Essay on Data Security and Encryption

Introduction

Data security and encryption are important in maintaining data on information systems. If properly implemented, data security and encryption processes may improve the level of assurance to users. Data security strategies in a system are effective in ensuring that unauthorized persons do not view vital data. Therefore, security measures and encryption strategies are effective in preventing interception of data, theft and view by unauthorized persons. In respect to data security, it is imperative to note that it relates to a range of measures in protecting databases (Pfleeger, and Shari, 2002). This type of security also values protection of servers, stored functions. The potential threats to databases include unauthorized transactions on servers by administrators. Another influence relates to infections by malware, overloads, programming and design flaws and physical damage.

Encryption on the other hand relates to the process of encoding messages. This process of encoding is important in a system since it ensures that only authorized individuals view the message. Diverse software has been effective in encrypting data. The methods of encryption of data include symmetric key encryption technique. The other method relates to the application of public key encryption. However, for a system to function properly such measures is of great importance. Military organizations use such measures in transmitting secret information. For the civilian populations such measure ensures verification of messages (Pfleeger, and Shari, 2002). To make it a success, the use of digital signature and message authentication codes is of importance. In order to attain an effective data security and encryption, various activities are necessary.

Mandatory Access Control

Mandatory access control is a process in which the operating system is programmed to limit the access of subjects on the system. The designers of such systems ensure that initiators or subjects are unable to access the general performance of the database. Mandatory access control works in a fantastic fashion. The process of its functions depends on the Kernel of the system. In practice if one wishes to access the system, an authorization process is necessary. For one to access the system the Kernel examines the request of the user then a rule enforced on the system takes place.

The rule has security attributes that process users requests; either rejecting or accepting it (Kuhn, Xie, and Hwang, 2011). Various fronts on the field have been in practice in many corporations. For example, MAC computers have been effective in using Multi-level security systems. Trusted Computer systems Evaluation Criteria is another important invention. Other innovations on the front include TOMOYO Linux, Gsecurity and SUSE Linux. Maybe the innovation of application has made security an important feature. Trusted Mandatory Access controls have been a feature for ipad, iphone as well as other fronts. Such aspects include SELinux, MAC Os and FLASK fronts (Sun et al 2009).

Discretionary Access Control

Unless Mandatory Access control is in use, Discretionary Access may be effective. However, for Discretionary control to take place, Trusted Computer Evaluation Criteria needs to be implemented (Popa et al 2012). This type of control ensures that individual’s restriction to accessing the system bases on their allegiances. Their allegiances may be in form of a group or certain subjects. In this type of security, the control is discretionary. This means that an individual has permission to access the database. On the other hand, the user of the system may share this permission with other individuals. Discretionary Access control ensures that a user has ultimate control of programs and files (Fong, 2008). The user might decide to provide permission to other users as well as prohibit others. This type of control on the other hand refers to the provision of access to those who need it.

Role-Based Access Control

Role- Based access control revolves around use of Mandatory access control as well as discretionary control. When one visits huge corporation that feature over 400 workers, it becomes apparent that role based Access control is essential. Role based system Access control uses the properties of the discretionary as well as Mandatory Access controls (Zhang and Yang, 2003). The feature ensures that access permission has its hierarchy (Galante, 2009). In an organization, subjects might have specific permission in accessing the system. On the other hand, assignment of such permission of access might require authorization from specific individuals. Such permissions might include role assignment exercises or role authorization on the system.

Oracle Transparent Data Encryption

Oracle Transparent Data Encryption is another important feature in the securing of data in databases. This form of security uses the property of Authentication, authorization and the use of auditing features in solving security breaches. However, one needs to take note that the encryption works only on databases. Oracle transparent Data Encryption system protects sensitive data on database columns rather than on operating systems (Pan, Chang and Cungang, 2006). It enables the encryption of data without contributions from applications and users. The security system stops attackers from by passing the database and in reading system’s information. This becomes a reality using Data- at –Rest encryption criteria on the database region.

Microsoft SQL Server 2012 Encryption

Microsoft SQL Server 2012 Encryption is an important factor in providing security for computer system. Organizations have undergone various losses due to security breaches. In relation to the Encryption, Microsoft SQL server has a transparent data encryption (TDE). The system also has an extendible key management that manages third parties. On the other hand, the system provides an automatic encryption by use of custom application codes (Thales 2012). The system further is important for enterprise and above users in the business environment.

Reference List

Pfleeger, Charles P., and Shari Lawrence Pfleeger.2002. Security in computing. Prentice Hall Professional Technical Reference. http://dl.acm.org

Popa, R, Redfield, C, Zeldovich, N, & Balakrishnan, H 2012, ‘CryptDB: Processing Queries on an Encrypted Database’, Communications Of The ACM, 55, 9, pp. 103-111, Business Source Complete, EBSCOhost, viewed 4 August 2014.

Hu, V, Kuhn, D, Xie, T, and Hwang, J 2011. ‘Model Checking For Verification Of Mandatory Access Control Models And Properties’, International Journal Of Software Engineering & Knowledge Engineering, 21, 1, Pp. 103-127

Galante, V 2009. ‘Practical Role-Based Access Control’, Information Security Journal: A Global Perspective, 18, 2, pp. 64-73

Fong, PL 2008. ‘Discretionary capability confinement’, International Journal Of Information Security, 7, 2, pp. 137-154

Popa, R, Redfield, C, Zeldovich, N, & Balakrishnan, H. 2012. ‘CryptDB: Processing Queries on an Encrypted Database’, Communications Of The ACM, 55, 9, pp. 103-111.

Thales 0004. ‘Thales announces support for SQL Server 2012’, Business Wire (English), March, Regional Business News, EBSCOhost, viewed 4 August 2014.

Sun, G, Chen, Y, Zhou, Z, & Min, Z 2009, ‘A configurable access control system for networked manufacturing monitoring using XML’, International Journal Of Advanced Manufacturing Technology, 39, 11/12, pp. 1252-1261

Zhang, C, & Yang, C 2003, ‘Integration Object Oriented Role-Based Access Control Model With Mandatory Access Control Principles’, Journal Of Computer Information Systems, 43, 3, P. 40

Pan, L, Chang N., Z, & Cungang, Y 2006, ‘A Role-Based Multilevel Security Access Control Model’, Journal Of Computer Information Systems, 46, 3, Pp. 1-10