productivity

and

at

the

same

time

providing

security

All

necessary

database

accesses

could

be

associated

with

a

specific

role

that

an

individual

performs

in

an

organization

Since

roles

change

often

and

consequently

access

needs

change

as

well

it

is

much

easier

to

manage

access

control

by

associating

privileges

with

roles

It

is

worth

noting

that

these

three

types

of

access

controls

are

not

mutually

exclusive

but

work

in

combinations

that

suit

the

organizational

needs

Another

important

aspect

of

database

security

is

authentication

Since

databases

provide

many

views

of

the

data

suitable

privileges

for

the

ability

to

drill

down

data

requires

appropriate

authentication

The

authentication

aspect

of

database

access

supports

the

confidentiality

in

the

CIA

-LRB-

Confidentiality-Integrity

Availability

-RRB-

triangle

that

is

basic

to

information

security

Authentication

models

discussed

include

single-factor

two-factor

and

three-factor

authentication

and

the

attendant

performance

issues

Among

the

many

topics

covered

in

this

course

one

of

the

important

ones

relates

to

Multi-Level

Secure

-LRB-

MLS

-RRB-

databases

-LSB-

-RSB-

Commercial

databases

such

as

Oracle

or

SQL

Server

do

not

handle

the

MLS

aspects

in

their

software

However

it

is

an

important

aspect

to

be

aware

of

For

example

in

an

organization

not

every

one

has

the

access

rights

to

view

confidential

information

Database

queries

are

designed

to

pull

all

data

that

satisfy

the

query

condition

In

the

MLS

environment

the

query

condition

would

not

necessarily

reflect

the

security

level

of

the

person

making

the

query

Since

the

security

level

authorization

of

the

individual

running

the

query

is

known

from

the

login

time

the

MLS

database

is

supposed

to

show

all

data

that

is

cleared

for

that

level

of

user

Usually

the

security

levels

could

be

unclassified

confidential

secret

or

top

secret

Not

all

fields

of

data

in

a

record

would

need

to

be

carrying

a

classification

Those

sensitive

data

that

have

an

associated

security

classification

should

be

able

to

serve

the

needs

of

users

with

the

appropriate

security

clearance

and

hide

the

data

from

others

A

major

problem

to

overcome

in

this

context

is

known

as

polyinstantiation

-LSB-

-RSB-

This

concept

refers

to

the

fact

that

if

persons

with

a

lower

clearance

level

have

reason

to

suspect

the

existence

of

a

record

with

hidden

values

then

they

would

be

able

to

infer

Polyinstantiation

could

be

addressed

to

a

large

extent

by

allowing

certain

redundancies

in

a

database

Another

common

problem

with

MLS

databases

is

the

presence

of

inference

channel

Inference

channel

leaks

information

about

data

classified

at

a

higher

level

to

users

with

lower

level

clearances

-LSB-

-RSB-

Security

policies

also

play

an

important

role

in

protecting

against

inference

channel

leaks

A

related

approach

to

this

problem

is

to

develop

classification

constraints

on

data

These

data

classifications

are

then

used

at

query

time

and

then

the

appropriate

level

of

the

constraint

is

applied

to

the

resulting

data

before

it

is

presented

to

the

user

In

this

context

we

discussed

the

security

architecture

for

databases

This

was

broadly

classified

as

those

systems

that

use

a

Trusted

Computing

Base

-LRB-

TCB

-RRB-

that

is

external

to

the

DBMS

and

those

systems

that

manage

access

to

data

through

the

DBMS

-LSB-

-RSB-

In

the

TCB

architecture

the

access

controls

were

usually

handled

by

the

operating

system

or

the

network

In

the

DBMS

control

architecture

security

design

involved

multi-factor

authentication

as

well

as

security

clearance

and

role-based

access

As

part

of

the

secure

architecture

topic

we

studied

the

Bell-LaPadula

Model

and

the

Biba

Model

-LSB-

-RSB-

Then

we

took

a

detailed

look

at

the

Seaview

Model

-LSB-

-RSB-

This

is

the

first

paper

that

studied

in

detail

the

security

needs

for

database

systems

that

contained

data

with

various

levels

of

security

clearances

The

major

contribution

of

this

paper

was

the

application-independent

nature

of

data

integrity

with

particular

reference

to

entity

integrity

referential

integrity

