By the end of this chapter, you will be able to:
These skills will help you protect valuable data and keep your organisation’s information safe and secure in the real world.
Type: Individual
| Tools & Equipment | Materials |
|---|---|
| Relational Database Management System (MySQL 8.0 or MS SQL Server 2019) | integer |
| Data Modelling Tool (Draw.io or Lucidchart) | varchar |
| Rewritable Compact Disc (CD-RW) | date/time |
| S/N | Item | Quantity |
|---|---|---|
| 1 | Relational Database Management System (MySQL 8.0 or MS SQL Server 2019) | 1 Instance per Candidate |
| 2 | Data Modelling Tool (Draw.io or Lucidchart) | 1 License per Candidate |
| 3 | Rewritable Compact Disc (CD-RW) | 1 Disc per Candidate |
| Items to be Evaluated | Marks Available | Marks Obtained | Comments |
|---|---|---|---|
| TASK 1: Explain Key Database Security Concepts | |||
| Explained authentication mechanisms (user accounts, passwords) (Award 3 marks for clear explanation of authentication) | 3 | ||
| Explained authorization and role-based access control (Award 3 marks for clear explanation of authorization) | 3 | ||
| Explained encryption of data at rest and in transit (Award 3 marks for clear explanation of encryption) | 3 | ||
| Explained importance of auditing and logging database activities (Award 3 marks for clear explanation of auditing) | 3 | ||
| Sub-Total | 12 | ||
| TASK 2: Demonstrate Database Security Features | |||
| Created at least three distinct user accounts with different privileges (Award 4 marks for correct user account creation and privilege assignment) | 4 | ||
| Configured role-based access control restricting access to sensitive data (Award 4 marks for correct role and permission configuration) | 4 | ||
| Enabled encryption for data storage or connection encryption (e.g. SSL/TLS) (Award 3 marks for proper encryption setup) | 3 | ||
| Set up audit logging to track user activities on the database (Award 3 marks for audit logging configuration) | 3 | ||
| Sub-Total | 14 | ||
| TASK 3: Backup and Report Generation | |||
| Created a backup of the database and saved it to a CD-RW (Award 3 marks for successful backup and correct media usage) | 3 | ||
| Generated a brief report summarizing implemented security measures (Award 3 marks for clear and concise report) | 3 | ||
| Sub-Total | 6 | ||
| PRODUCT CHECKLIST | |||
| Database security configuration correctly implemented and functional (Award 10 marks for fully functional security features as per task) | 10 | ||
| Sub-Total | 10 | ||
| GRAND TOTAL | 42 | ||
Type: Individual
| Tools & Equipment | Materials |
|---|---|
| Relational Database Management System (MySQL Server 8.0 or PostgreSQL 13) | Sample Customer Database Schema with Test Data |
| Database Security Simulation Tool (SQLMap or Metasploit Framework) | |
| Network Packet Sniffer (Wireshark or equivalent) |
| S/N | Item | Quantity |
|---|---|---|
| 1 | Relational Database Management System (MySQL Server 8.0 or PostgreSQL 13) | 1 Instance per Candidate |
| 2 | Database Security Simulation Tool (e.g., SQLMap, Metasploit Framework) | 1 Tool per Candidate |
| 3 | Sample Customer Database Schema with Test Data | 1 per Candidate |
| 4 | Network Packet Sniffer (Wireshark or equivalent) | 1 Tool per Candidate |
| Items to be Evaluated | Marks Available | Marks Obtained | Comments |
|---|---|---|---|
| TASK 1: Identify Database Security Threats | |||
| Candidate lists at least three common database security threats (e.g., SQL Injection, Privilege Escalation, Brute Force Attacks) (Award 1 mark for each correctly identified threat, zero otherwise) | 3 | ||
| Candidate explains the potential impact of each identified threat (Award up to 3 marks based on clarity and correctness of explanations) | 3 | ||
| Sub-Total | 6 | ||
| TASK 2: Simulate Unauthorized Access Attempts | |||
| Candidate configures the database environment to prepare for simulation (Award 2 marks if environment is correctly set up, zero otherwise) | 2 | ||
| Candidate successfully simulates an SQL Injection attack using the security simulation tool (Award 4 marks for a complete and successful simulation) | 4 | ||
| Candidate simulates a brute force login attempt on the database user accounts (Award 4 marks for correctly executed brute force simulation) | 4 | ||
| Candidate uses the network packet sniffer to capture and analyze unauthorized access traffic (Award 4 marks for capturing relevant traffic and basic analysis) | 4 | ||
| Sub-Total | 14 | ||
| TASK 3: Document Security Threats and Recommendations | |||
| Candidate documents the unauthorized access scenarios simulated with screenshots or logs (Award 4 marks for clear and complete documentation) | 4 | ||
| Candidate provides at least two recommendations for mitigating each simulated threat (Award 1 mark per valid recommendation, up to 6 marks) | 6 | ||
| Sub-Total | 10 | ||
| PRODUCT CHECKLIST | |||
| Complete report including identified threats, simulation evidence, and mitigation recommendations (Award up to 10 marks based on completeness, clarity, and professionalism of the report) | 10 | ||
| Sub-Total | 10 | ||
| GRAND TOTAL | 40 | ||
At the start of this chapter we promised you would be able to:
Tick each one you can genuinely do.
So, are you there yet?
You're competent when you can confidently do 50% or more of what this chapter promised.
Sign in to record how you're doing.