What Database Management Systems Do and Why Protecting Them Is Critical

UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 8.1 Free with a free account

What Database Management Systems Do and Why Protecting Them Is Critical

Ethics in Technology · Chapter 8: Guarding the Data Vault: Database Protection, Cloud Risks, and Intrusion DetectionSection 8.1 · lesson 35 of 11616 min · free with a free account

← The Technical Skills and Emerging Trends Shaping Today’s Cybersecurity WorkforceNext lesson: Protecting Data Inside Databases →

Earn 3 college credits for Ethics in TechnologyRecommended for credit by NCCRS · Computer Science 195 · self-paced · one payment, lifetime access
Enroll in Ethics in Technology · $250 →Download the syllabus (PDF)

In this lesson

Management software, storage models, copies, and the human cost of exposure.

  • Separate data, management software, and infrastructure
  • Explain database functions and six storage families
  • Analyze concentrated records, credentials, and copies
  • Assess persistent personal harm and a ticketing-business scenario

Free study notes

Get this lesson's notes by email

The key points and 4 practice questions with answers, in your inbox. One email, free.

One email. Unsubscribe in one click.

Transcript

Everything said in the video, section by section (1,960 words). Read along, or search it.

Chapter 8

Databases, Concentrated Value, and Protection

A database collects organized information, while its management software coordinates how people and applications use it. Keep collection, management software, and infrastructure distinct. Responsibility for design, permissions, updates, and protection depends on that distinction. This lesson explains database functions, storage families, deployment choices, and the copies that hold sensitive information. We examine why organized collections can attract attention, including their concentration and linked records. Copying information may leave the original present, so a working service does not prove confidentiality. We also consider insiders, whose legitimate access can exceed the needs of one task. Then we name the categories of information and the harms their exposure could enable. Linked fields can be more useful together, while some personal facts resist ordinary recovery measures. Finally, a ticketing-business example separates the impact of exposure from the strength of protection. We qualify the source's absolute claims, because permissions, encryption, valid credentials, and deployment details matter. The aim is responsible protection of information and people, across normal interfaces and every other relevant access path.

Architecture

The DBMS Mediates Normal Requests, While Other Layers Protect Storage

The collection, management software, and supporting machine are different parts of the system. A database is the organized information; the management system provides interfaces and supported coordination functions. Infrastructure includes storage, operating systems, machines, and the hosted services that support the collection. Applications normally submit requests through managed interfaces, rather than editing storage files by hand. Managed access provides a useful place to enforce permissions. It also supports recording activity and coordinating changes. It does not mean database permissions are the only possible route to the underlying information. Privileged filesystem access, stolen storage, and exposed backups can bypass that normal request path. Operating-system controls, cloud configuration, storage protection, and encryption-key access therefore remain important. A software flaw may need a patch, while excessive account permissions require a different correction. Poor design, unsafe hosting, or a forgotten extract likewise calls for the responsible layer to be addressed. Clear ownership prevents one team from assuming another is protecting an access path that both overlooked.

Management Functions

Shared Data Needs Coordination, Rules, Evidence, and Recovery

Defining structure establishes tables, collections, fields, and constraints, with limits on who can change them. Storage and retrieval organize records and indexes, helping authorized requests find relevant information efficiently. Access rules determine which accounts can read, change, create, or administer particular parts of the system. Transactions can make related changes complete together, or undo them when the transaction cannot finish. This all-or-nothing property supports consistency, under the product's actual guarantees and configuration. It does not establish that an account requesting a transaction belongs to a legitimate person. Concurrency handling coordinates simultaneous activity, including which changes other users can see. Suitable activity records can support investigation, if logging is configured, retained, protected, and reviewed. Backup and recovery functions create restorable information, which also needs appropriate access and protection. Different products support different guarantees and features, so do not assume every database behaves identically. Reliable operation, controlled access, useful evidence, and tested recovery must work together.

Storage Families

Data Shape Supports Different Workloads Without Determining Sensitivity

Relational systems organize tables and keys, commonly using SQL for structured records and queries. They are widely used for accounts, orders, payroll, and other workloads needing clear relationships and constraints. Document stores hold self-describing records, supporting flexible structures for profiles, catalogs, and content. Key-value stores retrieve values through keys, often serving sessions, caches, and settings. Their values may support richer types, rather than necessarily being a label and one simple scalar. Session information can include powerful credentials, making a small store highly sensitive. Wide-column systems support partitioned records and columns, with designs suited to scalable distributed workloads. They are not automatically the same as columnar analytical engines; product and workload details matter. Graph databases represent entities and relationships, useful for networks, routes, and fraud analysis. Time-series systems organize timestamped readings, such as sensor observations, operational metrics, and market data. The model affects workload fit, while actual contents and access determine sensitivity across all six families.

