JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD B.Tech III DATABASE SECURITY Previous Question Paper (February - 2022 - R18)

The Grant Model is a fundamental mechanism for access control in database systems, primarily used to manage privileges on database objects. Its applications include:

• Access Control Management: It provides a structured way to grant specific permissions (SELECT, INSERT, UPDATE, DELETE) to users or roles, ensuring that only authorized individuals can interact with sensitive data.
• Principle of Least Privilege: It allows administrators to assign the minimum level of access necessary for a user to perform their job functions, reducing the risk of accidental or malicious data modification.
• Delegation of Authority: Through the WITH GRANT OPTION, the model allows authorized users to delegate specific privileges to other users, facilitating decentralized administration in large organizations.
• Role-Based Access Control (RBAC): It serves as the underlying engine for implementing roles, where privileges are granted to a role rather than individual users, simplifying the management of permissions in dynamic environments.
• Audit and Compliance: By tracking who granted what privilege to whom, the model assists in maintaining an audit trail required for regulatory compliance and security monitoring.

Database security refers to the collective measures, tools, and processes used to protect a database from unauthorized access, misuse, corruption, or data breaches. It encompasses the protection of the database management system (DBMS), the data itself, and the applications that interact with it, ensuring the CIA Triad: Confidentiality, Integrity, and Availability.

Database security is required in the following situations:

• Protection of Sensitive Data: When storing Personally Identifiable Information (PII), financial records, or intellectual property, security is essential to prevent identity theft and corporate espionage.
• Regulatory Compliance: Organizations must adhere to legal frameworks such as GDPR, HIPAA, or PCI-DSS, which mandate strict controls over how data is stored, accessed, and protected.
• Prevention of SQL Injection: Databases are frequent targets of web-based attacks; security measures are required to sanitize inputs and prevent malicious code execution.
• Insider Threats: Security is necessary to restrict privileged users (such as DBAs) from accessing data beyond their scope of work, preventing internal data leaks.
• Data Integrity Maintenance: In multi-user environments, security controls prevent unauthorized modifications that could corrupt the consistency or accuracy of the database.
• Availability and Denial of Service: Security protocols protect against malicious attempts to overwhelm the database, ensuring that legitimate users maintain continuous access to critical business information.