Abstract:
Our society is increasingly dependent on computers and more data than ever before are stored and manager by computerized information systems. Sophisticated software tools (database management systems, DBMS) have been developed to aid the development and maintenance of complex databases. Also, most real life databases contain some sensitive data such as confidential or critical information. Database security consists of a set of measures, policies and mechanisms to protect sensitive information from improper disclosure (data confidentiality), modification (data integrity) or denial of service (data availability). Traditional database security techniques within the DBMS, provide physical security (e.g., backup/recovery) and enforce organizational constraints (e.g., database dependencies, integrity constraints). However, they are not adequate to protect data against unauthorized logical accesses (that is, via software tools). During the last 15 years, new access control models emerged, addressing some of the aspects of logical security. Most recently, the development of integrated, heterogeneous database systems and web-enabled databases makes database security even more complex then before.
In this seminar I will talk about logical database security concerns. The main focus is on how to provide controlled data accesses to users. I'll briefly explain the different access control directions, such as discretionary, mandatory and role-based access controls, their advantages and limitations. Finally, I'll mention some of the current research problems and my thoughts on them.