Chapter VIII data and database Information security · PDF fileChapter VIII data and database Information security ... Modern business computer 8. ... (Structured Query Language) is

Chapter VIIIdata and database

Information securityFile fundamentals

Database fundamentals

Malware and computer security

Dr. Nazih Abdallah - Modern business computer 1

Lecture objectives

• Understand file creation, naming and saving

• Understand database and database structure

• Understand the use of database.

• Understand database query and manipulation

• Be able to compare database approach to file approach in business management

• Be aware of threats targeting information and computer network.

• Understand backup policy


File fundamentals

• A file is the smallest named collection of data/information or instructions stored on a storage medium.

• A file must have a name before being saved.• File name must be descriptive to indicate the content of the file and

must abide by the following criteria:• Maximum length shouldn’t exceed 255 characters• Avoid prohibited characters *?”/I><:\• Case sensitive: “A” and “a” are different characters in the file name.

• The file name must end with an extension that is related to the format used when the file was saved. (.txt, .doc, .gif, .xls, etc…)

• File name extension cannot exceed 3 characters.• Operating system can be set to hide the file name extension

• Native file format is format used when we create the file: Example (if we use MS word to create a document then we save the document as a pdf file its native file format will be .doc and its filename extension will be .pdf)


Types of files

• Program file or software file: • consists of software instructions designed to instruct the computer how to perform

specific applications

• an application may consist of one or several programs

• all program files are saved on the hard disk in a folder called “program files” folder which is the default folder used by the operating system to store software programs including the ones that you download from the WEB.

• Program file can be ASCII text file that needs conversion to binary or binary executable file that don’t need any conversion.

• Data files: • Files that hold data/information of all types

• No instructions included in data files.

• Content vary from text to document to multimedia (pictures, audio, video, etc…)


Physical storage Model• Each storage medium is formatted and divided into sectors (CD has one single track about 3

miles long: 336000 sectors of 2048 bytes each 336000 x 2048 = about 700 megabytes

• The smallest storage location is not the sector but the cluster

• A cluster is formed of several contiguous sectors.

• Operating system stores each record of a saved file in an available cluster and gives it a flag and order number in the corresponding file.

• Consequently, a given file has its records dispersed all over the storage medium

• Operating system maintain a list of addresses of files in a FAT (File Allocation Table) that serves like the occupancy board at the entrance of office buildings.

• Defragmentation utility brings same file records as close to each other as possible

• The FAT addressing technology helps the operating system to retrieve the file when we want them to be displayed.

• NTFS (New Technology File System) and HPFS (High Performance File System) and IFS (Installable File System) are newer more advanced technologies than FAT which is still used because of its effectiveness


Logical storage model

• The operating system creates a directory for each storage medium and maintain an addressing table for all files stored on that directory

• The directory is considered to be the logical storage model that identifies the path to each file thru directories and subdirectories.

• This logical storage model is like a tree metaphor that consists of:• Root directory: The storage medium depicted as the trunk of the

tree. Example for the hard disk (C:\) • Subdirectories: considered as the folders and subfolders depicted as

the branches.• Files depicted as the leaves• Example: C:\electronics\computers\notebook\apple.xls• The above example in computer store represents the path of the

available apple notebooks excel file stored in the notebook subfolder which is stored in the computer subfolder which is also stored in the electronic folder on the hard disk.


File management softwarewindows explorer – Mac finder

allows you to manipulate files and folders in the following ways:

• Rename: Change the name use (Save as)• Copy: make a copy of the file so you can paste it in

another location• Move: You can move the file from its actual location to

another and change its logical storage model accordingly.

• Delete: Move the file to the recycle bin folder


MOVE/DELETE files

• When you move a file from one location to another all its bits stay where they were until they are overwritten by other files.

• Only the status of the corresponding clusters will be turned from occupied to vacant so they will be reused by the Operating system.

• When you delete a file, you in fact, are moving it to the recycle bin folder where it will stay and can be retrieved as long as that folder is not emptied or overloaded.