and

polyinstantiation

integrity

We

studied

additional

secure

architecture

topics

with

particular

reference

to

commercial

database

systems

These

topics

include

input

validation

credential

handling

and

encryption

Encryption

is

a

major

topic

in

itself

in

the

security

context

Usually

encryption

is

an

important

tool

for

data

in

transit

However

the

recent

spate

of

incidents

involving

lost

or

stolen

data

-LSB-

-RSB-

shows

the

need

for

protecting

data

at

rest

from

falling

into

the

wrong

hands

One

useful

tool

in

this

regard

is

encryption

We

studied

the

impact

of

encrypted

data

with

respect

to

performance

Usually

encryption

of

sensitive

data

at

rest

is

a

desirable

feature

provided

the

access

to

such

data

is

not

frequent

On

the

other

hand

for

data

that

is

frequently

used

the

better

alternative

to

encryption

would

be

to

partially

secure

storage

-LSB-

-RSB-

whereby

the

data

management

is

handled

by

an

independent

system

that

works

outside

the

operating

system

control

This

technique

protects

the

data

from

hackers

as

the

access

control

is

under

an

independent

system

that

is

not

manipulated

by

the

operating

system

where

most

of

the

vulnerabilities

are

exploited

In

this

context

we

studied

the

FARSITE

model

that

discusses

the

reliable

storage

aspects

in

an

incompletely

trusted

environment

such

as

the

Internet

-LSB-

-RSB-

This

research

performed

at

Microsoft

shows

how

to

harness

the

collective

resources

of

loosely

coupled

insecure

and

unreliable

machines

to

provide

logically

centralized

secure

and

reliable

file-storage

service

The

next

major

topic

covered

was

security

audit

for

a

database

The

sources

used

for

this

topic

were

Jajodia

-LSB-

-RSB-

Andrews

-LSB-

-RSB-

and

material

from

the

Congressional

Hearing

reference

provided

in

the

References

section

Audit

involves

different

components

such

as

login

access

and

storage

Commercial

database

systems

such

as

Oracle

and

SQL

Server

facilitate

login

auditing

in

a

simple

way

For

example

in

SQL

Server

the

user

could

set

the

login

audit

level

to

any

one

of

four

levels

Level

does

not

log

any

information

about

the

logins

level

logs

information

about

successful

logins

only

level

logs

information

about

unsuccessful

logins

only

and

level

logs

information

about

all

attempted

logins

This

aspect

of

setting

the

appropriate

level

is

related

to

the

security

policy

of

the

organization

An

organization

might

feel

that

they

need

to

know

only

those

people

who

attempted

a

login

and

failed

as

the

ones

who

successfully

logged

in

are

considered

authorized

users

This

is

not

a

good

assumption

when

it

comes

to

computer

forensics

where

one

is

trying

to

reconstruct

an

event

that

happened

in

the

past

Consequently

organizations

must

consider

the

impact

of

their

policies

when

it

comes

to

information

security

Auditing

is

also

mandated

by

certain

accreditation

bodies

In

order

to

satisfy

certain

data

security

requirements

some

organizations

might

have

to

secure

level

security

rating

from

the

National

Computer

Security

Center

-LRB-

NCSC

-RRB-

The

NCSC

certification

is

measured

according

to

the

Department

of

Defense

Trusted

Computer

System

Evaluation

Criteria

-LSB-

-RSB-

We

concluded

the

course

with

an

analysis

of

database

protection

copyright

and

privacy

aspects

both

from

a

policy

and

legal

perspective

First

we

discussed

the

Congressional

hearing

on

Database

and

Collections

of

Information

Misappropriation

Act

of

This

hearing

showed

the

limitations

of

Copyright

laws

and

how

U.S.

courts

have

interpreted

the

laws

that

protect

privacy

We

then

studied

the

future

of

the

database

protection

in

U.S.

and

the

laws

to

help

in

this

regard

U.S.

court

rulings

including

that

of

the

Supreme

Court

have

shown

that

sweat

of

the

brow

argument

does

not

offer

protection

for

databases

rather

the

demonstration

of

some

form

of

originality

in

data

collection

and

dissemination

is

essential

for

database

ownership

A

court

ruling

in

in

United

Kingdom

in

the

case

of

the

British

Horseracing

Board

-LRB-

BHB

-RRB-

has

once

again

brought

into

focus

the

sweat

of

the

brow

argument

The

U.K.

