Security and data governance
Introduit
Vocabulaire
| English | Sens |
|---|---|
| authentication/ɔːˌθentɪˈkeɪʃn/ | authentication |
| authorisation/ˌɔːθəraɪˈzeɪʃn/ | The granting or checking of permission to access a resource or perform an action. |
| principle of least privilege/ˈprɪnsɪpl ɒv liːst ˈprɪvɪlɪdʒ/ | Giving each user or process only the access needed to carry out its authorised tasks. |
| parameterised statements | parameterised statements |
| data governance | data governance |
English
Who you are, what you may
- Authentication proves who you are; authorisation proves what you may do. The principle of least privilege shapes both: accounts get the narrowest grants that let the job run.
{exercise:uni-cs0806-auth}
Pratique
Authorisation decides —
Difficulté 1/5 · 100 pièces + un petit bonus lors de la première réussite aujourd'hui
Authentication proves identity; authorisation bounds the rights.
English
Injection, ended
- A query built by pasting user text —
"... WHERE name = '" + input + "'"— with input' OR '1'='1matches every row: on the sample schema, all 8 students. - Parameterised statements send the query and the values on separate channels: the attacker's text can only ever be a value, so the attack class ends, not just the example.
{exercise:uni-cs0806-inject}
Pratique
Input ' OR '1'='1 in a pasted query matches —
Difficulté 1/5 · 100 pièces + un petit bonus lors de la première réussite aujourd'hui
The tautology makes the WHERE always true - on the sample, all 8 students.
English
Grants that fit, governance that loops
- The teaching grants:
GRANT SELECT ON Student TO reader; GRANT SELECT, INSERT ON Enrollment TO clerk;— the clerk cannot delete an enrollment, and a stolen session is bounded by the grant. Revoke on role change, not on audit day. - Data governance classifies data (public, internal, sensitive), assigns owners, sets retention, and audits access: the sensitive grade column is encrypted at rest, its access logged, stale grants revoked quarterly. Never connect the application as the owner — every bug then runs with full authority.
{exercise:uni-cs0806-grants}
Pratique
Parameterised statements end SQL injection because —
Difficulté 1/5 · 100 pièces + un petit bonus lors de la première réussite aujourd'hui
Separate channels: attacker text can only ever be a value.