Data Management Approaches and

Elements of the Database Environment

Chapter 4 - Security II:

Auditing Database Systems
Information Technology Auditing
By James Hall
 Security Part II:
Auditing Database Systems
• Data Management Approaches
• The Flat-File Approach
• The Database Approach
• Key Elements of the Database Environment
• Database Management System
• Users
• The Database Administrator
• The Physical Database
• DBMS Models
• Centralized Model - Hierarchical, Network, Relational
• Distributed Database - Centralized database, Distributed database: Replicated database,
Partitioned database
DATA MANAGEMENT APPROACHES:
Two (2) general approaches in database
• 1) flat-file model
• Private ownership of data
• root cause of several problems that inhibit data integration.
• used in many older (legacy) systems
• a single-user view approach
• Problems:
• Data redundancy: data storage, data updating, currency of information
• Task-data dependency
• To overcome this problem: Database Model through data sharing
DATA MANAGEMENT APPROACHES:
Two (2) general approaches in database
• 2) database model
• entity-wide data sharing and centralized control of data
• Issue to consider by the Auditor:
• procedures for assigning user authority.
• User’s program
• Sends requests for data to the DBMS.
• DBMS
• Validates and authorizes access to the database.
• Benefits:
• Elimination of Data Update Problem
• Elimination of Currency Problem
• Elimination of Task-Data Dependency Problem
KEY ELEMENTS OF THE DATABASE
ENVIRONMENT
• 1) Database management
system (DBMS)
• 2) Users
• 3) Database administrator
• 4) Physical database
• 5) DBMS models
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
1) Database Management System (DBMS)
• Four (4) Typical Features of DBMS:
• 1) Program development
• programmers and end users may create applications to access the database.
• 2) Backup and recovery
• 3) Database usage reporting.
• to help assign user authorization and maintain the database.
• 4) Database access
• 2 ways to access the database by the users :
• formal access – application interfaces
• Informal access – query language
• 3 software modules:
• data definition language (DDL)
• data manipulation language (DML)
• query language
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
1) DBMS – Database Access
• Three (3) software modules that
facilitate the database access:
• 1) Data Definition Language (DDL)
• Is used to define the database to the DBMS
• used by database administrators during
the setup and removal phases of a
database project.
• 3 levels of database views:
• internal view/physical view
• Describes the structures of data records and
linkages between files
• Physical arrangement & sequence of records in
the database
• One view
• conceptual view/logical view (schema)
• Describes the entire database
• One view
• external view/user view (subschema)
• Defines the user’s section of the database.
• Many views
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
1) DBMS – Database Access
• Three (3) software modules
that facilitate the database
access:
• 2) Data Manipulation
Language (DML) – formal
access: application interface
• Is used by all database users
during the routine operation
of the database.
• 3) Query Language -
Informal Access: Direct
query
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
2) Users
• Figure 4.3 shows how users access the database
in two ways.
• 1) Formal Access: Application Interfaces
• Access data by using the formal application
interfaces.
• User programs, prepared by systems professionals,
send data access requests (calls) to the DBMS, which
validates the requests and retrieves the data for
processing.
• DML  uses to retrieve, process, and store data.
• 2) Informal Access: Query Language
• Query
• Access data via direct query, which requires no formal
user programs using the DBMS’s built-in query facility.
• for integrating and retrieving data to produce ad hoc
management reports.
• SQL:
• IBM’s SQL – the standard query language
• Select Command
User view=conceptual
view access granted
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
3) The Database Administrator
• DBA function or responsibility:
• In large organizations: May consist of an entire department of technical personnel under the database
administrator.
• In smaller organizations: May be assumed by someone within the computer services group.
• The duties of the DBA fall into five (5) areas:
• Database planning
• Database design
• Database implementation
• Operation and maintenance
• Database growth and change
• Two (2) Important functions of DBA:
• 1) Organizational Interactions of the DBA
• The relationship among the DBA, the end users, and the systems professionals of the organization
• 2) Creation and maintenance of the Data Dictionary
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
4) The Physical Database
• Physical database
• Consists of magnetic spots on metallic coated disks.
• At the physical level, the database forms a logical collection of records and
files that constitute the firm’s data resource.
• The other levels of the database
• the user view, conceptual view, and internal view
• are abstract representations of the physical level.
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
4) The Physical Database – Data Structures
• Seven (7) file processing operations that data structures must support:
• 1. Retrieve a record from the file based on its primary key value.
• 2. Insert a record into a file.
• 3. Update a record in the file.
• 4. Read a complete file of records.
• 5. Find the next record in a file.
• 6. Scan a file for records with common secondary keys.
• 7. Delete a record from a file.
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
4) The Physical Database – Data Structure
• Two (2) components of data structures:
• 1) Data organization
• sequential or random
• 2) Data access method

• Six (6) criteria that influence the selection of the data structure :
• 1. Rapid file access and data retrieval
• 2. Efficient use of disk storage space
• 3. High throughput for transaction processing
• 4. Protection from data loss
• 5. Ease of recovery from system failure
• 6. Accommodation of file growth
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models
• Database Terminology
• Data Attribute/Field
• Entity
• physical entity (inventories, customers, and employees)
• conceptual entity (sales, accounts receivable, and depreciation expense).
• Record Type
• Table or File or Folder
• Database
• Associations: Three basic record associations:
• 1) one-to-one
• 2) one-to-many
• 3) many-to-many
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models
• Data model
• Purpose of a data model: to represent entity attributes in a way that is understandable to users.
• Each DBMS is based on a particular conceptual model.