• File shredder is software that overwrites the old file ASCII code using random zeroes and ones.


Database fundamentals

• A database is a collection of related data files that consists of all data/information of a business or organization.

• Database files are also called tables or relations because they are tables similar to spreadsheet files.

• If the number of files in a business or organization is too big, which is usually the case in big businesses, then several databases will be necessary and a data warehouse is created which consists of a collection of several related databases.

• A small data warehouse is known as a data-mart.

• Creation and manipulation of database is not possible without a powerful software known as DBMS (Database management software). MS Access is a database management system.


Functions of DBMS

• Helps create the database files or projects• Helps manipulate the database: update information, add new

information delete and all necessary operations.• Sort data based on given criteria.• Provides interface between the user and the database thru 2

applications;• Front end application interface between the user like the forms

and direct links provided by the application• Back end application interacts with program and applications of

the database that are used by the users.• Prepare routine tasks using available data:

• Paychecks for employees• Issue letters and labels and other promotional material.• Tax forms • Client and supplier accounts• Etc…


Functions of DBMS

• Help decision makers with the decision process by providing reports and statistics needed for that purpose.

• Provide for possibility to query the database by authorized people in order to get needed information and data.

• Help in enhancing data security by protecting data from intruders, attacks and all unauthorized queries.


Database structure

• Field: is the building bloc of the database and its data. It is the smallest data element that must have well defined characteristics:• Length: how many characters and if it is fixed or variable.

• Type: Alpha, numeral, decimal, currency, date, etc…

• Never store last name and first name in the same field.

• Each part of the name must have its own field. Example the name Dr. Maya N. Abdallah Jr. must be stored in 5 fields.

• Each data element that fits in a field is known as the field attribute.


Database structure

• Record:

• The record is a collection of related fields.• If the number of fields is too big the record will be very bulky

and we may need to create another record and consequently another file.

• Table or relation

• The file in a database is known as table or relation.• It consists of a collection of many related records• Files in the database have relationships necessary to extract all

information we need from different files.• Each table, regardless of its size, is composed of:

• One record type which consists of the record template of all the labels of the record.

• A number of record occurrences equal to the number of the population of the file


Database structure

• Database is a collection of related files used as a centralized homogeneous source of data/information used by many users in a business and is very flexible to allow the following procedures:• Collect and store data• Update data• Organize and output data• Find and analyze data


Database structure

ID # Last name First name suffix Department # Date of hire

123456 Smith Ted Sr 22 050508

456789 Rogers Bill 19 022599

157157 Salam Ziad Jr. 18 031608

989898 Jolie Raya 22 111210


Database structure is depicted in the following database sample of a department store where the database is composed of 5 tables as follow: Clients, Suppliers, Employees, Inventory, SalesEmployees file has a sample depicted in the table below:

KEYS

• Database manipulation and data retrieval from a database will not be possible without a key that identify data and information stored into the database.

• There are two types of keys;• The primary key: which is a field unique to each record (PID, SSN,

ID#, etc…) database designer must be very careful when defining primary keys especially for inventory items.

• Secondary key: May be any other field of the file. • In the sample file above:

• ID# is the primary key that is unique to each employee (it is not possible that 2 employees get the same ID# in the same business)

• All other fields of the record type may be used as secondary keys used when needed to extract information. Example: We may use the date of hire as key to get a list of all employees that were hired in 2008 for example.


Database relationship

One to one

One to many

Many to many


supps prods

supps prods

supps prods

Data warehouse

• A data warehouse is a collection of related databases that include all databases in multidimensional establishment.

• A small data warehouse is known as data-mart.• They can be depicted as a cube shape where each cut

represents a separate Market

product

Sales person


Database operations

• Normalization: process of eliminating redundant data which results in reducing the size of the database.

• Selection: process of selecting from the database records that meet given criteria. Example clients whose accounts payables exceed $ 5000.

• Joining table: to shrink the number of tables or files in a database we may join 2 or more tables together to form one table.

• Query database: SQL (Structured Query Language) is used in forms that are converted into queries by the DBMS. Example: grade form on CGS2100 website.


