## 3 Enhanced Clements-Hoffman Model for Databases  
So, let us take as a basis the Clements-Hoffman model in the form of a 5-tuple:  
\[S=\{O,T,W,V,B\} \tag{1}\]  
where \(O\) is the set of protected objects; \(T\) is the set of security threats; \(V\) is the set of vulnerabilities representing paths of implementing threats \(T\) in relation to objects \(O\), determined by a subset of the Cartesian product \(V=T\times O\); \(B\) is the set of barriers representing the points at which protection is required, defined by a subset of the Cartesian product \(B=V\times W=T\times O\times W\). At first, let us clarify some of these elements in relation to databases:  
* \(T=\{t_{i}\}\), \(i=1..I\) is the set of database security threats. According to studies [11, 26, 28, 31, 45, 46, 47], the main largest and most important threats (types of threats) to database security (to a greater extent they are associated with anthropogenic sources of threats--people or groups of persons, as a result of whose actions or inaction, the security of the considered system has been violated) are:  
* Excessive and unused privileges. For definiteness, let us designate this type of threat as \(t_{1}\);
* Privilege abuse--\(t_{2}\);
* Input injection--\(t_{3}\);
* Malware--\(t_{4}\);
* Wweak audit trail--\(t_{5}\);
* Storage media exposure--\(t_{6}\);
* Exploitation of vulnerabilities and misconfigured databases--\(t_{7}\);
* Unmanaged sensitive data--\(t_{8}\);
* Inference--\(t_{9}\);
* Denial of service--\(t_{10}\);
* Limited security expertise and education--\(t_{11}\). * \(O=\{o_{j}\}\), \(j=1..J\) is the set of protected database objects. Considering that database systems are information products with a dual nature (that is, consisting of two components (assets): DBMS software, independent of their scope, structure, semantic content of the accumulated and processed data, and the actual stored data), as well as the possible harmful effects on the corresponding assets, it is advisable to ensure the security of both components. For relational databases, as the most widespread (this thesis is confirmed by the results of DB-Engines and Popularity of Programming Language (PYPL) ratings [48, 49], as well as reports of experts from the world-famous company Gartner, Inc. [50, 51]), taking into account the possibility of various degrees of detail of these components, the following objects of protection can be distinguished [11, 52]:  
* The entire database--\(o_{1}\);
* Tables--\(o_{2}\);
* Views--\(o_{3}\);
* Tuples (rows) of tables--\(o_{4}\); \begin{tabular}{l l} ✓ & Separate fields (attribute values) of rows--\(o_{5}\); \\ ✓ & Triggers--\(o_{6}\); \\ ✓ & Persistent stored modules--\(o_{7}\) and some others. \\ \(-\) & \(W=\{w_{k}\}\), \(k=1\_K\) is the set of security measures (also referred to in the literature [53; 54; 55; 56; 57] as controls), which include any process, policy, device, established practice, or other action which modifies risk [57]). \\ \end{tabular}   
The elements of all the sets listed above are among themselves in certain relationships, at that the relationship between threats and objects is not a \"one-to-one\" relationship. Threat \(t_{i}\in T\) can spread to any number of objects \(O\), and object \(o_{j}\in O\) can be vulnerable to more than one threat \(T\). Now we note one feature of the presented Clements-Hoffman model (Equation (1)). [PERSON] and [PERSON] [35], introducing the concept of vulnerability, formally represent it as a mapping of \(T\times O\) onto a set of ordered pairs \(v_{r}=(t_{i},o_{j})\), and not a separately objectively existing category--_vulnerability_ (weakness asset or control that can be exploited by one or more threats [57]). Threats exist separately from asset weaknesses. Vulnerability in itself does not cause damage it is only a condition or set of conditions that allows a threat to harm assets. When a threat is realized, one or more vulnerabilities of an asset can be used [58]. At that, one type of vulnerability can lead to many various security threats.