court

upheld

the

BHB

's

claim

of

ownership

of

data

pertaining

to

horses

and

jockeys

-LSB-

-RSB-

It

remains

to

be

seen

how

the

U.S.

courts

would

consider

challenges

to

the

sweat

of

the

brow

argument

when

it

comes

to

protecting

large

databases

from

competitors

In

this

course

we

used

several

different

types

of

evaluation

tools

Students

were

required

to

write

three

individual

research

reports

on

topics

provided

in

class

The

topics

were

Buffer

overflows

Security

audit

Sarbanes

Oxley

Act

and

its

impact

on

Database

Security

On

the

testing

side

we

used

a

closed

book

closed

notes

midterm

and

final

examinations

All

questions

were

essay

type

The

students

had

access

to

a

dedicated

InfoSec

lab

where

they

could

perform

several

different

types

of

hands-on

testing

for

vulnerabilities

-LSB-

-RSB-

The

InfoSec

Lab

has

workstations

on

a

LAN

connected

to

a

Windows

server

First

the

SQL

Server

was

installed

on

the

server

Two

stand-alone

computers

that

were

not

connected

to

the

network

were

also

provided

to

the

students

for

testing

The

first

assignment

provided

a

chance

for

the

students

to

install

SQL

Server

and

choose

appropriate

security

settings

for

various

components

of

the

database

The

students

then

created

new

SQL

Server

accounts

on

the

stand-alone

computers

and

granted

suitable

privileges

first

and

then

tested

the

DENY

and

REVOKE

features

as

well

The

students

had

to

install

the

latest

SQL

Server

patches

on

the

stand-alone

computers

and

test

for

vulnerabilities

The

dedicated

lab

environment

provided

an

excellent

facility

for

us

to

allow

students

to

understand

how

a

hacker

would

gain

routine

information

about

the

database

system

First

the

SQL

Server

was

left

unpatched

and

the

students

used

the

SQL

utility

to

gather

information

about

the

database

system

This

showed

the

port

in

use

Then

the

SQL

Server

was

patched

with

version

and

the

students

tried

the

same

SQL

utility

this

time

finding

a

different

type

of

information

about

the

SQL

Server

Next

the

SQL

Server

was

put

in

hide

mode

and

the

students

found

out

this

piece

of

information

by

noticing

that

the

listening

port

had

changed

to

We

were

able

to

accomplish

this

testing

by

making

changes

to

the

SQL

Server

every

two

days

giving

a

short

time

between

changes

for

testing

This

was

done

as

assignment

The

third

assignment

involved

testing

Bulk

Copy

Bulk

Insert

features

of

SQL

Server

The

fourth

assignment

involved

a

buffer

overflow

attack

A

sample

code

was

given

to

the

students

to

try

the

buffer

overflow

attack

on

the

patched

server

The

patched

server

foiled

the

attack

The

students

were

then

asked

to

test

the

same

buffer

overflow

attack

on

the

stand-alone

computers

where

patches

were

not

applied

The

last

assignment

involved

SQL

Injection

attack

The

students

were

given

a

series

of

codes

for

the

SQL

Injection

attack

testing

The

first

part

involved

logging

into

a

SQL

Server

database

system

knowing

the

userid

of

the

user

but

not

the

password

The

second

part

involved

not

knowing

the

userid

or

the

password

The

third

part

involved

creating

a

new

user

and

then

exploiting

the

system

The

fourth

part

involved

finding

the

password

of

the

sa

account

The

fifth

part

involved

dropping

the

SQL

Server

from

the

server

and

shutting

down

the

SQL

Server

via

SQL

Injection

attack

The

students

were

given

the

challenge

in

the

fourth

part

of

the

SQL

Injection

attack

testing

to

find

out

the

strong

password

used

on

the

server

which

had

all

the

latest

patches

both

for

the

SQL

Server

part

and

the

operating

system

part

This

required

more

work

beyond

the

SQL

knowledge

One

of

the

students

succeeded

in

finding

out

the

server

password

not

just

the

sa

password

which

was

much

easier

to

get

using

SQL

Injection

Overall

the

students

enjoyed

the

content

of

the

course

that

involved

learning

many

database

security

concepts

and

the

ability

to

test

many

aspects

of

SQL

Server

installation

suitable

settings

detect

vulnerabilities

develop

simple

countermeasures

and

have

the

ability

to

use

the

logs

to

detect

intrusion

This

research

was

supported

in

part

by

the

NSF

grant

and

the

Kentucky

Council

on

Postsecondary

Education

grant

-LSB-

-RSB-

Abrams

M.

