2 cissp ® Official Study Guide Eighth Edition

Data Mining and Data Warehousing
Many organizations use large databases, known as 
data warehouses
, to store large 
amounts of information from a variety of databases for use with specialized analysis tech-
niques. These data warehouses often contain detailed historical information not normally 
stored in production databases because of storage limitations or data security concerns.
A 
data dictionary
is commonly used for storing critical information about data, including 
usage, type, sources, relationships, and formats. Database management system (DBMS) soft-
ware reads the data dictionary to determine access rights for users attempting to access data.
Data mining
techniques allow analysts to comb through data warehouses and look for 
potential correlated information. For example, an analyst might discover that the demand 
for lightbulbs always increases in the winter months and then use this information when 

---

Database Systems Security 
349
planning pricing and promotion strategies. Data mining techniques result in the develop-
ment of data models that can be used to predict future activity.
The activity of data mining produces metadata. 
Metadata
is data about data or infor-
mation about data. Metadata is not exclusively the result of data mining operations; other 
functions or services can produce metadata as well. Think of metadata from a data mining 
operation as a concentration of data. It can also be a superset, a subset, or a representation 
of a larger dataset. Metadata can be the important, significant, relevant, abnormal, or aber-
rant elements from a dataset.
One common security example of metadata is that of a security incident report. An inci-
dent report is the metadata extracted from a data warehouse of audit logs through the use 
of a security auditing data mining tool. In most cases, metadata is of a greater value or sen-
sitivity (due to disclosure) than the bulk of data in the warehouse. Thus, metadata is stored 
in a more secure container known as the 
data mart
.
Data warehouses and data mining are significant to security professionals for two rea-
sons. First, as previously mentioned, data warehouses contain large amounts of potentially 
sensitive information vulnerable to aggregation and inference attacks, and security practi-
tioners must ensure that adequate access controls and other security measures are in place 
to safeguard this data. Second, data mining can actually be used as a security tool when it’s 
used to develop baselines for statistical anomaly–based intrusion detection systems. Data 
mining is used to “hunt” through large volumes of security-related data for anomalous 
events that could indicate an ongoing attack, compromise, or breach.