SAS/ACCESS 9.2 for Relational Databases: Reference, Fourth Edition

Data Integrity and Security 4 Assigning SAS Passwords 27Table 3.1Password Protection Levels and Their EffectsFile Type READ= WRITE= ALTER=PROC SQLview ofDBMSdataProtects the underlyingdata from being read orupdated through theview; does not protectagainst replacement ofthe viewProtects the underlyingdata from being updatedthrough the view; doesnot protect againstreplacement of the viewProtects the view frombeing modified, deleted,or replacedAccessdescriptorNo effect on descriptor No effect on descriptor Protects the descriptorfrom being read or editedViewdescriptorProtects the underlyingdata from being read orupdated through theviewProtects the underlyingdata from being updatedthrough the viewProtects the descriptorfrom being read or editedYou can use the following methods to assign, change, or delete a SAS password:3 the global SETPASSWORD command, which opens a dialog box3 the DATASETS procedure’s MODIFY statement.The syntax for using PROC DATASETS to assign a password to an access descriptor,a view descriptor, or a SAS data file is as follows:PROC DATASETS LIBRARY=libref MEMTYPE=member-type;MODIFY member-name (password-level = password-modification);RUN;The password-level argument can have one or more of the following values: READ=,WRITE=, ALTER=, or PW=. PW= assigns read, write, and alter privileges to adescriptor or data file. The password-modification argument enables you to assign anew password or to change or delete an existing password. For example, this PROCDATASETS statement assigns the password MONEY with the ALTER level ofprotection to the access descriptor ADLIB.SALARIES:proc datasets library=adlib memtype=access;modify salaries (alter=money);run;In this case, users are prompted for the password whenever they try to browse orupdate the access descriptor or try to create view descriptors that are based onADLIB.SALARIES.In the next example, the PROC DATASETS statement assigns the passwords MYPWand MYDEPT with READ and ALTER levels of protection to the view descriptorVLIB.JOBC204:proc datasets library=vlib memtype=view;modify jobc204 (read=mypw alter=mydept);run;In this case, users are prompted for the SAS password when they try to read the DBMSdata or try to browse or update the view descriptor VLIB.JOBC204. You need bothlevels to protect the data and descriptor from being read. However, a user could stillupdate the data that VLIB.JOBC204 accesses—for example, by using a PROC SQLUPDATE. Assign a WRITE level of protection to prevent data updates.Note: When you assign multiple levels of passwords, use a different password foreach level to ensure that you grant only the access privileges that you intend. 4