Control Measures
• Access control
– A security problem common to computer systems is that of preventing unauthorized
persons from accessing the system itself, either to obtain information or to make
malicious changes in a portion of the database.
– The security mechanism of a DBMS must include provisions for restricting access to
the database system as a whole. This function, called access control, is handled by
creating user accounts and passwords to control the login process by the DBMS.
• Inference control
– Statistical databases are used to provide statistical information or summaries of
values based on various criteria.
• For example, a database for population statistics may provide statistics based on age groups,
income levels, household size, education levels, and other criteria. Statistical database users
such as government statisticians or market research firms are allowed to access the database
to retrieve statistical information about a population but not to access the detailed confidential
information about specific individuals.
• Security for statistical databases must ensure that information about individuals cannot be
accessed. It is sometimes possible to deduce or infer certain facts concerning individuals from
queries that involve only summary statistics on groups; consequently, this must not be
permitted either.
– This problem, called statistical database security. The corresponding control
measures are called inference control measures.