Security and data governance
แนะนำใหม่
คำศัพท์
| English | ความหมาย |
|---|---|
| authentication/ɔːˌθentɪˈkeɪʃn/ | Checking the identity claimed by a user, device or process. |
| authorisation/ˌɔːθəraɪˈzeɪʃn/ | The granting or checking of permission to access a resource or perform an action. |
| principle of least privilege/ˈprɪnsɪpl ɒv liːst ˈprɪvɪlɪdʒ/ | Giving each user or process only the access needed to carry out its authorised tasks. |
| parameterised statements | parameterised statements |
| data governance | Rules, responsibilities and processes for managing data quality, access, use and retention. |
English
Who you are, what you may
- Authentication proves who you are; authorisation proves what you may do. The principle of least privilege shapes both: accounts get the narrowest grants that let the job run.
{exercise:uni-cs0806-auth}
ฝึกฝน
Authorisation decides —
ความยาก 1/5 · 100 เหรียญ + บอนัสน้อยๆ เมื่อทำสำเร็จครั้งแรกในวันนี้
Authentication proves identity; authorisation bounds the rights.
English
Injection, ended
- A query built by pasting user text —
"... WHERE name = '" + input + "'"— with input' OR '1'='1matches every row: on the sample schema, all 8 students. - Parameterised statements send the query and the values on separate channels: the attacker's text can only ever be a value, so the attack class ends, not just the example.
{exercise:uni-cs0806-inject}
ฝึกฝน
Input ' OR '1'='1 in a pasted query matches —
ความยาก 1/5 · 100 เหรียญ + บอนัสน้อยๆ เมื่อทำสำเร็จครั้งแรกในวันนี้
The tautology makes the WHERE always true - on the sample, all 8 students.
English
Grants that fit, governance that loops
- The teaching grants:
GRANT SELECT ON Student TO reader; GRANT SELECT, INSERT ON Enrollment TO clerk;— the clerk cannot delete an enrollment, and a stolen session is bounded by the grant. Revoke on role change, not on audit day. - Data governance classifies data (public, internal, sensitive), assigns owners, sets retention, and audits access: the sensitive grade column is encrypted at rest, its access logged, stale grants revoked quarterly. Never connect the application as the owner — every bug then runs with full authority.
{exercise:uni-cs0806-grants}
ฝึกฝน
Parameterised statements end SQL injection because —
ความยาก 1/5 · 100 เหรียญ + บอนัสน้อยๆ เมื่อทำสำเร็จครั้งแรกในวันนี้
Separate channels: attacker text can only ever be a value.