Beginning SQL

12
SQL Security
In today’s world, the security of the data in your database is a primary concern. Privacy concerns
and laws often make exposure of corporate data a catastrophic problem. Exposure of personal
information such as social security numbers or medical information can bring costly lawsuits or
even government fines and litigation. In the Internet age, the theft or exposure of such information
can be performed from half a world away. No longer can you just lock the door to the server and
remove the floppy disks from the workstations and consider yourself secure. The security issues
that you must deal with in the database world involve who can see what when, and they break
down into a handful of basic situations:
❑ The data in a specific table should be accessible to some users but not others.
❑ Some users should be able to modify particular tables, but other users should not.
❑ In some instances, access to tables should be broken down into columns of the tables. One
set of users should be able to see columns a, b, and d, while another set of users should be
able to access only columns c, e, and f.
❑ In other instances, the access to tables should be limited by rows. Perhaps department
managers should be able to see data about their department but not data about other
departments.
This chapter describes the methods that SQL provides to implement this security.
Security Concepts
Implementing the security system and enforcing the required restrictions are the responsibility of
the DBMS. The SQL language implements a security framework and provides a rather basic syntax
used to specify security restrictions. SQL grants access to objects by users; it does not restrict
access. In other words, a user cannot perform any action without first being granted the power to
do so.