HomeHow To

How to Password protect SAS datasets ?4 min read

Like Tweet Pin it Share Share Email

Password Protecting SAS datasets

Password Protecting SAS datasets means using access control on your data to prevent unintended access and secure your data. SAS has provided three levels of Access controls over the data and is implemented using passwords.

Those access controls are read-write and alter.

Passwords are hierarchical in terms of gaining access. For example, specifying the ALTER password gives you read and write access.

Note – SAS password doesn’t provide any restriction over the use of SAS file beyond the file system.

To demonstrate, Password Protection I have created a library to store the SASHELP.CLASS dataset.

libname mylib '/home/9to5sas';

data mylib.class;
	set sashelp.class;
run;

Setup a password

To set a password, first specify a SAS data set in one of the following:

  1. DATA statement
  2. MODIFY statement of the DATASETS procedure
  3. OUT = statement in PROC SQL
  4. CREATE VIEW statement in PROC SQL

Read Protected – Users can’t read the data without knowing the password. They can’t write to the data however they can drop the dataset itself.

Write Protected – Users can’t write to the data to the data set without knowing the password but they can read the data and drop the dataset itself.

Alter Protected – Users can’t drop or replace the dataset without knowing the password but they can always read and write to the data.

PW= Data Set Option – You can apply full control using the PW= option. It assigns a READ, WRITE, and ALTER password to a SAS file, and enables access to a password-protected SAS file.

Applying full controls Using PW= option:

data mylib.class(pw=red);
	set mylib.class;
run;

To view the access control specified in a SAS dataset, you can use the proc contents procedure. How to Password protect SAS datasets ? 1

Preventing deletion and modification of a SAS dataset

This example prevents deletion or modification of the data set without a password.

data mylib.class(write=green alter=red);
	set mylib.class;
run;

Accessing password-protected files

You can access password-protected files, with the same data set options that you use to assign protection.

proc print data=mylib.class (read=blue);

Assigning a Password with a Procedure

You can assign a password after an OUT= data set specification in PROC SQL.

This example assigns a write and alter password

proc sort data=sashelp.class
out=mylib.class(write=yellow alter=red);
by age;
run;

Assigning a Password to an Existing Data Set

You can use the MODIFY statement in the DATASET procedure to assign passwords to unprotected members if the SAS data file already exists.

proc datasets library=mylib;
modify class(alter=black);
run;

Manipulating Passwords

Once, you have set up a password at some point of time you may want to change or remove the password. You can use the proc datasets procedure to update or remove passwords.

Changing Passwords

proc datasets lib=mylib;
	modify class (pw=green/brown);
	run;

̉Removing Passwords

proc datasets lib=mylib;
 modify class (pw=brown/);
run;

Locking SAS datasets

Locking a SAS data set (a SAS data file or a SAS data view) prevents other users from creating, reading, updating, deleting, or renaming the SAS data file. Locking a SAS data view prevents other users from creating, reading, deleting, renaming, or interpreting the view.

lock mylib.class;

NOTE: MYLIB.CLASS.DATA is now locked for exclusive access by you.

lock mylib.class clear;

NOTE: MYLIB.CLASS.DATA is no longer locked by you.

  • You use a LOCK statement with the LIST argument to list a lock you do not have.
  • You use a LOCK statement with the CLEAR argument to release a lock you do not have.

Locking a data set and verifying that a lock is held Macro

SAS data encryption

Encrypting SAS datasets is a way to prevent SAS datasets access from outside systems like Ab-Initio, Mainframe etc. You can encrypt data by using the ENCRYPT= SAS dataset option. Below code demonstrates this.

Define dataset encryption

data mylib.class(pw=red encrypt=yes);
set sashelp.class;
run;

Remove data encryption

data mylib.demog(pw=red encrypt=no);
set mylib.demog;
run;

Using the ENCRYPT=AES Option

ENCYPT= AES encrypts the file by using the SAS Proprietary algorithm. This encryption uses passwords that are stored in the data set.  You must specify the READ= data set option or the PW= data set option along with the ENCRYPT=YES. Note that you cannot change any password on an encrypted data set without re-creating the data set.

data mylib.class(encrypt=aes encryptkey=green);
set sashelp.class;
run;

Comments (0)

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.