Security related aspects of databases and database access.

learn more… | top users | synonyms

0
votes
1answer
46 views

Security of Data and Source Code in a 3rd Party Hosting Environment [closed]

What expectation should I have for the security of my data and codebase hosted with a 3rd party e.g. godaddy, or any other similar hosting provider. How common is it that some IT employee within the ...
4
votes
1answer
59 views

How do I protect the stored clients' public keys on a server?

I'm learning about security at the moment, and I want to store my clients' public keys on the server to facilitate distributing and managing those keys, my question is what are the possible ways to ...
3
votes
1answer
451 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
0
votes
0answers
77 views

Hashing Identifiers to Create Pseudonyms

I'm wanting to share datasets between two organisations in a pseudonymised way such that they link together via mutual entities (e.g. people) but so that the entities cannot be identified. E.g.: ...
1
vote
2answers
81 views

Why use the UUID method over traditional ID?

The following quote came from one of my Teachers not to long ago, along with an exercise to build an application: To follow guidelines, you are to use UUID's instead of ID's. Of course, the ...
1
vote
0answers
100 views

Multi-Region MySQL Deployment on AWS - How to Encrypt?

Problem: AWS offers the managed RDS MySQL database service in which you can encrypt and manage keys using AWS's Key Management System (KMS). Unfortunately encrypted database snapshots cannot be copied ...
2
votes
1answer
74 views

How to save passwords temporarily?

I work for a hosting company and are about to design a rest api for a 3rd party so they can create Active Directory user accounts. I also want this api to be async and robust enough to survice ...
2
votes
2answers
122 views

Best hash for indexing and searching encrypted data

I would like to be able to do database look-ups on a set of data based on one of the encrypted fields. My understanding of the best practice for accomplishing this is to store a hash of the data I ...
6
votes
2answers
158 views

Non-Sensitive/Non-Critical Database and Web server protections?

I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not ...
2
votes
2answers
98 views

Is using a sqlite with random name file secure?

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and ...
0
votes
1answer
61 views

Convert customer tracking system from web access to REST

Intro:In our company there is a service tracking website for our clients, where they can monitor the progress made in their cases with us. Our users are required to log in to that website (admin ...
1
vote
1answer
103 views

what fields should I encrypt in a database containing user information? [closed]

So in a database many user fields could exist. Normally when I setup a database I go off of the security experts recommendations on what fields to encrypt, but I'm curious what is the most standard ...
4
votes
1answer
191 views

How do banking software systems securely store account information in database?

Banking systems store account information in databases such as Oracle and databases are maintained and administered by DB administrators. The account information is stored in a table and a column of ...
2
votes
3answers
265 views

Is it possible to make cracking a password pointless to an attacker with database access?

I've been reading information on making passwords secure, but what are the reasons an attacker would want to put effort into getting the original password? If an attacker does indeed have a copy of ...
2
votes
3answers
1k views

Strategy for updating stored passwords to more secure hash? [duplicate]

I know that we cannot update our hashed passwords without having the plain text password to re-hash. When a member logs in with login/password, we have the plain text, so that gives us an opportunity ...
3
votes
1answer
113 views

Should I make my api calls to update users contain a password or hashed auth key?

So Im creating an API for an app that in the backend involves updating users, deleting users, and some other user related stuff. Im using the slim framework and I was wondering when the user wants to ...
2
votes
3answers
174 views

Feasibility of time-based database brute-force attacks on websites

I recently learned that there is an attack that utilizes the fact that when brute-forcing a compared string (e.g. hash from a password or token) in a database the query fails a few nanoseconds earlier ...
0
votes
1answer
60 views

Windows SQL Server Intrusion Detection [closed]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
-1
votes
1answer
215 views

Does the 'Relational' Foundation of Database Theory enable 'Ashley Madison'-like attacks?

Again and again hackers use SQL injection to get information from the backend database. Is it fair to say because a relational database by its nature has all the links within the data sets (e.g., ...
4
votes
1answer
117 views

Best practice for direct SQL connection from DB to specific IPs on Internet

I am using AWS and looking for any comments on best practices regarding permitting connections to my DB from specific IPs on the Internet. I could give the DB a public IP and just lock down the ...
-1
votes
1answer
312 views

What is one way to verify emails of compromised website if registrations are not validated?

There was recently a massive personal data leak, and the data seems to be from Ashley Madison - a site providing dating services to married men. The site takes any email and does not verify them while ...
0
votes
0answers
24 views

Get data file off critical database host

Re-wording this question to hopefully be more understandable. Thanks for the feedback. We have a data warehouse which sits in our production environment. Our data engineers can get to the host via ...
1
vote
2answers
309 views

Encrypt data stored in a database

I recently talked to a potential customer who wants to build up a database which contains fairly sensitive data. One of her key requirements is, that the data storeed will be encrypted in a way that ...
1
vote
0answers
110 views

How does the Facebook App on iPhone access the SMS data from iMessages? What are the details?

(This is not a repeat question to "How is Facebook accessing my iPhone texts in order to recommend friends?", linked below. I wish to know the internal details of how downloading the Facebook app on a ...
-2
votes
2answers
76 views

When should a password be hashed? [duplicate]

I develop a Smartphone App and have a little question: When should I hash the user passwords, on the device or upload them in plain text and hash them on the server before stored in the database?
2
votes
1answer
74 views

Do password derived encryption keys need to be salted?

