Database Access Control Policies

As organizations increase their dependence on database systems for daily business, they become more vulnerable to security breaches even as they gain productivity and efficiency advantages. A truly comprehensive approach for data protection must include mechanisms for enforcing access control policies based on data contents, subject qualifications and characteristics. The database security community has developed a number of different techniques and approaches to assure data confidentiality, integrity, and availability. In this paper, we survey the most relevant concepts underlying the notion of access control policies for database security. We review the key access control models, namely, the discretionary and mandatory access control models and the role-based access control (RBAC)