Access Control Methods in DBMS

Access control in DBMS

Database access control is a method of allowing access to a company’s sensitive data only to those people (database users) who are allowed to access such data and to restrict access to unauthorized persons. It includes two main components: authentication and authorization.

Authentication is a method of verifying the identity of a person who is accessing your database. Note that authentication isn’t enough to protect data. An additional layer of security is required, authorization, which determines whether a user should be allowed to access the data or make the transaction he’s attempting. Without authentication and authorization, there is no data security.

Any company whose employees connect to the Internet, thus, every company today, needs some level of access control implemented.

Types of Access Control
Obsolete access models include Discretionary Access Control (DAC) and Mandatory Access Control (MAC). Role Based Access Control (RBAC) is the most common method today, and the most recent model is Attribute Based Access Control (ABAC).

Discretionary Access Control (DAC)
With DAC models, the data owner allows access. DAC is a means of assigning access rights based on user-specified rules.

Mandatory Access Control (MAC)
MAC was developed using a nondiscretionary model, in which people are granted access based on an information clearance. MAC is a policy in which access rights are assigned based on central authority regulations.

Role Based Access Control (RBAC)
RBAC grants access based on a user’s role and implements key security principles such as “least privilege” and “separation of privilege.” Thus, someone attempting to access information can only access data necessary for their role.

Attribute Based Access Control (ABAC)
In ABAC, each resource and user is assigned a series of attributes. In this dynamic method, a comparative assessment of the user’s attributes, including time of day, position, and location, is used to make a decision on access to a resource.

How it Works
Let’s take a look at how access control works in DataSunrise.

Two-Factor Authentication
DataSunrise includes two-factor authentication mechanisms based on emails and one-time passwords (OTP) which allow to access the target database. Database users should input the database’s password and complete email-based or Google Authenticator-based authentication to get access to the target database.

Database Access Restriction
DataSunrise features Data Security component which enables you to restrict access to a complete database or certain database objects depending on the following factors:

• Database username;
  
• Client application;
  
• Application username;
  
• IP address or hostname;
  
• Operating system user;
  
• Number of unsuccessful login attempts;
  
• Query text.
  

Thus, DataSunrise utilizes the ABAC method of access control. Data Security’s functionality is based on security rules created by DataSunrise administrator.