CISSP 20.2 - Establishing Databases & Data Warehousing (Part 1 of 2)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series builds a working picture of how databases are organized, drawn from Domain 8. It lays the groundwork for protecting the information attackers want most by explaining architectures, relational structure, keys, the query language, and the guarantees that keep transactions trustworthy.

Frequently Asked Questions

What database architectures exist beyond the relational one?

Beyond the dominant relational model, two others matter. A hierarchical model arranges records in a logical tree, a one-to-many structure where each node has many possible children but only a single parent, much like an org chart. A distributed model spreads data across several logically linked databases so users see one seamless entity, and because each field can have many parents and many children, its relationship pattern is many-to-many.

How is a relational database actually structured?

A relational database is built from flat, two-dimensional tables of rows and columns. The table, also called a relation, holds a set of related records; each column is an attribute or field and each row is a record, also called a tuple. Cardinality is the number of rows, which changes often, while degree is the number of columns, which changes rarely. The domain of an attribute is the set of values it is allowed to hold.

What are keys, and how do they tie tables together?

Keys are subsets of a table’s fields used to uniquely identify records and to join tables. A candidate key is any set of attributes that can uniquely identify a record, the primary key is the chosen candidate whose uniqueness the system enforces, and any candidate not chosen is an alternate key. A foreign key lives in one table but points to another table’s primary key, enforcing referential integrity so the reference always matches a record that truly exists.

How does the query language shape security?

Every relational database speaks a common structured query language for storing, retrieving, and modifying data. Its standout security feature is granularity of authorization, letting you set permissions by table, by row, by column, or even by an individual cell. The language splits into a data definition portion that creates and changes the schema and a data manipulation portion that works with the data inside it, while normalization reduces redundancy.

What guarantees keep database transactions trustworthy?

A transaction is a group of instructions that must all succeed or all fail together. A completed transaction is committed and cannot be undone, while a failed one is rolled back to its prior state. Four required properties, together called the ACID model, make this reliable: atomicity means all or nothing, consistency means the database obeys its rules before and after, isolation means concurrent transactions do not interfere, and durability means a committed result survives.

Reference: This article is based on concepts discussed in CISSP 20.2 - Establishing Databases & Data Warehousing (Part 1 of 2).