Technique for Evaluating the Security of Relational Databases Based on the Enhanced Clements–Hoffman Model
Source abstract
Abstract
Obtaining convincing evidence of database security, as the basic corporate resource, is extremely important. However, in order to verify the conclusions about the degree of security, it must be measured. To solve this challenge, the authors of the paper enhanced the Clements–Hoffman model, determined the integral security metric and, on this basis, developed a technique for evaluating the security of relational databases. The essence of improving the Clements–Hoffmann model is to expand it by including a set of object vulnerabilities. Vulnerability is considered as a separate objectively existing category. This makes it possible to evaluate both the likelihood of an unwanted incident and the database security as a whole more adequately. The technique for evaluating the main components of the security barriers and the database security as a whole, proposed by the authors, is based on the theory of fuzzy sets and risk. As an integral metric of database security, the reciprocal of the total residual risk is used, the constituent components of which are presented in the form of certain linguistic variables. In accordance with the developed technique, the authors presented the results of a quantitative evaluation of the effectiveness of the protection of databases built on the basis of the schema with the universal basis of relations and designed in accordance with the traditional technology of relational databases.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Information and Cyber Security · Information Systems and Technology Applications · Advanced Data Processing Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Security of Information Systems and Technologies, Faculty of Computer Science, V. Karazin National University of Kharkiv, 61022 Kharkiv, Ukraine
Department of Computer Science and Automatics, Faculty of Mechanical Engineering and Computer Science, University of Bielsko-Biala, 43-309 Bielsko-Biala, Poland
Funding
University of Bielsko-Biala, Poland
References (91)
Show source-provided references
1. The Beckman Report on Database Research10.1145/2694428.2694441 ↗
2. The Seattle Report on Database Research10.1145/3385658.3385668 ↗
3. (2021, September 21). ISO/IEC 25010:2011 Systems and Software Engineering. Systems and Software Quality Requirements and Evaluation (SQuaRE). System and Software Quality Models. Available online: https://www.iso.org/standard/35733.html/.
4. Latham, D.C. (2021, September 21). Department of Defense Trusted Computer System Evaluation Criteria, Available online: http://csrc.nist.gov/publications/history/dod85.pdf.
5. Commission of the European Communities (2021, September 21). Information Technology Security Evaluation Criteria (ITSEC): Provisional Evaluation Criteria. Document COM(90) 314, Version 1.2. Available online: https://www.ssi.gouv.fr/uploads/2015/01/ITSEC-uk.pdf.
6. (2021, September 21). ISO/IEC 21827:2008 Information Technology. Security Techniques. Systems Security Engineering. Capability Maturity Model® (SSE-CMM®). Available online: https://www.iso.org/obp/ui/#iso:std:iso-iec:21827:ed-2:v1:en.
7. (2021, September 21). Common Criteria for Information Technology Security Evaluation Part 1: Introduction and General Model. Version 3.1 Revision 5 CCMB-2017-04-001. Available online: https://www.commoncriteriaportal.org/files/ccfiles/CCPART1V3.1R5.pdf.
8. Jansen, W., and Gallagher, P.D. (2021, September 21). NISTIR 7564. Directions in Security Metrics Research, Available online: https://nvlpubs.nist.gov/nistpubs/legacy/ir/nistir7564.pdf.
9. Understanding Database Security Metrics: A Review
10. (2021, September 21). NIST Special Publication 800-55 Revision 1, Available online: https://csrc.nist.gov/publications/detail/sp/800-55/rev-1/final.
11. Sandhu, R.S., and Jajodia, S. (1993). Data and Database Security and Controls. Handbook of Information Security Management, Auerbach Publishers.
12. Date, C.J. (2004). An Introduction to Database Systems, Pearson Education Inc.. [8th ed.].
13. Neto, A.A., Vieira, M., and Madeira, H. (2009, January 18–23). An appraisal to assess the security of database configurations. Proceedings of the Second International Conference on Dependability, Athens, Greece.10.1109/DEPEND.2009.17 ↗
14. Oracle (2021, September 21). Database Security Assessment Tool User Guide. Available online: https://docs.oracle.com/en/database/oracle/security-assessment-tool/2.2.2/satug/index.html#UGSAT-GUID-C7E917BB-EDAC-4123-900A-D4F2E561BFE9.
