This final assignment is the logical continuation of assignment #1. In assignment #1, you researched...

Question

This final assignment is the logical continuation of assignment #1. In assignment #1, you researched your organization or school to determine its database architecture, and you designed an Assessment and Analysis plan (Phase 1 of the Security Architecture Cycle) for your organization. In particular, you had to:
- Identify the assets to be protected
- Define and prioritize the threats against those assets
In this final assignment, you are asked to (partially) implement Phase 2 of the Security Architecture Cycle (“Design and Modeling”, described on page 25 of the textbook). Armed with the knowledge you acquired during this term, you should be able to write policies and to prototype a security architecture that fit the needs of the business (or school) you selected in assignment #1. In particular, you should address:
- What security policiesneed to be put into place in order to mitigate the identified threats? Security Policies are addressed on page 27. Some additional guidelines and examples are given below.
- What firmware/software changes need to take place to minimize vulnerabilities and support policies? Given the database management system used in your selected environment and given the policy requirements, what changes in software version/configuration must be done?
- What security tools or applications should be added to minimize risk?
You are asked to include the description of the environment, the identified assets and threats from assignment #1 in the final assignment. Please feel free to make some "guesses" about the described environment. Your final submission should be professional-looking. The expected length is between 6 to15 pages.
-------------------------------------------------------------------------------------------------

Guidelines for writing the policy:
- A security policy describes what it means for an organization to be secure. It is an agreed upon document that executive management uses to communicate its security goals and objectives. Thus, the language should be appropriate for all employees.
- The goal of such a policy is generally to protect valuable and/or confidential information from unauthorized access, but also to limit legal liability and prevent waste or inappropriate use of organization resources. Phrases such as “must”, “should”, or “will” are used to establish baseline expectations for behavior by employees and to authorize audits and monitoring.
- A security policy typically includes:
  - Scope (1 paragraph)
  - Goals (1 paragraph)
  - Information classification (1-2 paragraphs)
  - Actual requirements: as an itemized list. Specifically, database policy statements could address:
    - Roles and responsibilities: Roles at the organization level could include application developer, database user, database administrator, database owner, application owner etc. Responsibilities should be designated.
    - Database access types
    - Authentication and authorization – a password policy should be defined or referenced
    - Use of encryption (files, data in transit, backup files), managing encryption keys
    - Backups and recovery (weekend or weekdays, on-line or off-line, incremental or full, etc.)
    - Audits (auditor, frequency of audits, what is audited)
    - Use of multi level security
    - Use virtual private databases
    - Database servers hardening (firewall/intrusion detection system, secure configuration, patch management, vulnerability assessment)
    - Change management (ensure privileged accounts are documented, administered, monitored, and reviewed)
  - Reference to supporting documents (existing procedures and guidelines)
  - Reference to regulatory compliance (if any)
  - Consequences for non-compliance of the security policy (1 – 2 paragraphs)
The following are sample security policies that could help you develop your database security policy:
- server security policy (http://www.sans.org/security-resources/policies/server-security/pdf/server-security-policy ) ,
- Mobile Employee Endpoint Responsibility Policy (http://www.sans.org/security-resources/policies/retired/pdf/mobile-employee-endpoint-responsibility-policy )

