Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm currently focusing on any security features related to the Database. What are the main requirements needed to be able to achieve a secured environment on the database level. The top factors i could think of are the following :

  1. Account used by the application to access the database (least privileged user account).
  2. Encrypted database.
  3. Control the access rights on the database.
  4. Data in the database should be hashed.
  5. Control the access rights on the server.
share|improve this question
    
Do the clients communicate directly w the database or with an application on top of the database? –  Neil McGuigan Nov 19 '13 at 20:08
    
@NeilMcGuigan Yes direct communication. –  Optimus Prime Nov 20 '13 at 10:46
add comment

2 Answers

up vote 1 down vote accepted

In addition to what you have already listed, you should validate all the data passed to the database. Unvalidated input can lead to persistent cross-site scripting or SQL injection.

How to validate input passed to database:

  • Identify application inputs
  • Identify database entry points
  • Create and use validators
  • Use Type-Safe parameters in SQL statements (Stored procedures and Parameterized queries)

Logging and monitoring is another improvement. You can take action in case of any abnormal behaviour. For instance you can apply a set of rules to respond when your application makes a suspicious behaviour.There are tools/products which montiros database activity and protects them with a set of preconfigured defenses, and helps you build a custom security policy for your environment. You can search the web if you don't want to build yourself.

Additionally, you can use a host-based intrusion detection system such as OSSEC for log analysis, file integrity checking, policy monitoring, real-time alerting and active response.

share|improve this answer
    
Vulnerability scans were performed on the application level and vulnerabilities are handled. Wouldn't that cover XSS and SQL injection ? –  Optimus Prime Sep 27 '13 at 7:31
    
If the scans you performed are capable of covering XSS and SQL injection attack, it may be sufficient. I editted and expanded my answer. –  Kerim Oguzcan Yenidunya Sep 27 '13 at 8:57
add comment

If you can, a best practice is to handle all database logic with Stored Procedures and grant the account that accesses the database access to only the stored procedures, this will help prevent a hacker that gains access to the application from directly accessing tables. Moving business logic to stored procedures can also improve performance if it reduces the number of calls the application has to make to the database. Never use dynamic sql, again, that opens you up to SQL injection and also hurts performance because it doesn't take advantage of cached query plans. It's also a best practice to encrypt your stored procedures.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.