UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 8.3 Free with a free account
Database Roles and Accountability
Ethics in Technology · Chapter 8: Guarding the Data Vault: Database Protection, Cloud Risks, and Intrusion DetectionSection 8.3 · lesson 37 of 11615 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Data Tampering and Integrity Protection →← Protecting Data Inside DatabasesNext lesson: Data Tampering and Integrity Protection →
In this lesson
Decision rights, divided duties, traceable actions, and organizational oversight.
- Distinguish responsibility from assigned accountability
- Explain owners, custodians, DBAs, security staff, users, and auditors
- Apply RACI and separation of duties to database work
- Evaluate traceability, governance, and relevant legal roles
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,831 words). Read along, or search it.
Chapter 8
Database Roles and Accountability
Database protection depends on several roles, because decisions, technical work, oversight, and daily use are different duties. Unclear roles can leave important work undone, or concentrate excessive authority in one place. We distinguish responsibility for carrying out a task from accountability for a defined outcome. Then we explain data owners, custodians, database administrators, security staff, users, and independent auditors. A RACI chart records who works, who answers, who contributes advice, and who receives updates. Separation of duties divides sensitive requests, approval, implementation, and review. Supporting controls limit access and bring fresh scrutiny, but collusion and superficial checks remain possible. A historical trading case shows why formal departments need effective controls and investigation of warning signs. Named access, controlled privileges, and protected evidence support traceability without making logs automatic proof of human conduct. Finally, governance, frameworks, and relevant laws connect database decisions to organizational obligations. Internal job titles help organize work, but do not replace the organization's duties or justify blame without evidence.
Decision Rights
Doing the Work and Answering for a Decision Are Different Duties
A responsible person carries out an assigned task, and several people may contribute to the work. An accountable person answers for the defined outcome or decision, with suitable authority. Specify the task, resources, decision rights, escalation route, and evidence of completion. For backups, a custodian may run the jobs and test that copies restore correctly. A designated business owner decides the required recovery needs and confirms suitable oversight. A failure may involve execution, inadequate resources, missing review, or several problems together. Delegating technical work therefore does not automatically remove the owner's assigned oversight duty. Likewise, naming an owner does not erase the custodian's responsibility for the work they accepted. One accountable person per RACI task is a useful convention for avoiding ambiguous decisions. It does not mean only one person can have duties across an entire system or incident. Leadership obligations, organizational requirements, and fair evaluation of each person's conduct still remain.
Business and Operations
Owners Decide Appropriate Use; Custodians Implement Approved Protection
A data owner is typically a business leader assigned accountability for a defined dataset. For employee records, the human resources leader may hold that internal governance role. The owner classifies sensitivity and approves appropriate purposes, access levels, protection, recovery, and retention requirements. They periodically confirm that continuing access and the requirements themselves remain appropriate. The label does not mean personal ownership of other people's information. Custodians implement the authorized arrangements, commonly through operations or information technology work. They apply permissions, maintain storage and updates, and establish usable recovery capabilities. Implementation should follow agreed requirements, while unresolved risks need to be escalated for a decision. A data steward may add attention to quality and correct use within a business area. In the human resources example, IT implements approved access and tests that employee records can be restored. Clear communication between business and technical roles prevents each side from assuming the other handled an important requirement.
Other Participants
Specialist Authority Needs Oversight and Clear Boundaries
Database administrators install, configure, maintain, patch, and tune the management system. They grant approved permissions and configure applicable security features and recovery arrangements. Their authority can be extensive, although encryption, platform design, and other controls may limit particular access. That power calls for oversight and protected evidence covering administrative activity. Security staff define policy, assess risks, monitor, coordinate incident response, and report concerns to leadership. Independent review should not depend solely on the administrator whose actions are being examined. A security program leader also does not absorb every board or management obligation. Users access information for approved duties, protect credentials, follow handling rules, and report possible problems promptly. Auditors independently examine evidence and whether the relevant controls work as intended. Independence supports trustworthy review, but findings still depend on scope, competence, and sufficient evidence. Where required, a data protection officer advises and monitors privacy compliance with appropriate independence.
RACI Example
Assign One Accountable Role to Each Clearly Defined Task
A RACI chart marks responsibility, accountability, consultation, and information for each defined task. Responsible means doing the work; accountable means answering for the defined outcome. Consulted participants give input, while informed participants receive appropriate updates. In the source's example, the owner classifies data and approves access, consulting technical and security staff. The custodian or administrator grants approved access and performs backup and restoration work. The owner remains the designated accountable role for those particular tasks in the example. Security staff lead audit review and coordinate incident response, with other roles supporting the relevant work. Users and custodians report suspicious activity through the defined reporting process. These allocations illustrate an agreed workflow, rather than a universal organizational chart or legal liability finding. A dash means no routine assignment here, rather than a prohibition on useful involvement. Define scope, obtain agreement, and revise the chart when systems, staff, or decision rights change.
Separation of Duties
Split Sensitive Decisions, Implementation, and Independent Checks
Separation of duties divides a sensitive process so that meaningful checks come from different participants. An employee requests access, an appropriate owner approves it, an administrator grants it, and a reviewer checks. Separating request and approval reduces the opportunity for a person to authorize their own access. Separating approval and implementation helps compare the business decision with the permission actually created. Administration should not be the sole source of independent review of that administrator's activity. Protected evidence reduces the opportunity to erase or quietly ignore signs of misuse. Writing code and approving an unreviewed production release also deserve an independent boundary. A controlled deployment tool can perform an approved release without defeating the purpose of separation. The objective is meaningful authorization and verification, rather than banning developers from every deployment tool. Financial entry should likewise be separated from appropriate approval or reconciliation. Different people must perform real checks; additional names alone do not establish effective separation.
