The significance of Access Control in Database security - Paper
munna408
DatabaseSecurityPaper.docxThe significance of Access Control in Database security
Database security should mainly ensure that the sensitive information of customers and clients are fully secured within the company database. Further, authenticated database users should have access to it (Malcher et al., 2014). Unauthorized individuals can and must be restricted at all costs. This purpose brings the concept of access control in database security. Therefore, in this paper, a literature review would be conducted to gain insights regarding existing literature to identify the significance of access control in database security. Research questions would be formed, and based on the questions, the literature review shall be conducted. In the methodology section, the approach taken to do the research shall be outlined. The results of the review shall be highlighted in the findings and discussion section. Lastly, based on the findings, a conclusion would be drawn and probable recommendations shall be given.
Aim of the research
The aim of conducting the research is to identify the significance of access control and ways it ensures the security of the organization's databases.
Research questions
· What is the useful access control mechanism to ensure the security of databases?
· What is the extent to which the control mechanisms have been beneficial for US-based firms?
· Are there any issues faced by firms while implementing access control?
· What has been done to ensure the access of deserving users only?
· What are the ways of mitigating the database security issues?
Literature review
Literature review mainly refers to a review of existing scholarly materials such as journal articles or books that are relevant to the chosen research topic. The purpose is to situate the work with existing knowledge.
Useful access control mechanism
According to Kuijper & Ermolaev (2014), RBAC or Role-based access control can be a useful mechanism or model to ensure database security. The mechanism can be used to restrict network access, and access is given to individual users. The employees have the right to have access to database information. It is role-based, and therefore the “role” determines the level of access to information. The role is based on job competency, authorization, and responsibility. The company can give a designation to someone as an end-user, specialist user, or administrator. The administrator can view and modify files, unlike end-users. The purpose is to enhance the scalability of the organization. The end-users are considered the "least privilege" users among administrators and specialist users.
Figure: Access control model
(Source: researchgate.net, 2020)
The extent to which access control mechanisms proved beneficial
According to Karataş & Akbulut (2018), notably, internet-based applications, along with the cloud computing services, allowed end-users to have access to remarkable opportunities. The author stated that security issues occur due to a lack of control. This, in turn, increases system failures. In the cloud computing environment, effective control mechanisms have proved beneficial. However, the service-based architecture models in cloud computing have been examined, and research shows that the mechanisms have enhanced system authentication, and the users have been ensured system security. Accidents and thefts have reduced considerably, and undetected users can be avoided as well.
Issues faced by organizations in implementing access control
As per Takabi, Joshi & Ahn (2010), security dilemmas exist while implementing the mechanisms of access control, and the IT team of an organization is likely to confront those issues. For instance, at every endpoint, malware might be present that can cause vulnerabilities, and the entire network could be exploited. The user-specific access control is challenging to implement. Lastly, centralized control is difficult to achieve because continuous coordination among operations, security teams, and administration are challenging.
Steps taken to allow access of database to deserving users
As per Fernandez, Mujica & Valenzuela (2011), the concept of "Least Privilege" and "Separation of Duty" exists, and it is vital because organizations are supposed to provide minimum privileges or access to undeserving users so that the most deserving ones can modify and create files. Roles have been created across firms so that less deserving users receive the least amount of privileges. The granted privileges would be enough to perform a specific task.
Ways of mitigating the database security issues
As stated by Murray (2010), the lurking issues can be mitigated by removing traditional solutions of access control. An organization can consider the separation of end-point client security configuration and cloud-based security services. It would be beneficial to use a unified portal (cloud-based) and ensure a single control point. End users can have access to the applications only after they enter relevant credentials.
Research methodology
The research methodology is a systematic process by which information reading the chosen research topic can be gathered and analyzed (Kumar, 2019). In this paper, the secondary method of research has been chosen because of a lack of time. Reputed online platforms such as Google Scholar and ProQuest have been used to find relevant journals related to the chosen topic. Rather than using the primary method, it seemed feasible to use the secondary technique because it is less time-consuming, unlike the primary method. In the primary method, the researcher is supposed to develop a questionnaire and conduct interviews. It would have been a costly method, as well.
Findings and discussion
The findings of the secondary research study have been listed below:
· One of the most useful access control mechanisms in the modern day is the Role-based access control or RBAC. It has a positive impact on organizations. Based on the role of the user, their level of access is determined.
· Database security in the cloud computing environment can be ensured by using the best internet-based applications.
· Organizations face security implementation issues, and notably, the user-specific type of access control can be a challenge
· US-based firms have taken steps by applying concepts such as “Separation of Duty” and “Least Privileges” so that users get only the amount of access they need to perform a task.
· It is vital to ditch traditional access control methods such as DAC and MAC. Nowadays, one of the effective techniques of mitigating issues is the unified portal that will be operating in a cloud-based environment.
The research has been conducted in order to gain insights regarding the usefulness of implementing access control in organizations. It can be stated that the above-mentioned findings would ensure that only expert users gain access to any sensitive information, and it would be vital to prevent resource access that is irrelevant to the end-users.
Conclusion and recommendations
The paper has been divided into various sections. In the introductory part, the concept of database security has been explored. Thereafter, the research aims and questions were formulated. A literature review has been conducted, and a brief outline of the followed methodology has been outlined as well. Lastly, the findings of the secondary research have been listed sequentially.
The paper signifies the importance of modern-day access control techniques. One of the critical factors for success in achieving complete database security is authentication and assigning appropriate roles to users. Issues in access control implementation still exist. Therefore, it can be recommended that upgrading technology and installing encryption-based technology would be beneficial for firms. Most importantly, periodic testing would prove beneficial for ensuring system functionality. Tests can be conducted either on a monthly or quarterly basis. Security managers are responsible for making advanced changes.
Implementation of Mandatory Access Control in Role-based Security System. CSE367 Final Project Report. Professor Steve Demurjian. Fall PDF Free Download. (n.d.). We offer you effective and free publishing and information sharing tools. https://docplayer.net/8528509-Implementation-of-mandatory-access-control-in- role-based-security-system-cse367-final-project-report-professor-steve-demurjian-fall- 2001.html
DulceMontemayor. (n.d.). Security identifiers. Technical documentation, API, and code examples | MicrosoftDocs. https://docs.microsoft.com/en-us/windows/security/identity- protection/access-control/security-identifiers
Significance of SSRS roles? Reports depending on permission of Stored procs. (n.d.). StackOverflow. https://stackoverflow.com/questions/15842519/significance-of-ssrs- roles-reports-depending-on-permission-of-stored-procs/15842978
