05 Database Security - Cheat Sheet

Relational terms (s.7)

Relation = table · tuple = row = record · attribute = column = field · primary key uniquely identifies a row · foreign key links to another table · view = virtual table from a query. SQL (IBM, mid-1970s) defines, manipulates and queries data (s.10).

SQL injection (s.11-20)

Malicious SQL sent to the DB server: modify/delete data, run OS commands, DoS (s.11).

• Tautology: name' OR 'a'='a makes WHERE always true, returns all rows (s.13-14).
• Piggyback + end-of-line comment: John'; DROP table Course;-- (s.15).

Category	Channel	Example
In-band	same for attack and results	tautology, --, piggyback
Inferential	no data transferred; behaviour/timing; illegal queries; descriptive error pages	Blind SQLi
Out-of-band	different channel for results	DNS/HTTP, email

Countermeasures: defensive coding (input validation); detection = signature, anomaly, code analysis; runtime prevention (s.20).

Database access control (s.21-24)

Centralized (few privileged users) · ownership-based (table owner) · decentralized (owner can let others grant/revoke). GRANT {privs|role} [ON table] TO {user|role|PUBLIC} [IDENTIFIED BY pw] [WITH GRANT OPTION] · REVOKE ... FROM .... Rights: SELECT, INSERT, UPDATE, DELETE. PUBLIC = any user; GRANT OPTION = grantee can pass it on.

Inference (s.25-29)

Authorized queries + deduction = unauthorized info. Techniques: functional dependencies (Rank $\to$ Salary), merging views (same row order, Item+Cost example). Fix: at design (split table, finer RBAC roles) or at query time (deny/alter).

Database encryption (s.30-36)

Entire DB = inflexible; rows or columns = best, plus attribute indexes. Encrypted values lose order, so range queries fail. Fix: encrypt each row as a block $E(k,B)$, keep range indexes; query eid<300 $\to$ $I(eid)\le 2$, decrypt rows, discard non-matches.

Quiz one-liners

Injected condition always true = tautology · -- = end-of-line comment · deduce from authorized answers = inference.

Details: 05 Database Security - Chunk 01 (s.1-38) · 05 Database Security - Index · Concept - SQL Injection · Concept - Inference