SQL (Structured Query Language)

• SQL used keywords are:

• CREATE

• DELETE

• INSERT

• JOIN

• SET

• SELECT

• UPDATE• Example: SELECT 32” TV FROM electronics Where TV Brand = Sony

• SQL also allows the use of logical operators: AND, OR, NOT

• The grade form on the course website: When you fill and submit it will be converted into SQL to select your grade page from the grades database.


User interface

• Forms are the most used user interface they should be designed carefully to make it user friendly as much as possible. Forms must be:

• Fields arranged in a logical order• Boxes areas should be clear, visible and consistent with

data to fill• Provide easy samples with instructions about the filling

of data.


OODB (Object oriented database

• Data is stored as objects that are grouped into classes and subclasses• OODB is reusable and portable because:

• Functions and application methods are defined with each object and can be reused by all subclasses.

• You only need to add your special parameters and the model will work for you if you belong to the same class activity.

• Example: If transportation network is an object: there are general functions and attributes that are valid for all kind of transportation classes:• Air transportation• Water transportation • Ground transportation • In Ground transportation there are general functions and attribute

that are valid for all forms of ground transportation• We don’t have to start always from scratch when building a

database• OODBMS (Object Oriented Database Management System) is needed to

manipulate the OODB• Access can manipulate all types of databases including OODB.


File approach• File approach: each department will create and maintain its own files

• Strengths:

• More security

• Limited and clear responsibility

• Close knowledge of the subject matter of data/information

• Weaknesses:

• Redundancy: same record is repeated in many departments.

• Limited involvement in the general business picture

• No or limited networking possibility

• No cooperation between all business department

• Poor quality reports and decision making information tool.


Database approach

• Strengths: • No redundancy• Centralized source of same information among all

departments• Networking heaven because of database server

that will be able to provide information to all clients

• Security is enhanced thru strict central policy and limited people are manipulating the database.

• Much better quality report and customer and supplier service.


The Changing Face of Crime

• Corporate and government networks are under attack, and the Internet is the battlefield

• Many types of attacks can be made on computer systems

• Malware: Viruses, worms and Trojan horses

• Identity theft

• Theft of personal information

• Unauthorized use of other’s computer

• Information security involves

• Confidentiality, integrity, availability

Viruses and Worms

• Virus• Program that attaches itself to a file• Spreads to other files, and delivers a destructive action called a payload• Time bomb: Virus that delivers payload on a specific time (birthday of

celebrity, anniversary of an incident, etc…)• Logic bomb: delivers payload on specific conditions (click a link, open a

file, boot, etc…)

• Trojan horses • Appear to be harmless programs• When they run, they install programs on the computer that can be

harmful• Backdoor Trojans open ports on the computer for hackers access.

• Worm : Acts as a free agent, replicating itself numerous times in an effort to overwhelm systems causing denial of service attack on a network (traffic jam).

• War driving: Driving through neighborhoods with a wireless notebook or handheld computer looking for unsecured Wi-Fi networks.

26

Defending Against Viruses and Worms

• Antivirus software uses several techniques to:• Find viruses: 2 steps:

• Detect the virus presence using Checksum of the file.

• Checksum is the actual number of bytes in the file saved by the AV software and compared to the new number. If the numbers are different there should be a virus.

• Find the identity of the virus by comparing its signature to the available list of virus signatures.

• AV then removes them if possible or quarantine them until they can be removed.