Robert · Accepted Answer

Security Analysis Plan  1
Security Analysis Plan 
Introduction 
Data or information can be considered as the most significant resources in any association. 
Organizations such social, legislative, educative etc. have now modified their data frameworks as 
well as other working operations. They have supported the databases that contain the sensitive 
information. This is the main cause for the database security to be considered as main intrigue. In 
genuine terms database security is to keep the confidential information that is stored in servers. 
The main reason for using database security is to secure the database from any kind of illicit 
access or any type of risk. Database security requires allowing or denying client activities on the 
database as well as the objects that come under it. Associations working admirably have 
requested the privacy of their database. They don't enable the illegitimate user to have the access 
to their data. They assert the affirmation that their information is protected from any malignant or 
unforeseen differences. Protection of information and its secrecy are the main focus for the 
security of database. In this paper, we will discuss various security methods that are required to 
protect the database in the hospital. (Deepika, Soni, N., 2015). 
Assets that need to be protected 
Database architecture is fundamental to our organization in order to make the recovery as well as 
its maintenance of information simple and productive in a database. Database association and its 
contents are viewed as important corporate resources that must be precisely secured in light of 
the fact that databases are centralized point for the attackers. Much the same as alternate 
resources that need protection from the users, the significant and the sensitive information that is 
stored in system databases are few resources that mainly require furthest security. In such 
Security Analysis Plan  2
manner the best safety measures are the centralized part of any database starting from the origin 
to the outline stages. (Gaikwad, T., R. & Raut, A., B., 2014). 
Security Threats to Database Structure 
1. Excessive Privilege Abuse - If some user from the organization are conceded database access 
privileges that surpass the necessities of his or her job. There is probability of misuse of these 
privileges for the malicious reason. Eg: a system administrator in this association can change any 
staff contact data. He can have the ability to change employee salary information without 
anyone's knowledge. 
2. Legitimate Privilege Abuse - Legitimate privilege abuse happens if the authorized user 
abuses their real database benefits for the unauthorized purposes. This unauthorized access can 
be as abuse by database users, the administrators or their system manager who are responsible 
for unauthorized or deceptive access. 
3. Privilege Elevation - These are vulnerabilities in database programming where hackers can 
convert their general access privileges to administrator privileges where they could bring about 
counterfeit records, transaction of assets, as well as error of certain sensitive diagnostic data. 
Database rootkit is such type of program or a method that is hidden within the database and that 
gives administrator privileges to access the information in the database. These rootkits may even 
kill alerts that are activated by Intrusion Prevention Systems (IPS). It can be installed after 
exchanging the hidden operating system. (Rohilla, S., Mittal, P., K., 2013). 
4. SQL Injection - Database frameworks are utilized for the backend operations. Users provided 
information is frequently utilized to progressively manufacture SQL articulations that influence 
specifically to the databases. These type of injections are done for subverting the first purpose of 
Security Analysis Plan  3
the application by submitting the attacker like provided SQL articulations specifically to the 
backend database. Two types of input injections can be considered: 
1. SQL Injection  
2. NoSQL Injection. 
SQL Injection: It mainly focus the convention database framework. These attacks can be 
possible by infusing unauthorized articulations into the input fields of the application.  
NoSQL Injection: It mainly focus big data stages. This type includes embedding malicious 
articulations into big data segments such as Hive, MapReduce. In SQL as well as NoSQL 
effective infusion assault can give assailant unhindered access to the entire database. (Malik, M. 
& Patel, T., 2016). 
5. Denial of Service (DoS) - Here, all users that also includes legitimate users are not able to 
access the data in the database. Denial of service (DOS) conditions might be made by means of 
numerous procedures like a significant number of which are identified with the other specified 
vulnerabilities. Eg: DOS can be accomplished by accessing the database server. Various other 
options can include data corruption, networking flooding etc. that leads to crash of database 
server. 
6. Unpatched DBMS - As the vulnerabilities are continued to be updated on regular basis that 
are being abused by the attackers, database vendors release patches that leads to protect the 
database's sensitive data. As these patches are released they ought to be fixed instantly. In the 
event that left unpatched, programmers can figure out the fix, or can regularly discover data 
online on the most proficient method to abuse the unpatched vulnerabilities, leaving a DBMS 
significantly more defenseless so that patch get released. 
Security Analysis Plan  4
7.

This final assignment is the logical continuation of assignment #1. In assignment #1, you researched your organization or school to determine its database architecture, and you designed an Assessment...

Solution

Answer To This Question Is Available To Download

Related Questions & Answers

Submit New Assignment