Password Protecting SAS datasets
Password Protecting SAS datasets means using access control on your data to prevent unintended access and secure your data. SAS has provided three levels of Access controls over the data and is implemented using passwords.
Those access controls are read-write and alter.
Passwords are hierarchical in terms of gaining access. For example, specifying the ALTER password gives you read and write access.
Note – SAS password doesn’t provide any restriction over the use of SAS file beyond the file system.
To demonstrate, Password Protection I have created a library to store the SASHELP.CLASS dataset.
libname mylib '/home/9to5sas'; data mylib.class; set sashelp.class; run;
Setup a password
To set a password, first specify a SAS data set in one of the following:
- DATA statement
- MODIFY statement of the DATASETS procedure
- OUT = statement in PROC SQL
- CREATE VIEW statement in PROC SQL
Read Protected – Users can’t read the data without knowing the password. They can’t write to the data however they can drop the dataset itself.
Write Protected – Users can’t write to the data to the data set without knowing the password but they can read the data and drop the dataset itself.
Alter Protected – Users can’t drop or replace the dataset without knowing the password but they can always read and write to the data.
PW= Data Set Option – You can apply full control using the PW= option. It assigns a READ, WRITE, and ALTER password to a SAS file, and enables access to a password-protected SAS file.
Applying full controls Using PW= option:
data mylib.class(pw=red); set mylib.class; run;
To view the access control specified in a SAS dataset, you can use the proc contents procedure.
Preventing deletion and modification of a SAS dataset
This example prevents deletion or modification of the data set without a password.
data mylib.class(write=green alter=red); set mylib.class; run;
Accessing password-protected files
You can access password-protected files, with the same data set options that you use to assign protection.
proc print data=mylib.class (read=blue);
Assigning a Password with a Procedure
You can assign a password after an OUT= data set specification in PROC SQL.
This example assigns a write and alter password
proc sort data=sashelp.class out=mylib.class(write=yellow alter=red); by age; run;
Assigning a Password to an Existing Data Set
You can use the MODIFY statement in the DATASET procedure to assign passwords to unprotected members if the SAS data file already exists.
proc datasets library=mylib; modify class(alter=black); run;
Once, you have set up a password at some point of time you may want to change or remove the password. You can use the proc datasets procedure to update or remove passwords.
proc datasets lib=mylib; modify class (pw=green/brown); run;
proc datasets lib=mylib; modify class (pw=brown/); run;
Locking SAS datasets
Locking a SAS data set (a SAS data file or a SAS data view) prevents other users from creating, reading, updating, deleting, or renaming the SAS data file. Locking a SAS data view prevents other users from creating, reading, deleting, renaming, or interpreting the view.
NOTE: MYLIB.CLASS.DATA is now locked for exclusive access by you.
lock mylib.class clear;
NOTE: MYLIB.CLASS.DATA is no longer locked by you.
- You use a LOCK statement with the LIST argument to list a lock you do not have.
- You use a LOCK statement with the CLEAR argument to release a lock you do not have.
SAS data encryption
Encrypting SAS datasets is a way to prevent SAS datasets access from outside systems like Ab-Initio, Mainframe etc. You can encrypt data by using the ENCRYPT= SAS dataset option. Below code demonstrates this.
Define dataset encryption
data mylib.class(pw=red encrypt=yes); set sashelp.class; run;
Remove data encryption
data mylib.demog(pw=red encrypt=no); set mylib.demog; run;
Using the ENCRYPT=AES Option
ENCYPT= AES encrypts the file by using the SAS Proprietary algorithm. This encryption uses passwords that are stored in the data set. You must specify the READ= data set option or the PW= data set option along with the ENCRYPT=YES. Note that you cannot change any password on an encrypted data set without re-creating the data set.
data mylib.class(encrypt=aes encryptkey=green); set sashelp.class; run;