15. Formalized Representation for the Data Model with the Universal Basis of Relations10.47839/ijc.18.4.1615 ↗
16. A Security Metrics Taxonomization Model for Software-Intensive Systems10.3745/JIPS.2009.5.4.197 ↗
17. Towards Measurement of Security Effectiveness Enabling Factors in Software Intensive Systems10.7763/LNSE.2014.V2.104 ↗
18. A Survey on Systems Security Metrics10.1145/3005714 ↗
19. Bernik, I., and Prislan, K. (2016). Measuring Information Security Performance with 10 by 10 Model for Holistic State Evaluation. PLoS ONE, 11.10.1371/journal.pone.0163050 ↗
20. An analysis on effects of information security investments: A BSC perspective10.1007/s10845-010-0402-7 ↗
21. Complexity: Toward an empirical measure10.1016/j.technovation.2013.01.001 ↗
22. Quality of security metrics and measurements10.1016/j.cose.2013.05.002 ↗
23. Yasasin, E., and Schryen, G. (2015). Requirements for IT Security Metrics—An Argumentation Theory Based Approach. European Conference on Information Systems—ECIS, ECIS. Completed Research Paper; Paper 208.
24. Katt, B., and Prasher, N. (2018, January 24–28). Quantitative security assurance metrics: REST API case studies. Proceedings of the 12th European Conference on Software Architecture: Companion Proceedings, Madrid, Spain.10.1145/3241403.3241464 ↗
25. Quantitative Security Metrics: Unattainable Holy Grail or a Vital Breakthrough within Our Reach?10.1109/MSP.2014.31 ↗
26. Database Security—Threats & Prevention10.14445/22312803/IJCTT-V67I5P108 ↗
27. Using Blockchain in Cloud Computing to Enhance Relational Database Security10.1109/ACCESS.2021.3117733 ↗
28. Pfleeger, C.P., Pfleeger, S.L., and Margulies, J. (2015). Security in Computing, Prentice Hall. [5th ed.].
29. Mousa, A., Karabatak, M., and Mustafa, T. (2020, January 1–2). Database security threats and challenges. Proceedings of the 8th International Symposium on Digital Forensics and Security (ISDFS), Beirut, Lebanon.10.1109/ISDFS49300.2020.9116436 ↗
30. Connolly, T.M., and Begg, C.E. (2015). Database Systems: A Practical Approach to Design, Implementation, and Management, Pearson Education Limited.
31. Review of attacks on databases and database security techniques
32. Information security effectiveness: A research framework
33. A comparison of security requirements engineering methods10.1007/s00766-009-0092-x ↗
34. Hoffman, L.J. (1977). Modern Methods for Computer Security and Privacy, Prentice-Hall, Inc.
35. Hoffman, L.J., and Clements, D. (1977). Fuzzy Computer Security Metrics: A Preliminary Report, Electronics Research Laboratory, College of Engineering University of California. Available online: https://www2.eecs.berkeley.edu/Pubs/TechRpts/1977/ERL-m-77-6.pdf.
36. Methods of evaluating the effectiveness of protecting the assets in information technology objects
37. Methods for assessing the effectiveness of information systems protection systems
38. Domarev, V.V. (2004). Information Technology Security. Systems Approach, OOO «TID «DS».
39. Hoffmann, R., Kiedrowicz, M., and Stanik, J. (2016, January 14–17). Evaluation of information safety as an element of improving the organization’s safety management. Proceedings of the 20th International Conference on Circuits, Systems, Communications and Computers (CSCC 2016), MATEC Web of Conferences, Corfu Island, Greece.
40. Kiedrowicz, M., and Stanik, J. (2018, January 14–17). Method for assessing efficiency of the information security management system. Proceedings of the 22nd International Conference on Circuits, Systems, Communications and Computers (CSCC 2018), MATEC Web of Conferences, Majorca, Spain.
41. Information Security Risk Analysis Methods and Research Trends: AHP and Fuzzy Comprehensive Method
42. (2021, September 21). ISO/IEC 15408-1:2009. Information Technology. Security Techniques. Evaluation Criteria for IT Security. Part 1: Introduction and General Model. Available online: https://www.iso.org/standard/50341.html.
