Security and data governance
Introduced
Vocabulary
| English | Meaning |
|---|---|
| authentication/ɔːˌθentɪˈkeɪʃn/ | Checking the identity claimed by a user, device or process. |
| authorisation/ˌɔːθəraɪˈzeɪʃn/ | The granting or checking of permission to access a resource or perform an action. |
| principle of least privilege/ˈprɪnsɪpl ɒv liːst ˈprɪvɪlɪdʒ/ | Giving each user or process only the access needed to carry out its authorised tasks. |
| parameterised statements | parameterised statements |
| data governance | Rules, responsibilities and processes for managing data quality, access, use and retention. |
Who you are, what you may
- Authentication proves who you are; authorisation proves what you may do. The principle of least privilege shapes both: accounts get the narrowest grants that let the job run.
{exercise:uni-cs0806-auth}
Practice
Authorisation decides —
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Authentication proves identity; authorisation bounds the rights.
Injection, ended
- A query built by pasting user text —
"... WHERE name = '" + input + "'"— with input' OR '1'='1matches every row: on the sample schema, all 8 students. - Parameterised statements send the query and the values on separate channels: the attacker's text can only ever be a value, so the attack class ends, not just the example.
{exercise:uni-cs0806-inject}
Practice
Input ' OR '1'='1 in a pasted query matches —
Difficulty 1/5 · 100 coins + a small bonus on first completion today
The tautology makes the WHERE always true - on the sample, all 8 students.
Grants that fit, governance that loops
- The teaching grants:
GRANT SELECT ON Student TO reader; GRANT SELECT, INSERT ON Enrollment TO clerk;— the clerk cannot delete an enrollment, and a stolen session is bounded by the grant. Revoke on role change, not on audit day. - Data governance classifies data (public, internal, sensitive), assigns owners, sets retention, and audits access: the sensitive grade column is encrypted at rest, its access logged, stale grants revoked quarterly. Never connect the application as the owner — every bug then runs with full authority.
{exercise:uni-cs0806-grants}
Practice
Parameterised statements end SQL injection because —
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Separate channels: attacker text can only ever be a value.