Security related aspects of databases and database access.

learn more… | top users | synonyms

1
vote
0answers
20 views

Spring-MVC : Encryption/Decryption with user password

I am working on a Spring-MVC application which uses Hibernate as the ORM and PostgreSQL as the database, in which I am looking for on-the-fly encryption decryption solution, but only for 2 columns in ...
2
votes
1answer
25 views

How to appropriately secure a database using different db users

I was thinking recently of the steps to secure a database server. Most of us are aware how to handle the security on the application side, although a malicious user might find his way to bypass the ...
1
vote
2answers
118 views

Is bruteforcing the last character of a salt a good idea?

Would it be a good idea security-wise to store salts with their last character removed, and then bruteforce the last character to further the amount of time it would take to create rainbow tables and ...
1
vote
1answer
39 views

Is it fine to store single-use beta keys plain-text?

Is it okay to store single-use beta keys in plain-text in the database? I'll be pre-generating and storing about 2M keys. The keys get passed around so that people can sign up with it, rather than let ...
0
votes
1answer
53 views

Web app and database on same server, what is benefit of encrypting database data?

If a web app and a database are on the same server, what is the security benefit of encrypting database data? Obviously passwords should be hashed either way. I assume that if an attacker can ...
2
votes
3answers
90 views

How could a shared password database be implemented?

In the traditional form, a password database is similar to any other database file, except the contents are encrypted using a key derived from a passphrase entered by the user. The user enters their ...
1
vote
0answers
50 views

Proper credit card encryption for use in a blacklist

I have a general encryption question. I have read through many of the encryption related questions here and I can't find any specifically addressing my concern. This is the hypothetical scenario: I ...
0
votes
2answers
58 views

Encrypt database records to be accessed by multiple users

I want to encrypt serialised customer details and store in a database to protect against attacks where the attacker has access to the raw database records. The records then need to be accessible by ...
1
vote
1answer
118 views

Encrypted quiz data in PHP and JS

I'm developing a quiz with which you can win a few cool prizes. Therefore I'm afraid, that someone might try to hack/manipulate it. All participants have to be logged in and the website takes 15 ...
2
votes
2answers
105 views

High level design for secure web application

I'm looking for some advise on designing a secure web app for storing passwords. Why reinvent the wheel? Because I don't trust a 3rd party with all of my passwords. Here are my thoughts: There are ...
2
votes
2answers
134 views

Storing lots of passwords that different levels of employees need access to

I am wondering what other people do for storing passwords. Our current model at my employer is fundamentally flawed in my opinion, so I am trying to see what other people do so I can select the best ...
16
votes
3answers
2k views

Knowing when there has been a data breach from your database

How do companies know when there has been a data breach? For example, do they monitor event logs for login audits or do they wait until a paste is made of their data in a pastebin type site? Is it ...
0
votes
2answers
51 views

Is authenticating via the database secure

Sorry for this probably noobish question. So far, I've read password comparison/verification is implicitly understood to be made on the application layer and not in the database. For example in PHP, ...
0
votes
1answer
76 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
2
votes
1answer
98 views

Hiding remote database credentials in application

If I'm building an application that connects to a remote database, where should I hide the credentials? I've seen many suggest that you go through a web-application and use POST and GET requests to ...
0
votes
1answer
31 views

How to secure sensitive data in application with message queue

Currently we are creating one small service, where we are using some sensitive data from users(not worth zillions but to me it is like password). The idea is that application itself only inserts this ...
0
votes
3answers
110 views

My site was hacked and the attacker got data from the config file [closed]

A few days ago my website was hacked. I found out that the 'hacker' ran queries directly into the database, so he somehow got access to my database credentials. I'm using laravel 4 and the config ...
4
votes
1answer
70 views

Database Security

Would having the IP address and name of my database visible to the public be a security risk? I have hosting with godaddy, a shared hosting plan. When I connect to my DB, via MS-SQL-MS, I can see the ...
1
vote
2answers
50 views

What do we have to keep in mind when opening up our data to a third party?

We have a database with pictures (amongst other things). We have a few apps that can connect to this database via a php webservice (send https requests to a php file to retrieve stuff from the db and ...
3
votes
2answers
118 views

Web server interaction with a database server

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
1
vote
0answers
85 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
0
votes
1answer
47 views

PCI Compliant Secure Vault Design and Implementation

I often see the phrase “Secure Vault” in PCI DSS documentations and I want to know if a “Secure Vault” must be a highly protected file with sophisticated technologies stored on a very secure hardware ...
0
votes
2answers
70 views

Separate database column for salt

Is it advisable to store the salt in a separate database column or should we concatenate it together with the password? Is there any difference? I have come across implementations of both types. ...
1
vote
1answer
93 views

What are the risks of encrypting a database with a single symmetric key

An application is required to store sensitive data* on each user. Additional columns are added to the database which store cyphertext encrypted on the application server. The algorithm of choice is ...
17
votes
5answers
2k views

Is sending plaintext passwords to a SQL Server database a security risk?

I have a database which has stored procedures which take plaintext passwords. It hashes them and inserts them into the DB. If an attacker has access to the DB connection, it is possible to intercept ...
0
votes
2answers
63 views

What is the severity if someone read the ConnectionStrings_Prod.config?

