Lesson 7: Security, Access Control, Auditing, and Data Privacy

Database security is the protection of data against unauthorized access, misuse, disclosure, alteration, or destruction.

A DBA supports security using practical principles such as:

• least privilege — users get only the access they need
• separation of duties — sensitive powers are not concentrated unnecessarily
• accountability — actions can be traced
• defense in depth — combine controls, do not rely on only one

In actual environments, not every staff member should see complete records. For example:

• a cashier may see payment status
• a registrar may manage enrollment records
• a faculty member may view grades for assigned classes only
• a system operator may manage service status without seeing confidential student details

The DBA implements these boundaries through users, roles, permissions, and carefully designed views.

Two terms should be clear:

• Authentication — proving identity
• Authorization — deciding what that identity is allowed to do

After login, the DBMS checks permissions such as:

• SELECT
• INSERT
• UPDATE
• DELETE
• object creation rights
• administrative privileges

The safest practice is to assign permissions through roles, then assign roles to users. This is easier to maintain than granting rights one person at a time.

Examples of poor practice:

• shared admin accounts
• giving all users full access because it is "faster"
• allowing the application to connect as a superuser
• leaving old employee accounts active

A DBA should also protect service accounts, rotate credentials where required, and review access regularly.