Flashcards
SCC 201 - Advanced SQL and Security
Cards in this deck (19)
- 1Difference between views and base tables?Views are virtual tables
– Do not necessarily exist in physical form
– As opposed to base tables whose tuples are actually stored in a
database - 2If same query frequently executed on database, makes sense to– Define view based on results of query, and
– Use simpler query to retrieve tuples of interest from view
– Particularly useful if original query is complex,
e.g. involves a number of joins - 3Command used to drop views?DROP VIEW
- 4Why do we use quotes and auto_increment?• Note use of quotes so names aren’t misinterpreted
• auto_increment used to create unique key on INSERT - 5What is discretionary access control?Each user is given appropriate access rights (or privileges) on specific database objects.
Users obtain certain privileges when they create an object
– They can pass some or all of these privileges to other users at their discretion - 6Name a DBMS that uses discretionary access control?• This approach is used in SQL
- 7What is c.f Mandatory access control?Each database object is assigned a classification level
– i.e. top secret, secret, confidential, unclassified
• The levels form a strict ordering
– top secret > secret > confidential > unclassified
• Each subject (user or program) given a clearance level - 8How do you access an object using mandatory access control?To access an object, a subject requires the necessary clearance to read or write a database object
– See the Bell-LaPadula access control model (1974) - 9What is the Bell-Lapudula access control model?The Bell–LaPadula Model (BLP) is a state machine model used for enforcing access control in government and military applications. ... The model is a formal state transition model of computer security policy that describes a set of access control rules which use security labels on objects and clearances for subjects.
- 10What is an authorisation identifier?An SQL identifier used to establish the identity of a user
- 11Every SQL statement executed by the DBMS is performed on behalf of what?Every SQL statement executed by the DBMS is performed
on behalf of a specific user - 12Access rights associated with a user determine what?– Database objects a user can reference, and
– What operations can be performed by that user - 13Each object created in SQL has an owner, how is the owner identifed?Each object created in SQL has an owner
• Owner is identified by the authorisation identifier - 14Where is the authorization identifier defined?– Defined in AUTHORIZATION clause of schema to which the
object belongs - 15Complete this statement, • Owner is initially only person…– Who knows that object exists, and
– Can subsequently perform operations on that object - 16When you create a table, who has full privileges and how is permission granted?When you create a table,
you are owner and have full privileges
• Other users have no access,
and must be GRANTed permissions by the owner - 17When you create a view, who is the owner and what type of privileges do you get?When you create a VIEW, you are owner of the view, but may not have full privileges
– You must have SELECT privilege on base table(s) to create VIEW in the first place - 18What does the revoke statement do?• The REVOKE statement can take away all or some of the privileges previously GRANTed
- 19What does the networked database servers do?• Protect database behind firewall
• Only allow restricted/ defined access from known front-end server
• Don’t pass unchecked strings into queries
– Use well tested access functions/ methods
Information
- Description
- Flashcards on SCC 201 - Advanced SQL and Security, created by Ayo Olutobi on 13/04/2017.
- Created by
- Ayo Olutobi
- Views
- 1
- Rating