I was doing an pen test in a website and the programmer did a big mistake and I was able to read any file. So I read the web.config and see the password for database was in ...
0
votes
1answer
56 views

Application-Server connection security

I have this school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as ...
1
vote
3answers
107 views

Validating Credentials - Logic in Application vs Database

I am studying Web Application Security, A Beginner's Guide Paperback – November 3, 2011 by Bryan Sullivan (Author), Vincent Liu (Author) On pp 69, "Validating Credentials", they say you can ...
2
votes
3answers
127 views

If a phone is encrypted at a platform storage level do I need to encrypt my data stored on it?

I am writing a mobile app which would be expected to store sensitive data. It needs to be stored for offline use. I am wondering now that Android and iOS provide encryption at rest do I need to ...
52
votes
9answers
5k views

How do you explain to experts that a database server should not reside in the DMZ?

Our security experts, database administrators, network team and infrastructure team are all saying it's OK to have the database server located in the DMZ along with the HTTP server and middle-ware ...
0
votes
1answer
61 views

Which is the best way to secure login password and safeguard user data? (even DBAs couldn't connect data to users)

Lets say that I'm building an website and a app which saves the users' secrets. The user logs in and can save into the app his deepest secrets. I'm worried about two things: - Should I save the ...
-1
votes
1answer
49 views

Where do I start securing my system? [closed]

I am working for a company with perhaps the least security possible. We have servers, databases, web applications, and websites that are all unsecured. There only exists one account: root, which ...
0
votes
1answer
53 views

Indexing encrypted data for efficient searching

I have implemented encryption for certain columns in a database. In some cases it may be necessary to search by these columns, either for exact matches or for substrings. At the moment, there is less ...
1
vote
1answer
71 views

How to sniff [possibly encrypted] TDS protocol data from the host the client application is installed on?

Let's say, there is an .NET application on a windows 7 host where I have administrator's access rights. The application works with remote MS-SQL server which I don't control, it also seems that the ...
1
vote
2answers
75 views

Shared Database and PCI Compliance

Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a ...
-1
votes
1answer
75 views

retrieve database data with application server? [closed]

retrieve database data with application server?
1
vote
0answers
133 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
5
votes
2answers
675 views

Authentication: Username (email) and password hashed together in one database field

I am currently developping a platform with a PHP framework for our client. The head of the client's IT department wants us to handle authentication with one database field containing ...
1
vote
1answer
471 views

Flawed understanding of SQL Server Transparent Data Encryption (TDE)

We host a database for one of our applications on Microsoft SQL Azure. One of our clients was dissatisfied with the fact that TDE is not supported on SQL Azure (and the database is otherwise not ...
4
votes
3answers
207 views

Anonymiszing sensitive data in MySQL DB while retaining searchability [closed]

I have a MySQL database that stores sensitive (personal) data about individuals; and have been tasked with ensuring that this data is encrypted in some way to protect the individuals and their data if ...
1
vote
3answers
166 views

How do attackers find the database technology used by a web application?

These days there are several database technologies are available for data storage purpose. While performing injection attacks, how do attackers actually identify the database used by a website? If ...
-1
votes
2answers
157 views

How to securely store users' private keys? [closed]

I'm building an application that needs to store a public/private key pair generated by the user. What's the best way to do this? Encrypt the private key in the db with some application-generated ...
1
vote
1answer
95 views

Connecting to Oracle Database from VBScript - Hiding Credentials

At work our first level support uses a ticket management system that allows us to add extra functionality via VBScripts that the application invokes. First level support also receives quite a few ...
2
votes
1answer
87 views

Where to store uploaded images from perspective of security

It is quite common that uploaded files (images, videos, etc.) are stored on a file server because of performance and database-recovery-time reasons. But is there a benefit of storing such files in ...
0
votes
2answers
88 views

Authenticate User Salted Hash Without Username

I've got a page with a login system where you type your username and password, the salted hash gets pulled down from the database depending on the username ... SELECT hash FROM db WHERE username = ? ...
1
vote
2answers
184 views

Opinions on my “Encryption at rest” implementation idea

Ok so basic overview of the environment I'm envisioning: Webapp w/ db backend storing sensitive data, possibly phi; standard user:pass auth due to unteachable users. My idea was to encrypt row data ...
1
vote
3answers
457 views

Protect database data from everyone, including sys admins, etc

One of the things that has always bothered me about simple database data encryption: If the server is compromised, the database is effectively compromised. The attacker can use the same code as the ...
0
votes
1answer
63 views

Should content from database be sanitized again

Suppose I save content into the database after sanitizing it. Is there still a need to sanitize it again when retrieving it? If yes, why?
2
votes
1answer
52 views

Display link to admin section or not?

I have a question and answers site. I have an admin section. From that section I can delete users, threads, responses, and edit various other things. I have some simple code at the start of the admin ...
2
votes
2answers
102 views

Should I use a separate SQL Server instance for a database with PII?

We build software which needs a SQL SERVER database. This database will hold private user information (address,bank, ...) My question is: Should I install my database in a fresh SQL Server ...