DATABASE MANAGEMENT SYSTEM
106402Unit 4 – Database Security
Q1g. Many applications use where two independent factors are used to identify a user. - (i) Two-factor authentication (ii) Cross-site request forgery (iii) Cross-site scripting (iv) Cross-site scoring scripting20212m
Unit 4 – Database Security
View this question on its own page →Many applications use where two independent factors are used to identify a user.
- (i) Two-factor authentication
(ii) Cross-site request forgery
(iii) Cross-site scripting
(iv) Cross-site scoring scripting
Worked SolutionAnswer: (i) Two-factor authentication
Explanation: Two-factor authentication (2FA) uses two independent factors: something you know (password), something you have (OTP token), or something you are (biometric). Cross-site request forgery (CSRF) and cross-site scripting (XSS) are attacks, not authentication methods.
- (i) Two-factor authentication
Q1h. ______________allows a system administrator to associate a function with a relation; the function returns a predicate that must be added to any query that uses the relation. - (i) OpenID (ii) Single-site system (iii) Security Assertion Markup Language (SAML) (iv) Virtual Private Database (VPD)20212m
Unit 4 – Database Security
View this question on its own page →______________allows a system administrator to associate a function with a relation; the function returns a predicate that must be added to any query that uses the relation.
- (i) OpenID
(ii) Single-site system
(iii) Security Assertion Markup Language (SAML)
(iv) Virtual Private Database (VPD)
Worked SolutionAnswer: (iv) Virtual Private Database (VPD)
Explanation: VPD (Row Level Security, e.g., Oracle VPD) allows associating a function/policy with a table that appends a predicate (WHERE clause) to every query on that table for fine-grained access control. Example: function returns 'dept = USER_DEPT'. OpenID is authentication, SAML is SSO assertion language, Single-site is not relevant.
- (i) OpenID
Q7a. Make a list of security concerns for a bank. For each item on your list, state whether this concern relates to physical security, human security, operating-system security or database security.20217m
Unit 4 – Database Security
View this question on its own page →Make a list of security concerns for a bank. For each item on your list, state whether this concern relates to physical security, human security, operating-system security or database security.
Worked SolutionSecurity Concerns for a Bank - Classification:
- Robbery/Bank Vault theft - Physical security
- ATM skimming/physical tampering - Physical security
- Insider fraud/employee collusion - Human security
- Phishing/social engineering - Human security
- Operating system vulnerability exploitation (unpatched OS) - Operating-system security
- Privilege escalation on DB server - Operating-system / Database security
- SQL injection on online banking - Database security
- Unauthorized access to customer accounts/tables - Database security
- Data leakage via SELECT bypass - Database security
- Network eavesdropping - Operating-system / Database (communication)
- Backup tape theft - Physical + Database security
- Ransomware encrypting DB files - Operating-system and Database
Classification per item shows multi-layer defense needed. Physical guards/CCTV, human training/background checks, OS hardening/patching, DB GRANT, VPD, encryption, audit logs.
Q9a. Write a short note on any one of the foflowing: - (a) SQL injection20217m
Unit 4 – Database Security
View this question on its own page →Write a short note on any one of the foflowing:
- (a) SQL injection
Worked SolutionShort note on SQL Injection:
Attack where attacker injects malicious SQL via user input to alter query logic. Example: Input "' OR '1'='1" into login: SELECT * FROM users WHERE name='' OR '1'='1' -- bypasses authentication, returns all rows. Can lead to data leak, delete, privilege escalation.
Types: Error-based, Union-based, Blind,.
Prevention: Use prepared statements/parameterized queries (SELECT * FROM users WHERE name=?), input validation/sanitization, least privilege, WAF, avoid dynamic concatenation, use ORM.
Example parameterized in Java: PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE name=?"); ps.setString(1,input);