A Description of Database and Web Security Architecture

DATABASE AND WEB SECURITY 6

(Author’s name)

(Institutional Affiliation)

Database security is a concern that has rapidly grown due to theincreased incidents of unauthorized exposure or loss of sensitivedata. As the amount of data collected, shared, and retained viaelectronic means enlarges, so does the necessity for a developeddatabase security. Database security provides controlled andprotected access to database contents and also preserves theconsistency, integrity, and quality of data. Therefore, the paperpresents the confidentiality, integrity, and availability (CIA)triangle as well as the concepts of authentication and authorization,the steps required for establishment of a secure database securityduring the creation of user accounts, and the consequences ofimproper executions of such steps.

CIA Triangle

The confidentiality, integrity, and availability triangle is a modeldesigned to provide guidelines for managing information security inorganizations. Confidentiality is based on the principle of leastprivilege where access of information is granted to authorizedindividuals only. Confidentiality encompasses the measures undertakento prevent sensitive data from being accessed by wrong people.Integrity entails maintaining the accuracy, trustworthiness, andconsistency of data throughout its lifecycle. Integrity constitutesmeasures such as access controls that prevent data from being alteredby unauthorized individuals when it`s being transmitted. Availabilityensures that the organization`s information is made availablewhenever it is needed. Rigorous hardware maintenance, systemupgrades, and repairs and the maintenance of a properly functioningoperating system free of software conflicts helps to enhanceavailability.

Authentication and Authorization Concept

Authentication is the mechanism by which the identity of a userundergoes verification by obtaining valid credentials. Typically,authentication allows users to enter valid usernames and validpasswords before they are granted access to certain information.Authentication ensures that users have unique credentials foracquiring access to the system. During authentication, the servercompares the credentials the user attempts to use with those storedin the database. When a similarity occurs, the user is permitted toaccess the system, and if a variance exists, authentication failureoccurs, and the user is denied access. After successfulauthentication, authorization is then required for the user toperform definite tasks. For instance, after users log into thesystem, they might attempt to issue commands. The Authorizationestablishes if users have the mandate for issuing such instructions.Therefore, authorization allows the control of access rights bydenying or granting specific permissions to authenticated users(Rouse, 2017).

Steps that Ensure Security of User Accounts

To provide sufficient level of safety for new user accounts thefollowing steps are of utmost importance.

Step 1: Select database authentication for users.

The authentication mode is selected, and usernames and passwords, aswell as other information such as the email addresses, would bestored in a table in the database.

Step 2: Set passwords.

Different unique passwords should be set for every user`s account andmust meet the complexity requirements.

Step 3: Examine roles and groups.

In this step, user roles, permissions, and group participation arelisted out, and a review is conducted to ensure users have sufficientauthorization to their duties.

Step 4: Secure administrative functions from users.

Stored utilities, procedures, functions, and roles of theadministration should not be delegated to users.

Consequences of Improper Creation of User Accounts

The steps are crucial as they help to minimize data security threatsthat exist within the information system`s architectural atmosphere.When the steps get improperly executed, inadequate userauthentication and authorization occur which may lead tovulnerabilities in the database platform. Besides, awkward andineffective access controls would be encountered leading toexploitation of database privileges by users (Shaul, 2013).

In the real world, incorrect executions of steps when creating useraccounts result in occurrence of cyber crimes. Loss ofconfidentiality and privacy is a common cybercrime effect resultedfrom exposure of personal information to malicious individuals.Companies, therefore, may lose their propriety information such assecret market intelligence or trade secrets which may make companieslose their competitive market edge. Also, theft or fraud may occurwhere people use other individuals` access to the system and commitfraud by tampering with data for themselves. Furthermore, the actionmay lead to loss of data integrity and availability. When data getscorrupted, the organization`s ability to make effective decisions iscompromised resulting in poor organization performance.

Conclusion

The CIA triangle encompasses guidelines that help to ensure datasecurity in regards to data confidentiality, integrity, andavailability. The authentication and authorization concept entailsverification of user`s identity through attaining valid credentialsthat allow the user to log in the system, and the qualification ofthe user to perform particular tasks. During the creation of useraccounts, to ensure the security of the account one is required toselect the database authentication for users, set secured password,examine the roles of the user, and to protect the administrativefunctions from the users. Improper creation of user accounts leads todata security threats which may cause cybercrime.

References

Rouse, M. (2017). What is authentication, authorization, andaccounting (AAA)? – Definition from WhatIs.com. SearchSecurity.Retrieved 3 April 2017, from http://searchsecurity.techtarget.com/definition/authentication-authorization-and- accounting

Shaul, J. (2013). Database Insecurity And The Trends Of 2013.TeamSHATTER. Retrieved 3 April 2017, fromhttp://www.teamshatter.com/topics/general/team-shatter- exclusive/database-insecurity-and-the-trends-of-2013/