Database Programming

DBMS is a software that organises the creation, storage and maintenance of Databases for end users.

Most organizations know that it is important to protect their data and resources from loss or damage due to theft, human or computer error, malicious intent, or any number of other events. You can take steps to limit the opportunities for loss or damage to occur. You can also establish policies and procedures to respond to and minimize the effects of the loss or damage to your IT environment. The Rationalized level in this guide deviates somewhat from the Core Infrastructure Optimization Online Self-Assessment and focuses on the following topics: two-factor user authentication, standard security review for new assets, and data classification processes.

Phase 1: Assess

The Assess phase should determine the appropriate security needs for your organization and which processes are currently in place. Security requirements can vary dramatically from company to company or institution to institution based, for example, on size, industry or field, or regional laws and regulations. Gathering the requirements of your organization will allow you to define an appropriate security process.

Phase 2: Identify

During the Identify phase, an organization will examine the tools and procedures currently in place and determine what the security requirements are for its organization. During this phase, you will gather security policies that are currently implied or enforced, in addition to technology components already in use or at your disposal. You will also gather any external requirements based on laws or regulations for your region or industry.

Phase 3: Evaluate and Plan

The Evaluate and Plan phase moving to the Rationalized level of optimization highlights specific areas of improvement.

Two-Factor Authentication

Single secrets such as passwords can be effective security controls. A long password of more than 10 characters that consists of random letters, numbers, and special characters can be very difficult to crack. Unfortunately, users cannot always remember these sorts of passwords, partly due to fundamental human limitations.

Two-factor authentication systems overcome the issues of single secret authentication by the requirement of a second secret. Two-factor authentication uses a combination of the following items:

Something that the user has, such as a hardware token or a smart card.

Something the user knows, such as a personal identification number (PIN).

Smart cards and their associated PINs are an increasingly popular, reliable, and cost-effective form of two-factor authentication. With the right controls in place, the user must have the smart card and know the PIN to gain access to network resources. The two-factor requirement significantly reduces the likelihood of unauthorized access to an organization's network.

Smart cards provide particularly effective security control in two scenarios: to secure administrator accounts and to secure remote access. This guide concentrates on these two scenarios as the priority areas in which to implement smart cards.

Because administrator-level accounts have a wide range of user rights, compromise of one of these accounts can give an intruder access to all network resources. It is essential to safeguard administrator-level access because the theft of domain administrator-level account credentials jeopardizes the integrity of the domain, and possibly the entire forest, together with any other trusting forests. Two-factor authentication is essential for administrator authentication.

IT Challenges:

Limited PC security, The process for updating security on all network connected IT assets is undocumented.

Solutions :

Continue optimizing defense-in-depth security policies

Develop and implement two-factor identity and access management policies

Develop a process to manage security requirement testing on all acquired or developed software

Establish a standard and repeatable procedure for classifying sensitive data

IT Benefits:

Automated services and tools free up resources to implement new services or optimize existing services

Proactive IT operations resolve problems earlier to avoid reducing user productivity

Let us summarize these models.

The hierarchical model stores the data records in a tree structure with edges that connect the different records representing their relationships. Except for the root, all other nodes must have a parent node and each node may have either zero, or more child (dependent) records. Thus, in the hierarchical model, relationships between record types can be only one-to-one or one-to-many binary relationships.

IBM's IMS is possibly the only hierarchical DBMS in use today. There are only a few places where it is being used. In IMS, many-to-many relationships are handled by storing the data in two trees with opposite dependencies. Recursive relationships are handled in the same way. This means that the database contains redundant data, which is a waste of space, which makes the database structure inflexible to data change, and which makes the update operations more complex. Basic referential integrity of parent-child relationship is enforced by the DBMS.

The hierarchical model does not support declarative query processing. Retrievals are achieved through navigationembedded within a high-level programming language. The navigation is a tree pre-order traversal that starts from the root and proceeds down the tree, accessing the subtrees in order from left to right. This means that users know and operate directly on the physical schema. Hence, the hierarchical model supports a low level of abstraction compared to relational and object-oriented models, and it also offers only weak security and integrity.

The network model is similar to the hierarchical one in that it eliminates data redundancy in a database by storing the data in a graph (or network) structure rather than in a tree structure. In this way, recursive and circular relationships, for example, can be expressed with edges connecting two records of the same type.

The basic one-to-many relationship is represented by connecting the dependent records together in an ordered linked list with the parent record, which is called the owner, at the head of the list. Records are permitted to contain more than one link. This capability is used in expressing many-to-many binary relationships between two record types. Many-to-many relationships are expressed with the help of intermediate records that can be directly linked with records of both the related record types, providing an indirect link between these records. (The use of intermediate records is called decomposition.) Basic referential integrity constraints are enforced by the DBMS.

Similar to the hierarchical data model, the network model does not provide for declarative query processing. Access to records is achieved by navigation through the network structure using a set of predefined commands. These one-record-at-a-time commands must be embedded in a general-purpose programming language. Unlike records in the relational model, records in the network model can have fields, which are either single value, called simpleattributes, or multi-valued, called vector attributes.

In the relational model, data is stored in tables that completely hide the physical organization of data. Thus, compared to the hierarchical and network models, the relational model supports a high level of abstraction and a flexible database structure. The database structure, i.e., the schema, can easily be changed to accommodate new data and new access requirements.

Relationships of any cardinality (1:1, 1:N, and N:M) and degree (binary, recursive, or higher order) can be expressed by means of foreign keys that are logical pointers. Binary 1:1 and 1:N, and binary recursive relationships, can be expressed directly, whereas high-order and N:M relationships can be expressed by decomposition, i.e., with the use of an intermediate table.

In addition to basic referential integrity, the relational model supports semantic integrity constraints by means of checks, assertions, and triggers.

Finally, as we have discussed in some detail, the relational model supports declarative, interactive query languages such as SQL and QBE. Furthermore, it can be embedded in almost any programming language, and therefore it supports the development of database application programs.

The object-oriented model supports a high level of abstraction and exhibits the same flexibility in specifying data relationships as the relational model. Relationships in the object-oriented model are expressed as references to object IDs. However, the object-oriented model offers more flexibility in specifying the schema of the database by means of complex types, user-defined types, user-defined functions, and object inheritance.

Unlike the object-relational model, object-oriented data models are strongly tied to an object-oriented programming language (such as C++ and Smalltalk) acting as their data manipulation language. (In this respect, object-oriented models resemble the hierarchical and network models.) The object-oriented language is extended to support persistent objects whose values are stored in the database and can be shared with other programs. By manipulating transient and persistent objects uniformly, object-oriented models eliminate the so-called impedance mismatch; that is, object-oriented models can thus eliminate any incompatibility between the declarative database manipulation language and the procedural application programming language that is due to difference in programming paradigms and type systems. Thus, object-oriented databases simplify the task of programming by supporting a single level storage and a computationally complete DDL/DML.

In order to support declarative and interactive query processing, the ODMG standardization treats the object-relational model as a special object-oriented model, implementing its declarative query language.