Deployment and Copies

Protection Should Follow the Information Across Every Location

Centralized and distributed designs place information and responsibilities in different arrangements. A distributed collection adds nodes, replicas, communication paths, and administration boundaries that need coordinated protection. Self-operated and hosted services also divide responsibilities differently, according to the particular service. Confirm who controls each relevant layer, rather than assuming renting infrastructure transfers every duty to the provider. Production is only one location; backups, extracts, test copies, and supplier datasets can hold the same information. A backup may be full, partial, or incremental, so assess what can actually be recovered from it. Copies remain sensitive according to their contents, even when they are older or used for testing. An extract for a short supplier trial can persist after the trial, without a clear owner or retention rule. Prefer appropriately protected synthetic or minimized data, where it can meet the purpose. Control access, assign responsibility and retention, and verify how the copy is handled. Protection should follow the information, rather than being attached only to the production system's location.

Attacker Incentives

Organized, Linked, Current Records Can Increase the Return on an Intrusion

Concentration can make one accessible collection attractive, because many useful records may be reachable together. Structure, labels, relationships, and indexes can reduce the effort of interpreting the information. Maintained records may also be more current than fragments saved on individual devices. Completeness connects several fields to the same person, reducing uncertainty and enabling more plausible deception. Quiet reading can copy information without deleting it, leaving normal operations apparently intact. Information may then support fraud, extortion, competitive abuse, or resale, without another intrusion being necessary. These properties explain incentives. They do not prove one successful entry exposes every record. Account permissions, segmentation, encryption, available keys, and monitoring affect the scope of any compromise. An encrypted copy may not be immediately usable, and a limited account may reach only a small subset. The same quantity scattered across many laptops can require more work to find and match. Compare organization and protection together, rather than assuming every database is easier to misuse than every device.

Reading and Insiders

Successful Service Operation Does Not Prove Information Stayed Confidential

Reading a record does not necessarily remove the original, or interrupt the service that uses it. A functioning application therefore does not establish that information stayed confidential. Database records can help investigate access, but they are not the only possible evidence source. Application, identity, host, and network activity can also matter, depending on coverage and retention. Evidence needs protection and review, rather than simply being generated and forgotten. Insider access creates another concern, including legitimate accounts with broader reach than one task requires. A support agent helping one customer may not need every customer's full record. That breadth can be a design decision, rather than proof that the employee intends wrongdoing. If an intruder retains access, later updates and new records can increase continuing exposure. A one-time stolen copy does not automatically update itself, so access duration and revocation matter. The source's seven-month scenario illustrates possible delay, rather than establishing a universal database detection average.

Information and Harm

Name the Contents Before Assessing What Exposure Could Enable

Identity information includes names, birth dates, official identifiers, and document numbers, potentially supporting impersonation. Contact and location information can support targeted deception, harassment, or physical approaches. Authentication information includes password material, recovery details, tokens, and keys, with risks depending on validity and protection. Financial information includes payment details, accounts, and transactions, exposing both credentials and personal circumstances. Health information can reveal conditions, prescriptions, tests, and appointments, creating risks beyond replacing a number. Behavioral information can show purchases, browsing, movements, and messages, enabling detailed profiling and convincing deception. Commercial information can expose designs, pricing, contracts, and customer relationships, harming an organization and its partners. These categories may overlap within one record, making combined consequences more serious. They describe possible harms, rather than promising that every disclosure produces each outcome. Context, controls, misuse, and the person's circumstances determine the actual exposure and effects. Naming the contents makes the ethical assessment clearer than discussing a large but otherwise abstract quantity of data.

Compounding Value

Linked Fields Can Support a More Convincing Account of One Person

The source's combined-record example explains why matched fields can be more useful together. A name and birth date connect identity details, while an address adds contact and location context. An email address and exposed authentication material may support account misuse, depending on the surrounding controls. Payment details introduce financial exposure, while purchase history supplies real events to mention in deceptive messages. Recovery information may weaken an account-reset process that relies on predictable personal facts. The combination reduces uncertainty, allowing a message or impersonation attempt to appear more convincing. It does not guarantee access to every service, or establish that an attacker can become the person everywhere. Strong authentication, protected password storage, secure recovery, and revocation can materially change the outcome. Reused credentials create additional risk, but a properly protected password record is not equivalent to a readable password. Relationship and contextual information still have value, even when some credentials are no longer valid. Protect the combination, rather than assessing each field as though it could never be linked to another.

Persistence of Harm

Replacing a Credential Cannot Withdraw an Exposed Life History

Some exposed credentials can be replaced, including cards, passwords, tokens, and keys under the relevant system. Cancellation or rotation reduces future misuse, but does not erase every earlier loss or related disclosure. A birth date cannot simply be reissued, and a medical history cannot be withdrawn from every recipient. Some national identifiers can be replaced under particular arrangements, so permanence is not identical for all identifiers. Persistent facts can also combine with later exposures, creating continuing risks that one reset cannot address. Organizational and individual consequences differ, both in their nature and their duration. A business may face recovery, legal action, and loss of trust. Affected people may face fraud or distress. Health exposure can also support discrimination or extortion, which a new payment credential does not solve. Financial compensation may help, without necessarily repairing the disclosure of intimate information. Assess the person's likely harm and ability to recover, alongside the organization's measurable costs. The ethical responsibility follows the people described, rather than ending when the system is restored.

