Security and data governance

語彙

English	意味
authentication/ɔːˌθentɪˈkeɪʃn/	Checking the identity claimed by a user, device or process.
authorisation/ˌɔːθəraɪˈzeɪʃn/	The granting or checking of permission to access a resource or perform an action.
principle of least privilege/ˈprɪnsɪpl ɒv liːst ˈprɪvɪlɪdʒ/	Giving each user or process only the access needed to carry out its authorised tasks.
parameterised statements	parameterised statements
data governance	Rules, responsibilities and processes for managing data quality, access, use and retention.

English

Who you are, what you may

Authentication proves who you are; authorisation proves what you may do. The principle of least privilege shapes both: accounts get the narrowest grants that let the job run.

{exercise:uni-cs0806-auth}

実践

Authorisation decides —

難易度 1/5 · 100 コイン + 今日初回達成時の小ボーナス

English

A query built by pasting user text — "... WHERE name = '" + input + "'" — with input ' OR '1'='1 matches every row: on the sample schema, all 8 students.
Parameterised statements send the query and the values on separate channels: the attacker's text can only ever be a value, so the attack class ends, not just the example.

{exercise:uni-cs0806-inject}

実践

Input ' OR '1'='1 in a pasted query matches —

難易度 1/5 · 100 コイン + 今日初回達成時の小ボーナス

English

The teaching grants: GRANT SELECT ON Student TO reader; GRANT SELECT, INSERT ON Enrollment TO clerk; — the clerk cannot delete an enrollment, and a stolen session is bounded by the grant. Revoke on role change, not on audit day.
Data governance classifies data (public, internal, sensitive), assigns owners, sets retention, and audits access: the sensitive grade column is encrypted at rest, its access logged, stale grants revoked quarterly. Never connect the application as the owner — every bug then runs with full authority.

{exercise:uni-cs0806-grants}

実践

Parameterised statements end SQL injection because —

難易度 1/5 · 100 コイン + 今日初回達成時の小ボーナス