Security and data governance

어휘

English	의미
authentication/ɔːˌθentɪˈkeɪʃn/	authentication
authorisation/ˌɔːθəraɪˈzeɪʃn/	The granting or checking of permission to access a resource or perform an action.
principle of least privilege/ˈprɪnsɪpl ɒv liːst ˈprɪvɪlɪdʒ/	Giving each user or process only the access needed to carry out its authorised tasks.
parameterised statements	parameterised statements
data governance	data governance

English

Who you are, what you may

Authentication proves who you are; authorisation proves what you may do. The principle of least privilege shapes both: accounts get the narrowest grants that let the job run.

{exercise:uni-cs0806-auth}

연습

Authorisation decides —

난이도 1/5 · 100코인 + 오늘 첫 완료 시 작은 보너스 추가

English

A query built by pasting user text — "... WHERE name = '" + input + "'" — with input ' OR '1'='1 matches every row: on the sample schema, all 8 students.
Parameterised statements send the query and the values on separate channels: the attacker's text can only ever be a value, so the attack class ends, not just the example.

{exercise:uni-cs0806-inject}

연습

Input ' OR '1'='1 in a pasted query matches —

난이도 1/5 · 100코인 + 오늘 첫 완료 시 작은 보너스 추가

English

The teaching grants: GRANT SELECT ON Student TO reader; GRANT SELECT, INSERT ON Enrollment TO clerk; — the clerk cannot delete an enrollment, and a stolen session is bounded by the grant. Revoke on role change, not on audit day.
Data governance classifies data (public, internal, sensitive), assigns owners, sets retention, and audits access: the sensitive grade column is encrypted at rest, its access logged, stale grants revoked quarterly. Never connect the application as the owner — every bug then runs with full authority.

{exercise:uni-cs0806-grants}

연습

Parameterised statements end SQL injection because —

난이도 1/5 · 100코인 + 오늘 첫 완료 시 작은 보너스 추가