(a) Define; (i) Data Security (i) Data risk assessment (b)(i) What is Access Control (ii) List the access control methods in database security. (c) State th...

This question tests data security concepts, risk assessment, access control in databases, and the duties of a database administrator.

(a)(i) Data security

Data security is the protection of data from unauthorised access, alteration, disclosure, or destruction, so that its confidentiality, integrity, and availability are preserved.

(a)(ii) Data risk assessment

Data risk assessment is the process of identifying the threats and vulnerabilities that could affect an organisation's data, judging how likely each is and how much harm it would cause, so that suitable safeguards can be chosen.

(b)(i) Access control

Access control is the security mechanism that decides and enforces who is allowed to view or use data and resources, and what actions (read, write, modify, delete) each user may perform.

(b)(ii) Access control methods in database security

• Discretionary Access Control (DAC): the owner of the data grants or revokes access rights to other users.
• Mandatory Access Control (MAC): access is decided by fixed security classifications/labels set by the system, not by individual owners.
• Role-Based Access Control (RBAC): permissions are assigned to roles, and users gain access according to the role they hold.

(Authentication methods such as passwords and biometrics support these controls.)

(c) Three roles of a database administrator (DBA)

• Managing security and access: creating user accounts and granting or revoking privileges to protect the data.
• Performing backup and recovery: keeping copies of the database and restoring it after failure.
• Maintaining and tuning the database: monitoring performance, controlling storage, and keeping data integrity (other valid roles: installing/upgrading the DBMS, designing the database structure).

Examination reminder: keep the terms distinct: data security is the overall protection, risk assessment is judging the threats beforehand, and access control is the specific mechanism that limits who can do what.