• Structure of the IT Function (Chapter 2)

• 1) Centralized approach: The three models are presented from the perspective of a
centralized IT function:
• Hierarchical, Network, Relational
• 2) Distributed approach: Examines the role of database technology in the distributed
environment
• Centralized database, Distributed database: Replicated database, Partitioned database
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models - Centralized
Hierarchical Model
• The earliest DBMSs.
• IBM’s information management
system (IMS)
• also called a tree structure.
• Root segment
• Leaf .
• is constructed of sets that describe
the relationship between two linked
files.
• Each set  contains a parent and a child.
• Siblings
• requires access from the root entity
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models - Centralized
Hierarchical Model
• Is called a Navigational Databases.
• traversing the files requires following a predefined path.
• established through explicit linkages (by using pointers)
between related records.

• LIMITATIONS: The following rules, which govern the

hierarchical model, reveal its operating constraints:
• 1. A parent record may have one or more child records
(1:M).
• For example, in Figure 4.9, customer is the parent of both
sales invoice and cash receipts.
• 2. No child record can have more than one parent.

• Solution: Network Model

KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models – Network Model
• Committee on Development of Applied Symbolic Languages
(CODASYL)
• IDMS (integrated database management system)
• Also a navigational database with explicit linkages between records
and files.
• Permits a child record to have multiple parents (M:M).
• can be accessed at either
• of the root level records (salesperson or customer) or
• by entering the appropriate primary key (SP # or Cust #).
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models – Relational Model
• E. F. Codd
• Portrays data in the form of two-dimensional tables.
• Attributes (data fields) - Across the top of the table forming columns.
• Each attribute in the row should be dependent on (uniquely defined by) the primary key and independent of the other attributes.
• Tuples - Intersecting the columns to form rows in the table.
• How are relations formed? By an attribute that is common to both tables in the relation. The table should be
normalized.

• The linkages are implicit.

• Established through logical operations of the DBMS.
• Data associations: The degree of the association between two tables determines the method used for assigning
foreign keys.
• 1:1 - either table’s primary key may be embedded in the other as a foreign key.
• 1:M - the primary key on the “one” side is embedded as the foreign key on the “many” side.
• Many-to-many associations between tables do not use embedded foreign keys.
• Instead, a separate link table containing keys for the related tables needs to be created.
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models
• Structure of the IT Function (Chapter 2)
• 1) Centralized approach: The three models are presented from the
perspective of a centralized IT function:
• Hierarchical, Network, Relational
• 2) Distributed approach: Examines the role of database technology in
the distributed environment
• Centralized database, Distributed database: Replicated database, Partitioned
database
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models - Distributed
• Database Distribution Methods
• Organization’s concern: Ability to maintain data integrity.
• Accountant’s Concern:
• The preservation of audit trails
• The accuracy of accounting records

• Two (2) basic options of the database in a distributed system:

• 1) Centralized database
• 2) Distributed databases:
• two categories: partitioned databases and replicated databases.
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models – Centralized Databases
• involves retaining the data in a central location.

• Remote IT units  the data are processed and updated at

the remote site and sent back to the central site .
• Central site  the data are stored or retrieved centrally.

• Objective: Data Currency in a DDP Environment

• Problem: temporary inconsistency that results in

permanent damage to accounting records
• where the values of the account balances are incorrectly stated
during the execution of a transaction.
• Occurs when multiple IT units simultaneously access the
individual data elements

• Solution: Database Lockout

• To achieve data currency:
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models – Partitioned Databases
• Primary user
• Advantages:
• increases users’ control.
• Transaction processing response
time is improved.
• reduce the volume of data that must
be transmitted between IT units.
• reduce the potential effects of a
disaster.
• works best for organizations that
require minimal data sharing
among their distributed IT units.
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models –Partitioned Databases
• The Deadlock Phenomenon
• To resolve a deadlock
• terminate one or more transactions to complete
processing of the other transactions in the deadlock.
• The preempted transactions must then be reinitiated.
• Deadlock Resolution:
• In preempting transactions, the deadlock resolution
software attempts to minimize the total cost of
breaking the deadlock.

• Three (3) factors that are considered in the

deadlock resolution:
• 1) The resources currently invested in the
transaction.
• 2) The transaction’s stage of completion.
• 3) The number of deadlocks associated with the
transaction.
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models – Replicated Databases
• effective in companies where there exists a
high degree of data sharing but no primary
user.
• Advantages:
• the data traffic between sites is reduced
considerably.
• Lockouts and delays due to data traffic are
minimized.
• Primary justification for a replicated
database:
• to support read-only queries.

• Problem: Maintaining current versions of

the database at each site.
• Database concurrency
KEY ELEMENTS OF THE DATABASE ENVIRONMENT:
5) DBMS Models –Replicated Databases
• Solution: Concurrency Control:
• A commonly used method is to serialize
transactions.
• To serialize transactions, involves labeling
each transaction by two criteria:
• 1) special software groups transactions into
classes to identify potential conflicts.
• No conflict
• read-only (query) transactions
• transactions that do not use the same data
• Conflict:
• Multiple transactions that access the dame data
• read and write operations
• 2) to time-stamp each transaction.
• An algorithm is used to schedule updates to the
database based on the transaction time stamp
and class.