D.

Jajodia

S.

Podell

H.

J.

Information

Security

An

integrated

collection

of

essays

IEEE

Computer

Society

Press

CA

-LSB-

-RSB-

Adya

A.

Bolosky

W.J.

Castro

M.

Cermak

G.

Chaiken

R.

Douceur

J.

Howell

J.

Lorch

J.R.

Theimer

M.

and

Wattenhofer

R.P.

FARSITE

Federated

Available

and

Reliable

Storage

for

an

Incompletely

Trusted

Environment

Proceedings

of

the

th

Symposium

on

Operating

Systems

Design

and

Implementation

Boston

MA

December

-LSB-

-RSB-

Afyouni

H.

A.

Database

Security

and

Auditing

Course

Technology

MA

-LSB-

-RSB-

Andrews

C.

Litchfield

D.

Grindlay

B.

SQL

Server

Security

Fundamentals

McGraw-Hill/Osborne

NY

-LSB-

-RSB-

Castano

S.

Fugini

M.

Martella

G.

Samarati

P.

Database

Security

ACM

Press

Books

-LRB-

Diane

Publishing

Co.

-RRB-

NY

-LSB-

-RSB-

Cerrudo

C.

Manipulating

Microsoft

SQL

Server

Using

SQL

Injection

ishing

r

Accessed

on

-LSB-

-RSB-

CERT

Accessed

on

-LSB-

-RSB-

CNSS

Stds

National

IA

Education

Standards

-LSB-

-RSB-

Congressional

Hearing

Database

and

Collections

of

Information

Misappropriation

Act

of

September

Accessed

on

-LSB-

-RSB-

Duke

University

The

Future

of

Database

Protection

in

U.S.

Copyright

Law

Accessed

on

-LSB-

-RSB-

Hinke

T.

Multilevel

Secure

Database

Management

Prototypes

in

Information

Security

An

Integrated

Collection

of

Essays

edition

st

Edited

by

Abrams

M.D.

Jajodia

S.G.

Podell

H.J.

Essay

IEEE

Computer

Society

Press

CA

-LSB-

-RSB-

Jajodia

S.

and

Sandhu

R.

Toward

a

Multilevel

Secure

Relational

Model

in

Information

Security

An

Integrated

Collection

of

Essays

edition

st

Edited

by

Abrams

M.D.

Jajodia

S.G.

Podell

H.J.

Essay

IEEE

Computer

Society

Press

CA

-LSB-

-RSB-

Jajodia

S.

Sandhu

R.

and

Blaustein

B.T.

Solutions

to

the

Polyinstantiation

Problem

in

Information

Security

An

Integrated

Collection

of

Essays

edition

st

Edited

by

Abrams

M.D.

Jajodia

S.G.

Podell

H.J.

Essay

IEEE

Computer

Society

Press

CA

-LSB-

-RSB-

Jajodia

S.

and

Meadows

C.

Inference

problems

in

multilevel

secure

database

management

systems

in

Information

Security

An

Integrated

Collection

of

Essays

edition

st

Edited

by

Abrams

M.D.

Jajodia

S.G.

Podell

H.J.

Essay

IEEE

Computer

Society

Press

CA

-LSB-

-RSB-

Jajodia

S.

Gadia

S.K.

and

Bhargava

G.

Logical

Design

of

Audit

Information

in

Relational

Databases

in

Information

Security

An

Integrated

Collection

of

Essays

edition

st

Edited

by

Abrams

M.D.

Jajodia

S.G.

Podell

H.J.

Essay

IEEE

Computer

Society

Press

CA

-LSB-

-RSB-

Lewis

M.

SQL

Server

Security

Distilled

nd

edition

Apress

CA

-LSB-

-RSB-

Lunt

T.

Denning

D.

E.

Schell

R.

R.

Heckman

M.

and

Shockley

W.

R.