43. (2021, September 21). ISO/IEC 27001:2013. Information Technology. Security Techniques. Information Security Management Systems. Requirements. Available online: https://www.iso.org/standard/54534.html.
44. (2021, September 21). ISO/IEC 27004:2016. Information Technology. Security Techniques. Information Security Management. Monitoring, Measurement, Analysis and Evaluation. Available online: https://www.iso.org/standard/64120.html.
45. Database Security: Threads and Challenges
46. Imperva Whitepaper (2021, September 21). Top Ten Database Security Threats. Available online: https://informationsecurity.report/Resources/Whitepapers/e763d022-6ee4-4215-9efd-1896b0d9c381_wp_topten_database_threats%20imperva.pdf.
47. Imperva Whitepaper (2021, September 21). Top 5 Database Security Threats. Available online: https://www.imperva.com/docs/gated/WP_Top_5_Database_Security_Threats.pdf.
48. (2021, September 21). DB-Engines Ranking. Available online: https://db-engines.com/en/ranking.
49. (2021, September 21). TOPDB Top Database Index. Available online: https://pypl.github.io/DB.html.
50. Adrian, M., Feinberg, D., and Heudecker, N. (2021, September 21). Gartner Magic Quadrant for Operational Database Management Systems. ID G00376881. Available online: https://www.gartner.com/en/documents/3975492/magic-quadrant-for-operational-database-management-syste.
51. Adrian, M., Feinberg, D., Greenwald, R., Ronthal, A., and Cook, H. (2021, September 21). Critical Capabilities for Cloud Database Management Systems for Operational Use Cases. ID G00468197. Available online: https://www.oracle.com/explore/adw-ocom/gartner-cloud-database-management/?source=:ow:o:p:mt:::RC_WWMK200720P00100:Gartnerdatabase&intcmp=:ow:o:p:mt:::RC_WWMK200720P00100:Gartnerdatabase&lb-mode=overlay.
52. Groff, J., Weinberg, P., and Oppel, A. (2010). SQL: The Complete Reference, McGraw-Hill, Inc.. [3rd ed.].
53. Talabis, M., and Martin, J. (2012). Information Security Risk Assessment Toolkit Practical Assessments through Data Collection and Data Analysis, Syngress.10.1016/B978-1-59-749735-0.00004-X ↗
54. Whitman, M.E., and Mattord, H.J. (2017). Principles of Information Security, Cengage Learning. [6th ed.].
55. (2020). NIST Special Publication 800-53 Revision 5. Security and Privacy Controls for Information Systems and Organizations, National Institute of Standards and Technology.
56. (2021, September 21). ISO/IEC 27002:2013 Information Technology. Security Techniques. Code of Practice for Information Security Controls. Available online: https://www.iso.org/standard/54533.html.
57. (2021, September 21). ISO/IEC 27000:2018 Information Technology. Security Techniques. Information Security Management Systems. Overview and Vocabulary. Available online: https://www.iso.org/standard/73906.html.
58. Astakhov, A.M. (2010). The Art of Information Risk Management, DMK Press.
59. MITRE (2021, September 21). CWE VIEW: Research Concepts. Available online: https://cwe.mitre.org/data/definitions/1000.html.
60. Astakhov, A. (2002). Analysis of the Security of Corporate Systems, Open System DBMS. Available online: https://www.osp.ru/os/2002/07-08/181720.
61. Optimization of the choice of the composition of the means of engineering and technical information protection based on the Clements-Hoffman model
62. Economic analysis of normative and technical support of information security
63. Database security—Attacks and control methods
64. Expert-analytical assessment of information risks and the efficiency level of the information protection system
65. The concept of a linguistic variable and its application to approximate reasoning—I10.1016/0020-0255(75)90036-5 ↗
66. Petrenko, S.A., and Simonov, S.V. (2004). Information Risk Management. Economically Justified Safety, DMK Press.
67. (2021, September 21). NIST Special Publication 800-30 Revision 1. Guide for Conducting Risk Assessments, Available online: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf.
