Information Security: MIM737

Felex Madzikanda
Department of Information and
Marketing Sciences
Midlands State University
madzikandaf@staff.msu.ac.zw
0774810683
 Inference Control
• Salary table is confidential yet statistical
analysis of salary information is allowed.
• SQL use all (and,or,not) and functions (count,
sum, average etc)
• In the absence of inference controls,
compromise is easy
 Inference controls

NAME SEX POSITION SALARY

Harris male consultant 29000
Brown male manager 35000
Charles female manager 35000
Gordon male clerk 17000
Jones female consultant 31000
martin male consultant 32000
 Inference controls
Qtn How many employees are female and
consultant?
Ans 1
Qtn what is the average salary of all people who
are female and a consultant
Ans 31000
Ristriction Control: Do not respond to a querry if
fewer than k records satisfy the query e.g k = 2
 Inference controls
Qtn How many people are consultants or not
consultants?
Ans 10
Qtn How many people are not( female and a
consultant)
Ans 9
Qtn What is the total salary paid for all people
who are consultant or not consultants
Ans 262000
 Inference controls
Qtn What is the total salary paid for all people
who are not female and a consultant
Ans 231000
Given k = 2
Qtn How many people are consultants
Ans 3
Qtn How many people are male and consultants
Ans 2
 Inference controls
Qtn What is the total salary paid for all people
who are consultants
Ans 92000
Qtn What is the total salary paid for all people
who are male and consultants
Ans 61000