Security related aspects of databases and database access.

learn more… | top users | synonyms

0
votes
1answer
198 views

Which approach to encrypting data on a per-user basis is more secure?

As a bit of a thought experiment, I've been thinking through how one might design a web application where a user's data (say, from a form on a webpage) is stored, encrypted, on the server, using a ...
1
vote
1answer
185 views

Uploading Executable Files

Using proxy software, I was able to bypass a file upload control file-checking for an asp.net system I am pen testing. I noticed they are saving the file into the database as bytes, and it is ...
1
vote
1answer
150 views

Are there any secure ways to store the secret key used in a TOTP scheme?

I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash ...
1
vote
0answers
92 views

Store which parts of an IP address, for user to remain anonymous?

I'm thinking about building a very anonymous forum, where people can comment and upvote each other's comments anonymously. People are supposed to remain anonymous even if the forum's database contents ...
0
votes
2answers
144 views

What is truly unbreakable these days? [closed]

Just very curious, count my knowledge in cryptography, algorithms, and security in general as non-existent. Now I am aware that this might be a VERY broad question, but here it goes. What is the most ...
0
votes
1answer
195 views

Application Server <-> Database Firewall [closed]

What threats can a firewall between an application server and a database server mitigate that would not otherwise be mitigated when both the database server and application server are behind the same ...
4
votes
3answers
223 views

What is a good rebuttal to users who wish all data WITHIN Db be encrypted?

I am building an application in VB.NET (WinForms) utilizing SQL Server 2008 R2 as a Backend. The application is to track employee's money they defer each paycheck, or month, to deposit into separate ...
0
votes
0answers
23 views

Why is it not advisable to have the database and web server on the same machine? [duplicate]

I'm bringing this across from a question on stackoverflow, but I'd like to focus specifically on the security aspects of it (and not the performance, etc..). My hypothesis is that the cost of ...
0
votes
1answer
192 views

Should I encrypt Long-lived Facebook Access Token when storing them in my DB?

I own an application that grabs some Long-Lived Facebook Access token, in order to be use later according to the corresponding logged user. Should I need to encrypt them before storing them, to avoid ...
1
vote
0answers
39 views

Secure 'pg_settings' for PostgreSQL

I have been looking for some kind of hardening guide towards PostgreSQL which I can use for a security audit of a PostgreSQL DB. I came across this url, have checked the same. Anything more to this?: ...
0
votes
1answer
147 views

Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [closed]

As part of hardening a MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed. For a server that is serving only as a MySQL server, what services and ...
0
votes
2answers
162 views

What are the Standard Practices for Securely Storing Encryption Keys in Databases

I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ? To add a ...
18
votes
4answers
3k views

What can an attacker do if he knew my database credentials?

If an attacker knows my database username and password, what can he possibly do if he doesn't have access to my server? Let's say my database is using Microsoft SQL Server. Is there a way he can use ...
2
votes
3answers
279 views

How can I prevent my database from being compromised if my CakePHP app is compromised?

I have an app server hosting a CakePHP app and a database server hosting the databases. The servers are physically separate. The databases contain encrypted sensitive information. The encryption keys ...
0
votes
1answer
150 views

A Question about Database Encryption [closed]

I've been looking around for an answer to this for some time now and I felt that this place would be a good venue to ask this. How can one improve the security in a MySQL database? The database that ...
3
votes
1answer
647 views

Best practice for data security on a web application

I read a couple articles on privacy/security but still cannot get a clear picture of the best practice to ensure that an attacker will not be able to access users' private information. For storing ...
1
vote
1answer
121 views

PCI DSS compliance for storing PAN and PII in multi-tenant environment

I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the ...
6
votes
4answers
2k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
3
votes
1answer
123 views

PCI Complient Storing Credit Card Data On Offline Tablet

I have a client that does work in rural areas where there are no cellphone or internet connections. They need a way to take credit card information in the field, bring it back to their office where ...
2
votes
2answers
82 views

How do vulnerability reports work?

I'm really interested in IT security and I would like to know how vulnerability reports work. Is there a central database for those things? I often see CVE-XXX-XXX on disclosures, but I don't ...
1
vote
2answers
133 views

How to securely provide data to a web server using a data warehouse?

We have a data warehouse that stores prices for our products. Once every business day, new data points are added representing the day's price for each product. On the website, a user sees this ...
5
votes
2answers
596 views

Encrypt user data when they log in with Facebook, Gmail, etc

I made a login system. The user can login by: using a normal email / password (bcrypted). using a service like facebook, gmail, etc. So far so good. Now I want to store sensitive information (ftp ...
1
vote
0answers
108 views

Security considerations for SQL database with employee data in blob field

With elevated SQL permissions, I am able to export a blob and retrieve a pdf with employee data (SSN) from a SQL Server database. This database is a backend to a third party web app we use internally ...
1
vote
2answers
577 views

What does Gazzang zNcrypt actually protect against?

In an effort to increase security of our website, I'm reading up on Gazzang zNcrypt, which claims to protect data in databases from breaches. Technically, it seems to do filesystem encryption. As far ...
4
votes
1answer
102 views

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks?