68. Simulation of computer attacks on distributed software
69. FSTEC Russia (2021, September 21). Methodology for Determining Current Threats to the Security of Personal Data during Their Processing in Personal Data Information Systems. Available online: https://fstec.ru/tekhnicheskaya-zashchita-informatsii/dokumenty/114-spetsialnye-normativnye-dokumenty/380-metodika-opredeleniya-aktualnykh-ugroz-bezopasnosti-personalnykh-dannykh-pri-ikh-obrabotke-v-informatsionnykh-sistemakh-personalnykh-dannykh-fstek-rossii-2008-god.
70. Leonenkov, A.V. (2005). Fuzzy Modeling in MATLAB and Fuzzytech, BHV Petersburg.
71. Kruglov, V.V., Dli, M.I., and Golunov, R.Y. (2001). Fuzzy Logic and Artificial Neural Networks, Fizmatlit.
72. Piegat, A. (2001). Fuzzy Modeling and Control, Physica-Verlag.10.1007/978-3-7908-1824-6 ↗
73. Method for Development of Databases Easily Adaptable to Variations in The Subject Domain10.1615/TelecomRadEng.v78.i7.40 ↗
74. Yesin, V.I., Karpinski, M., Yesina, M.V., Vilihura, V.V., Veselska, O., and Wieclaw, L. (2019, January 18–21). Approach to Managing Data From Diverse Sources. Proceedings of the 10th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS), Metz, France.10.1109/IDAACS.2019.8924235 ↗
75. From databases to dataspaces: A new abstraction for information management10.1145/1107499.1107502 ↗
76. Saeed, K., and Homenda, W. (2018). Ensuring Database Security with the Universal Basis of Relations. CISIM 2018: Computer Information Systems and Industrial Management, Springer. Chapter 42.
77. Yesin, V., Karpinski, M., Yesina, M., Vilihura, V., and Warwas, K. (2020). Hiding the Source Code of Stored Database Programs. Information, 11.10.3390/info11120576 ↗
78. Monitoring the integrity and authenticity of stored database objects10.1615/TelecomRadEng.v79.i12.20 ↗
79. Some approach to data masking as means to counteract the inference threat10.30837/rt.2019.3.198.09 ↗
80. Yesin, V., Karpinski, M., Yesina, M., Vilihura, V., and Warwas, K. (2021). Ensuring Data Integrity in Databases with the Universal Basis of Relations. Appl. Sci., 11.10.3390/app11188781 ↗
81. Sadalage, P.J., and Fowler, M. (2013). NoSQL Distilled: A Brief Guide to the Emerging World of Polyglot Persistence, Pearson Education.
82. Protection in operating systems10.1145/360303.360333 ↗
83. A Linear Time Algorithm for Deciding Subject Security10.1145/322017.322025 ↗
84. Clark, D.D., and Wilson, D.R. (1987, January 27–29). A Comparison of Commercial and Military Computer Security Policies. Proceedings of the IEEE Symposium on Research in Security and Privacy (SP’87), Oakland, CA, USA.10.1109/SP.1987.10001 ↗
85. Bashir, I. (2018). Mastering Blockchain: Distributed Ledger Technology, Decentralization, and Smart Contracts Explained, Packt Publishing. [2nd ed.].
86. Antonopoulos, A.M. (2017). Mastering Bitcoin: Programming the Open Blockchain, O’Reilly Media. [2nd ed.].
87. Cotner, C., and Miller, R.L. (2018). International Business Machines Corporation. Row-Level Security in a Relational Database Management System. (8,478,713 B2), US Patent, N 15/343,568.
88. Meier, A., and Kaufmann, M. (2019). SQL & NoSQL Databases. Databases Models, Languages, Consistency Options and Architectures for Big Data Management, Springer Fachmedien.10.1007/978-3-658-24549-8 ↗
89. Harrison, G. (2015). Next Generation Databases: NoSQL, NewSQL, and Big Data, Apress.10.1007/978-1-4842-1329-2 ↗
90. What’s Really New with NewSQL?10.1145/3003665.3003674 ↗
91. Garcia-Molina, H., Ullman, J.D., and Widom, J. (2009). Database Systems: The Complete Book, Pearson Prentice Hall. [2nd ed.].