Supporting Controls
Divided Duties Work Better with Narrow Access and Fresh Review
Least privilege limits authority to the work a person or role actually needs. Need to know limits the information required by the current task, even where general clearance is broad. Role-based access control attaches reusable permissions to maintained job roles, with appropriate membership review. Dual control requires two authorized participants for a particularly sensitive action. Examples include destructive production changes or access to especially powerful key material. Rotation or time away allows someone else to perform or review the work. Fresh scrutiny may reveal irregularities that remained hidden under one person's continuing control. These measures reduce opportunities, but participants can collude or perform a superficial second check. Independent audits, protected evidence, and investigation of warning signs therefore remain necessary. A small team may need compensating review, constrained access, and clearly documented exceptions. Give the assigned people authority and resources, rather than expecting an impractical chart to protect the system.
Historical Case
Control Knowledge and Unresolved Warning Signs Can Defeat Formal Rules
In January two thousand eight, Société Générale announced a loss of about four point nine billion euros. The loss followed the closing of unauthorized trading positions associated with Jérôme Kerviel. Fictitious offsetting transactions concealed large exposures from the normal checks. His earlier middle-office work supplied knowledge of the controls used to examine trading activity. The bank's internal review described concealment and a failure to detect the problem sooner. The banking supervisor also sanctioned weaknesses in the bank's controls. The database lesson concerns meaningful reconciliation, independent evidence, and follow-up on unusual patterns. Formal departments and separate job titles are insufficient if checks can be circumvented or warnings remain unresolved. Controls need to examine whether the underlying activity matches the recorded account of it. This historical example does not prove every powerful administrator is dishonest. It shows why neither trust in one person nor confidence in formal procedures replaces effective oversight.
Traceable Actions
Identity, Access Limits, and Protected Evidence Support Fair Accountability
Traceability combines identity, authentication, authorization, and protected records of relevant activity. Identification is the claim of an identity by a person or service. Authentication checks appropriate credentials or other evidence, while authorization limits the actions allowed. Activity evidence records important operations and privileged changes for later review. A shared administrator login makes it harder to connect an operation to an individual participant. Named accounts are preferable, while a controlled broker can connect privileged sessions to individual identities. Privileged access management can add approval, limited-duration authority, and protected session evidence where justified. Activity monitoring can flag unusual exports, volumes, or hours for investigation. Recording and review must also avoid unnecessary exposure of sensitive information. Credentials and logs support attribution, but a compromised account means they do not alone prove which human acted. Assess the context and corroborating evidence, then apply clear policies through fair and consistent procedures.
Worked Incidents
Investigate Conduct, Control Design, and Oversight Separately
Worked incidents help separate conduct from control design and oversight. A former employee's active account points to departure notice, removal, and recurring access review. The owner and custodian have different duties, while the departure workflow may involve other participants. If a database administrator erases evidence of browsing, investigate both the conduct and the evidence design. Independent protected logs and review reduce the opportunity to hide administrative misuse. Silent backup failures require monitoring of job results and actual restoration exercises. The owner's recovery oversight and the custodian's testing duties may both be relevant. A salary spreadsheet sent to the wrong recipient raises user handling and organizational safeguard questions. Training, suitable access, useful warnings, and prompt response can all matter. Establish the assigned duty, authority, resources, evidence, and actual actions before drawing conclusions. A title alone is not a fair liability finding, and several failures can contribute to one incident.
Governance and Frameworks
Leadership Sets Direction and Checks Whether Protection Works
Governance sets decision rights and oversight, so leadership can check whether agreed protection is actually working. Policies should cover classification, access, retention, and acceptable use, with appropriate senior approval. Risk assessments guide effort, while access reviews confirm that continuing privileges remain justified. Independent audit, management reporting, and role-specific training help translate policy into practice. NIST's Cybersecurity Framework version two added Govern in two thousand twenty-four. It makes strategy, policy, roles, responsibilities, and oversight explicit parts of managing cyber risk. ISO's information security management standard provides a risk-based management system, including relevant role and control decisions. COBIT addresses governance and management of enterprise information and technology, distinguishing direction from delivery. Sarbanes-Oxley and related reporting rules concern internal control over financial reporting for covered issuers. Database access and change controls may support those objectives, but not every database has identical legal requirements. Reporting and auditor-attestation exceptions also apply; a framework or report does not itself guarantee security.
Legal Roles and Review
Internal Job Assignments Do Not Replace Organizational Privacy Duties
Under the European privacy framework, a controller determines the purposes and means of processing personal data. A processor handles personal data on a controller's behalf, with contractual and direct legal duties. These legal roles often concern organizations, rather than individual employees named in an internal chart. An internal owner and custodian provide a useful analogy about decisions and implementation. The analogy does not make every employee or internal technology department a separate legal processor. Where a data protection officer is required, they advise and monitor with appropriate independence. The organization retains its compliance duties, and conflicting decisions should not undermine that independent role. For the shared-login problem, use traceable privileged access and protected evidence linked to individual identities. For administrative review, prevent the observed person from casually changing the independent trail. For divided duties, address collusion and weak scrutiny through further checks and fair investigation. Review the roles, RACI, separation, traceability, governance, and legal distinctions as parts of one practical protection arrangement.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Database Roles and Accountability
What is the difference between a data owner and a data custodian?
What is a RACI chart in data security?
What is separation of duties in database security?
Why should database administrators avoid shared logins?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →