How to Password protect SAS datasets ?

Password Protecting SAS datasets

Password Protecting SAS datasets means using access control on your data to prevent unintended access and secure your data. SAS has provided three levels of Access controls over the data and is implemented using passwords.

Those access controls are read-write and alter.

Passwords are hierarchical in terms of gaining access. For example, specifying the ALTER password gives you read and write access.

Note – SAS password doesn’t restrict the use of SAS files beyond the file system.

To demonstrate Password Protection, we have created a library to store the SASHELP.CLASS dataset.

libname mylib '/home/9to5sas';

data mylib.class;
	set sashelp.class;
run;

Setup password for a SAS dataset

To set a password, first specify a SAS data set in one of the following:

1. DATA statement
2. MODIFY statement of the DATASETS procedure
3. OUT = statement in PROC SQL
4. CREATE VIEW statement in PROC SQL

Read Protected – Users can’t read the data without knowing the password. They can’t write to the data however they can drop the dataset itself.

Write Protected – Users can’t write to the data to the data set without knowing the password, but they can read the data and drop the dataset itself.

Alter Protected – Users can’t drop or replace the dataset without knowing the password, but they can always read and write to the data.

PW= Data Set Option – You can apply full control using the PW= option. It assigns a READ, WRITE, and ALTER password to a SAS file and enables access to a password-protected SAS file.

Applying full controls Using PW= option:

data mylib.class(pw=red);
	set mylib.class;
run;

You can use the proc contents procedure to view the access control specified in a SAS dataset.

Preventing deletion and modification of a SAS dataset

This example prevents the deletion or modification of the data set without a password.

data mylib.class(write=green alter=red);
	set mylib.class;
run;

Accessing password-protected files

You can access password-protected files with the same data set options you use to assign protection.

proc print data=mylib.class (read=blue);

Assigning a Password with a Procedure

You can assign a password after an OUT= data set specification in PROC SQL.

This example assigns a write-and-alter password.

proc sort data=sashelp.class
out=mylib.class(write=yellow alter=red);
by age;
run;

Assigning a Password to an Existing Data Set

If the SAS data file already exists, you can use the MODIFY statement in the DATASET procedure to assign passwords to unprotected members.

proc datasets library=mylib;
modify class(alter=black);
run;

Manipulating Passwords

Once you have set up a password at some point in time, you may want to change or remove the password. You can use the proc datasets procedure to update or remove passwords.

Changing Passwords of SAS Dataset

proc datasets lib=mylib;
	modify class (pw=green/brown);
	run;

̉Removing Passwords from a SAS dataset

proc datasets lib=mylib;
 modify class (pw=brown/);
run;

Locking SAS datasets

Locking a SAS data set (a SAS data file or a SAS data view) prevents other users from creating, reading, updating, deleting, or renaming the SAS data file. Locking a SAS data view prevents other users from creating, reading, deleting, renaming, or interpreting the view.

lock mylib.class;

NOTE: MYLIB.CLASS.DATA is now locked for exclusive access by you.

lock mylib.class clear;

NOTE: MYLIB.CLASS.You no longer lock DATA.

• You use a LOCK statement with the LIST argument to list a lock you do not have.
• You use a LOCK statement with the CLEAR argument to release a lock you do not have.

Locking a data set and verifying that a lock is held Macro

SAS data encryption

Encrypting SAS datasets is a way to prevent SAS datasets access from outside systems like Ab-Initio, Mainframe etc. You can encrypt data by using the ENCRYPT= SAS dataset option. The below code demonstrates this.

Define dataset encryption

data mylib.class(pw=red encrypt=yes);
set sashelp.class;
run;

Remove data encryption

data mylib.demog(pw=red encrypt=no);
set mylib.demog;
run;

Using the ENCRYPT=AES Option

ENCYPT= AES encrypts the file by using the SAS Proprietary algorithm. This encryption uses passwords that are stored in the data set. 

You must specify the READ= data set option or the PW= data set option along with the ENCRYPT=YES. Note that you cannot change any password on an encrypted data set without re-creating the data set.

data mylib.class(encrypt=aes encryptkey=green);
set sashelp.class;
run;