Maintaining the security and integrity of a statistical database requires specific security controls and techniques that need to be implemented by database administrators. A specific security issue involves an authorized user who attempts to gain private (unauthorized) information through one or a series of statistical queries by utilizing inference techniques in a purely statistical database.  Three control methods that are typically used to make inferences on statistical databases can include information supplied in the query and/or in past queries within the user interface, information held by the user outside of the information system, and information stored within the database (Hansen, 1995). Specific controls and countermeasures can be implemented to circumvent the inference techniques used by unauthorized users which can include inference command detection during at the time of the query or building inference controls into the database original design. An often-adopted security control by database developers is a query screener that seeks to discover the intent of a user’s input and validate the results of subsequent query results against a preconfigured output control that filters out confidential information from the results of the query. Utilizing logging of user access and flagging sequences of potentially malicious queries can also be utilized to conduct breach investigation and for hardening the existing database security protocols.

Question to consider…

Implementing inference security controls for a statistical database system can cause valid user queries to be automatically denied and flagged for investigation. What are some techniques to provide this type of security control and still ensure the normal business operations aren’t negatively impacted?

Reference

Steven C. Hansen. (1995). Hybrid inferential security methods for statistical databases. ACM SIGAPP Applied Computing Review – Special Issue on Security, 3(1), 14–18. https://doi.org/10.1145/214310.21 4433