Ticketing-Business Scenario

Rank Impact and Exposure Separately, Stating Your Assumptions

The ticketing business holds customer bookings, active sign-in tokens, and performance readings, plus a backup and supplier extract. Rank impact separately from exposure, stating assumptions rather than pretending there is one universally correct order. A recoverable backup of all three can have the highest aggregate exposure, because it combines their sensitive contents. The live customer database and supplier copy carry substantial personal-data sensitivity, even when the copy is older. Active sign-in tokens can create urgent account-access risk, depending on their privileges and remaining validity. Performance readings may be lower risk, if they contain no personal information or sensitive secrets. Those assumptions matter; usable tokens might outrank customer records during an immediate incident. Likewise, telemetry containing identifiers or operational secrets could move much higher in the assessment. The forgotten supplier extract or shared backup location may have weaker oversight than the live system. Confirm that through evidence, rather than assuming every copy necessarily has weaker protection. The collection with the greatest possible harm need not be the collection with the poorest controls.

Review and Defensive Reasoning

Protect the Data, Its Access Paths, Its Copies, and the People It Describes

The administrator's firewall argument confuses a permitted route with the limits on activity after entry. A firewall and a well-written application do not make internal database permissions a formality. Stolen credentials, supplier connections, insider reach, and infrastructure access can create different paths and risks. Separate responsibility for collection design, management software, and infrastructure operation, with coordinated controls. Limit an accepted account's reach to its authorized duties, rather than granting broad access by default. Track backups, replicas, extracts, tests, and supplier datasets, including the keys and credentials that affect recoverability. Choose suitable evidence, protect it, retain it appropriately, and review activity across the relevant layers. Then assess consequences through the information categories, linked fields, and the people who may be harmed. Credential replacement can reduce some risks, while persistent personal facts require a longer view. Storage families differ in shape and workload fit, but no family automatically eliminates confidentiality or integrity duties. Protecting databases means protecting information wherever it travels, with access, evidence, recovery, and human consequences considered together.

About Ethics in Technology at UPI Study

Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses

Compare: Cybersecurity vs Ethics in Technology · Which ethics course?

Why take it here

Why students take Ethics in Technology with UPI Study

The right and wrong of the digital worldEthics in Technology looks at the choices technology forces on people and organizations: security and privacy, surveillance and the law, big data, hacking and cyber warfare, malware and breaches, intellectual property, cybercrime, encryption, artificial intelligence and responsible digital citizenship. It suits computer science, information technology and business degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About What Database Management Systems Do and Why Protecting Them Is Critical

What is the difference between a database and a database management system?
A database is the organized collection of information, while a database management system (DBMS) is the software that defines its structure, stores and retrieves records, enforces access rules, coordinates simultaneous users and runs transactions. The infrastructure, such as servers, storage and hosted services, is a third layer. Keeping them distinct matters for security, because stolen storage or exposed backups can bypass the permissions the DBMS enforces.
What are the main types of databases?
Six common database families are relational, document, key-value, wide-column, graph and time-series. Relational systems use tables, keys and usually SQL for structured records like orders and payroll. Document stores hold flexible self-describing records, key-value stores serve sessions and caches, wide-column systems scale partitioned data, graph databases model relationships for uses like fraud analysis, and time-series systems store timestamped readings. Sensitivity depends on contents and access, not the model.
Why are databases a major target for attackers?
Databases attract attackers because they concentrate many organized, current and linked records in one reachable place. Labels, indexes and relationships make the data easy to interpret, and complete records tied to one person enable fraud, extortion or convincing deception. Copying data usually leaves the original intact, so a working service does not prove nothing was taken. Permissions, segmentation, encryption and monitoring still limit how much a single compromise exposes.
Which types of personal data cause the most harm when a database is breached?
Data that cannot be replaced often causes the longest-lasting harm. Passwords, payment cards, tokens and keys can be cancelled or rotated, but a birth date or medical history cannot be reissued. Health records can enable discrimination or extortion, while identity, contact, financial and behavioral data support impersonation, fraud and profiling. Combined fields are especially dangerous, because a name, address, email and purchase history together make scams far more convincing.

About the Ethics in Technology course

How many college credits is Ethics in Technology?
Ethics in Technology (Computer Science 195) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Ethics in Technology cost and what is included?
$250, paid once, with lifetime access: all 116 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. It is sold on its own and is not part of UPI Study PRO.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Ethics in Technology take?
It is self-paced with no deadlines. The 116 lessons total about 28 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Ethics in Technology.

116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Ethics in Technology →Download the syllabus
Ethics in Technology
3 credits · NCCRSEnroll →