Theory question 104
Data SecurityPaper 2, Section A
(a) Define: (i) Data security (ii) Data risk assessment
(b) (i) Explain the term access control in database security
(ii) List two access control methods in database security
(c) State three roles of a database administrator.
Show the model answer
(a)(i) Data security is the protection of data from unauthorised access, change, corruption or loss.
(ii) Data risk assessment is identifying the threats to an organisation's data, judging how likely and how harmful they are, and deciding controls to reduce them.
(b)(i) Access control decides who can use the database and what each user may do (view, add, change, delete), usually after the user is identified and authenticated.
(ii) Any two: user names and passwords; role-based access (privileges/permissions); discretionary access control; mandatory access control; biometrics or access cards.
(c) Any three: designing and creating the database; granting and controlling user access; backing up and recovering data; monitoring and tuning performance; installing and upgrading the DBMS; keeping data secure and consistent; supporting users.
Define each term in one sentence, then give clear separate points.