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks? Reading the "What Are the Oracle Database Built-in Password Protections?" from ...
4
votes
1answer
878 views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile website to make my service also available for other mobile operating systems. Now, ...
4
votes
2answers
128 views

Data integrity of malicious content in the database

From a data integrity standpoint, if I persist the following code into my database: <script> alert('hi'); </script> should I sanitize it before persistence, for instance making ...
-1
votes
1answer
64 views

Network and data security for small online businesses? [closed]

What is the most efficient way of protecting small online business from outside threats. Everything too much expensive is not a solution. I've been looking for good web application firewall and at ...
1
vote
1answer
108 views

Security risks if a server in not supported anymore

I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements. What are the security risks that we might ...
0
votes
1answer
348 views

How to secure and limit access to a web based application hosted on a local server

I have security concerns over a web based application. I want to limit access to the application only to a whitelisted IP addresses. Here are my thoughts on that: To host the application myself. The ...
9
votes
3answers
4k views

Is “Why Should You Avoid AES In MySQL?” true?

From a 2012 Smashing Magazine article quite a bold statement is made to avoid AES in MySQL itself. Or as they put it "Why Should You Avoid AES In MySQL?". However, if you search for SQL encryption, ...
-2
votes
1answer
63 views

Should I do science of computing or systems analyst? [closed]

I want to become a federal analyst of cyber crimes and I dont't know what's the right university course for me, I would like to know what's the cons and pros of choosing one or another course and ...
6
votes
1answer
317 views

SQL Server of my hosting provider allows me to see all databases. How secure is my mine?

My hosting provider allows access to its SQL Server. When I connected to it by SQL Management Studio, all hosted databases were visible. I can't get the details on these databases, I get this ...
4
votes
1answer
333 views

How secure is MongoDB wire protocol?

I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
1
vote
1answer
62 views

How to restrict access to a resource based on frequency of access?

I want to restrict access to a particular resource based on time (configurable). So suppose user A has time t configured from him. He can access the resource only once every t time units. The values ...
3
votes
1answer
262 views

Theory about split data in several isolated (different physical server) DBMS to gain in security?

Suppose the following scenario: 1- A web app (on WEBSERVER1) and its database (on DBMS1) having very sensible information deployed in the same physical server (lets said that for simplification). ...
1
vote
1answer
72 views

Oracle database privileges [closed]

I have a 10.2.0.5.0 Oracle Database and a list of users who i need to grant some privileges to (Mainly to generate reports and so on). I used impersonation, which means i created one Oracle user so ...
1
vote
2answers
178 views

Main requirements to secure my Application in any database related features

I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm ...
8
votes
2answers
249 views

What's ownership concept for?

I fail to grasp the necessity of using concept of owner (ownership) and find clear explanation of its necessity. What cannot be done without concept of owner(ownership) in filesystem/database object ...
5
votes
3answers
319 views

How do poor-quality initialization vectors affect the security of CBC mode?

(If the consensus is that this question belongs on crypto, rather than here, please feel free to [tell me to] migrate it.) From what I have read (looking specifically at AES in Cipher Block Chaining ...
1
vote
1answer
67 views

Hybrid Encryption System - Is this unnecessary in this case? [closed]

I have a column in my database that I need to encrypt. The column can contain any arbitrary data. What I am thinking is to generate a public and private key pair first. Store the public key in a ...
7
votes
1answer
632 views

Is Postgres password-based authentication secure?

According to Postgres's documentation, Postgres's password authentication method uses MD5 hashing to secure the password: The password-based authentication methods are md5 and password. These ...
4
votes
1answer
489 views

HIPAA: How am I required to secure PHI database access creds on my web server?

Assuming I have a database of PHI that my web application needs to access, how am I required to secure the credentials on the webserver that the web application uses to access this database? Is ...
0
votes
1answer
95 views

What are the risk associated with granting full permission (Any) to DB Admin users to the Database?

Usually in a well controlled environment, Database Admins are granted specific rights like Read, Modify...etc. No one has the right (ANY) to perform on any Database. Certain requirements dictate to ...
3
votes
6answers
311 views

Ban or delete abusive users [closed]

I'd like to hear recommendations on a best practice for handling abusive users (for whatever reason) on an authenticated Website. Is there any point in keeping the user in the database with a ...
4
votes
3answers
836 views

MS-SQL Monitoring/Auditing of PHI for HIPAA

We're currently looking for a solution (hardware or software-based) that can monitor and audit all PHI viewing activity per new HIPAA rules. We use MS-SQL for our production database. We have the ...
2
votes
2answers
986 views

IS TDE PCI-Compliant?

According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
5
votes
2answers
810 views

If encrypted data in a database are accessed by application, does that mean that the application has the decryption key?

I'm using an application linked to a database which holds confidential data (numbers). According to the developer, this data is encrypted. However, i can easily generate a report that will show the ...
6
votes
2answers
272 views

Can a web application administrator access the database of that application?

We have a web application linked to a database. The database is secured but contains unmasked confidential numbers. Can a normal administrator who can access the application, access those numbers in ...
5
votes
2answers
6k views

Building a web app with encrypted MySQL database entries?

I have some experience in building PHP based websites with MySQL access, storing encrypted user details, but all other fields being plain text. My most recent project will require sensitive data to be ...