• Keep additional viruses from infecting the system

27

Information Security and Vulnerability•Organizational information

• Compromised information can lead to• Loss of market share

• Business failure

•Business intelligence• Process of gathering information in the pursuit of business

advantage

•Competitive intelligence• Concerned with information about competitors

•Counterintelligence• Concerned with protecting your own information from access by

your competitors

28

National and Global Security

•Cyber-terrorism• Uses attacks over the Internet to intimidate or harm a

population

•United States Computer Emergency Readiness Team (US-CERT)• Monitors the security of US networks and the Internet• Responds to attacks

•National Strategy to Secure Cyberspace• Prevent cyber-attacks against US infrastructure• Reduce national vulnerability to cyber-rattack• Minimize damage and recovery time

29

Threats to Information Security:Software and Network Vulnerabilities

• Security vulnerabilities or security holes• Software bugs that allow violations of information security

• Software patches• Corrections to software bugs that cause security holes

30

Threats to Information Security: Hackers, Crackers, Intruders, and Attackers

• System penetration: Someone subverting the security of a system without authorization

• Hackers, crackers, intruders, and attackers• Hackers convene every year in Las Vegas the convention is nicknamed HOPE

(Hackers On Planet Earth): Media, businesses and government specialists attend the convention to be aware of new hacking and security advances .

• White-hat hacker: No criminal intention, Don’t make money• THEY MAY BE HIRED BY BUSINESSES TO CHECK AND CONSOLIDATE

THEIR NETWORK SECURITY (in this case they make legally money).• Black-hat hacker: Criminal intention, make money (cracker).• Gray-hat hacker: Can be either one• Script kiddie: Try to gain access to a network using scripts of other hackers.

• Computer forensics• Process of examining computer equipment to determine if it has been used

for illegal, unauthorized, or unusual activities

31


ZOMBIE computer

A computer that carries out actions (often malicious) under the remote control of a hacker either directly or through spyware or a virus is called a zombie computer. Zombie computers can join together to form zombie networks (botnet). Zombie networks apply the power of multiple PCs to overwhelm Web sites with distributed denial-of-service attacks, to crack complicated security codes, or to generate huge batches of spam.

Machine-Level Security

• Common forms of authentication• Something you know

• Password or personal identification number (PIN)

• Something you have• ID cards, smartcards, badges, keys,

• Something about you• Unique physical characteristics such as fingerprints

33

ID Devices and Biometrics

• Biometrics

• The science and technology of authentication by scanning and measuring a person’s unique physical features

• Facial pattern recognition

• Uses mathematical technique to measure the distances between 128 points on the face

• Retinal scanning

• Analyzes the pattern of blood vessels at the back of the eye

• Fingerprint scan

• Increasingly common method for access to secure areas, logging onto computers, and even validating credit

34

Encrypting Stored Data

• Encryption • Uses high-level mathematical functions and computer algorithms to encode

data

• Files • Can be encrypted “on the fly” as they are being saved, and decrypted as they

are opened

• Encryption and decryption• Tend to slow down computer slightly when opening and saving files

35

Backing up Data Files

• Backup software typically provides the following options• Select the files and folders you wish to back up• Choose the location to store the archive file• Choose whether to back up all files (a full backup), or just those

that have changed since the last backup (an incremental backup)

•Mirroring• Creating a copy of the system or a portion of it

• Real-time mirroring• As files are saved, they are automatically updated in the

mirrored copy

36

Scams, Spam, Fraud, and Hoaxes

• Virus hoaxes• E-mail that warns of a virus that doesn’t exist

• In some cases, just a nuisance, but they can cause great harm in other cases• Hoax may ask you to delete a “virus” file that is actually an uninfected,

important system file

• Deleting such a file may make your computer unusable

37


• Virus hoaxes• E-mail that warns of a virus that doesn’t exist

• In some cases, just a nuisance, but they can cause great harm in other cases• Hoax may ask you to delete a “virus” file that is actually an uninfected,

important system file

• Deleting such a file may make your computer unusable

38


• Spam solutions• Bayesian filters

• Simple authentication software

• “Trusted sender” technology

• Reputation systems

• Interfaces for client-side tools to allow end users to report spam

39


• Defending against scams, spam, fraud, and hoaxes• Awareness and common sense

• Do not click links sent by e-mail• Type URLs directly into the browser

• Examine Web addresses to make sure they are legitimate

• Do not believe virus alerts sent through e-mail unless they come from a reputable source

• Use spam filters

40

Chapter VIII data and database Information security · PDF fileChapter VIII data and database Information security ... Modern business computer 8. ... (Structured Query Language) is

Documents