The

Seaview

Security

Model

IEEE

Transactions

on

Software

Engineering

-LRB-

-RRB-

June

-LSB-

-RSB-

Mao

W.

Modern

Cryptography

Prentice-Hall

NJ

-LSB-

-RSB-

Meadows

C.

and

Jajodia

S.

Integrity

in

Multilevel

Secure

Database

Management

Systems

in

Information

Security

An

Integrated

Collection

of

Essays

edition

st

Edited

by

Abrams

M.D.

Jajodia

S.G.

Podell

H.J.

Essay

IEEE

Computer

Society

Press

CA

-LSB-

-RSB-

Nevins

S.C.

Database

security

breaches

on

the

rise

asp?article

id

Accessed

on

-LSB-

-RSB-

Nessus

Accessed

on

-LSB-

-RSB-

Notargiacomo

L.

Architectures

for

MLS

Database

Management

Systems

in

Information

Security

An

Integrated

Collection

of

Essays

edition

st

Edited

by

Abrams

M.D.

Jajodia

S.G.

Podell

H.J.

Essay

IEEE

Computer

Society

Press

CA

-LSB-

-RSB-

O'Reilly

Publishers

Developing

a

Database

Security

Plan

Accessed

on

-LSB-

-RSB-

Accessed

on

-LSB-

-RSB-

Pernul

Gunther

Database

Security

chapter

in

Advances

in

Computers

Edited

by

M.C.Yovits

vol

Academic

Press

NY

-LSB-

-RSB-

Rob

P.

and

Coronel

C.

Design

Implementation

and

Management

th

Edn.

Course

Technology

MA

-LSB-

-RSB-

Sandhu

R.

and

Samarati

P.

Access

Control

Principles

and

Practice

IEEE

Communications

Magazine

vol

September

-LSB-

-RSB-

Sandhu

R.

Coyne

E.J.

Feinstein

H.

L.

and

Youman

C.E.

Role-based

Access

Control

Models

IEEE

Computer

vol

February

-LSB-

-RSB-

SANS

Accessed

on

-LSB-

-RSB-

Solworth

J.

A.

Integrating

Discretionary

and

Mandatory

Access

Controls

f.

Accessed

on

-LSB-

-RSB-

Son

S.

H.

Chaney

C.

and

Thomlinson

N.

P.

Partial

Security

Policies

to

Support

Timeliness

in

Secure

Real

time

Databases

Proceedings

of

the

IEEE

Symposium

on

Security

and

Privacy

May

-LSB-

-RSB-

Srinivasan

S.

Design

and

Development

of

an

Information

Security

Laboratory

Proceedings

of

the

th

Annual

Colloquium

on

Information

System

Security

Education

Atlanta

GA

June

-LSB-

-RSB-

Strunk

J.D.

Goodson

G.R.

Scheinholtz

M.L.

Soules

C.A.N.

and

Ganger

G.R.

Self-Securing

Storage

Protecting

Data

in

Compromised

Systems

Foundations

of

Intrusion

Tolerant

Systems

-LSB-

-RSB-

Theriault

M.

and

Heney

W.

Oracle

Security

O'Reilly

Publishers

IN

-LSB-

-RSB-

Tomson

B.

SQL

Server

Security

Best

Practices

Accessed

on

-LSB-

-RSB-

UofL

InfoSec

InfoSec

Program

website

-LSB-

-RSB-

Wall

Street

Journal

ChoicePoint

struggles

to

gauge

how

much

information

fell

into

wrong

hands

May

Page

B B O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B B O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B I O O B O B O O O O B O O O O O O O O O O O O B O O O O O O O B O O O O O O O B O O O O O O B O O O B O O O O B O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O B O O B O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O B B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B O B O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O B O B B O O O O O B O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O B O O O O O O O B O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O B O O O O O O B O O O O O O O O B O O O O O O O O O O B O O O O O B O O O O O O O O O B O O O O O B B O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O B O O O B O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B B O B I O O O O O O O O O O O O O B O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B O O O O O O O O O O O B I O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O B O O O O O O O O O O O O O O O O O O O O O B O O B O O B O O O O O O B O O O O O O O O O O O B O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O B I O B I O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O B O B O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O

inference channel
database
buffer overflows
encryption
access control
security
authentication
policy
inference
cia
polyinstantiation
privacy