If I have a database where I store users' sensitive information, and encrypt that information, do I need to do something like PBKDF2(password,salt,10^5) for the encryption key as well as the hash?
2
votes
2answers
479 views

Practical steps for encrypting an encryption key for data stored in MySQL

So I'm working on my first project where user data is stored as encrypted using the user's password as (part of) the key. I have read many similar things about best practices, but the details seems to ...
2
votes
2answers
91 views

Securing microsoft access database

Let's say I have a website which is written in ASP and I keep my .mdb database in a random directory like /asd8asd/dkdgk32/asdmv/askdasd/kasldk.mdb Can an attacker find database's location without ...
-2
votes
2answers
272 views

Don't store passwords in database? [closed]

Where might someone keep them besides a database? By storing passwords elsewhere I mean a non-traditional database. Allow me to explain. A couple of my friends run high security websites. They ...
0
votes
2answers
181 views

Saving passwords in database

I have recently been studying a lot on writing secure code and choosing secure methods for saving passwords to a database. I'm wondering if it's secure to use ready made libraries or APIs to do this ...
2
votes
2answers
73 views

Trusted vulnerability database source [closed]

Would like to ask currently, is the National Vulnerability Database (NVD) still the place to go if you want to search for update vulnerabilities for different products? I find that some product ...
-6
votes
1answer
87 views

Is this an attack [closed]

Original site: ---topbargains-com-au A fake replica: --topbargain-org How dangerous is this? Have they copied the whole database? Edit: Removed the URLs to satisfy a spam allegation Edit: The fake ...
1
vote
3answers
105 views

Protecting Uploaded Confidential Files [closed]

We have a web application in Linux (App A) using PHP and Zend and another in Windows using Asp.net C# (App B). They both access the same database. App B is for internal use only while App A can be ...
4
votes
2answers
262 views

Is storing encrypted data in a database futile?

The way I see it: there are two ways to encrypt data for a web app. 1) Store a single encryption key on the server, and use it to encrypt / decrypt data at runtime. The obvious issue here is that if ...
11
votes
4answers
2k views

What's more secure? Hard coding credentials or storing them in a database? [duplicate]

I wonder which of these things is more secure. Imagine hard coded credentials, similar to this: if user.Equals("registereduser") && (password.Equals(encryptedpassword)) { Give access to ...
4
votes
1answer
188 views

How to detect a database leak

Website keep getting hacked every day and every now and then we hear website owners react and tell "affected users that their password might had been compromised". Most sites that disclose such leaks ...
1
vote
0answers
81 views

Is there a solution for On-the-fly-encryption with active directory rules & policies?

I am looking at having our servers' sql databases for a few program and documents to be always encrypted on the HDD, but available to AD users. So one or multiple users with the right AD privileges ...
5
votes
1answer
113 views

If I fill a hypothetical 1gb HDD with 1024 single 1mb files, will all sectors be overwritten?

When a file is deleted, its only marked as an unused sector of a hard drive. Im wondering if it's possible to fill a 1gb HDD with 1024 individual 1mb files to completely use every sector?
1
vote
1answer
132 views

How to encrypt or store data so that only a pool of processes can share it on Windows?

I am writing an application T1 which is using SQLite database to store some sensitive data and i am trying to encrypt it securely. The issue i am facing is that i don't want my symmetric key to be ...
0
votes
0answers
65 views

What type of security does Gazzang zNcrypt provide?

We have just planned to implement the same in our organization, and I believe this will encrypt files and data on disk. I have two questions: Does it provide column level encryption in database (if ...
1
vote
2answers
1k views

Table or row level security in ASP.NET MVC 5 and Entity Framework 6

I've already asked this question on Stack Overflow, but no one answered, so maybe it's a more appropriate place to discuss it. Please let me know if I'm wrong and having duplicated question on ...
1
vote
1answer
139 views

Is it ok to have GRANT ANY ROLE privilege granted to an Oracle account which is expired & locked?

I know it's not considered secure to grant GRANT ANY ROLE privilege to other users apart from admins. But what if the user is expired & locked? In particular, I see these 2 users having this ...
1
vote
3answers
278 views

Most secure location of database

Let's say I have a straight forward completely database driven web site application and I store my database on my web server in the DMZ. I won't be broadcasting the IP address of my database because I ...
1
vote
0answers
234 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
0
votes
1answer
2k views

How sqlmap works to get all database info

I am curious how sqlmap able to get all the info from the database? I am using burp as proxy to view all the request and response. From the response I couldn't see any information related to the ...
1
vote
1answer
105 views

Difference between Oracle Label Security and Oracle Virtual Private Database?

I am working on a class project, and our lecturer ask a question with this title, I searched in net but I could not find a clear answer. if there is difference what are they? thanks
0
votes
1answer
42 views

Diceware & Database hosting [duplicate]

I'm currently setting up a new SQL database with DotEasy as my Hosting/Database provider. I've heard a lot about Diceware being one of the best methods of creating a really strong password, so I ...
4
votes
1answer
490 views

Showing bank routing/account numbers, and storing them safely

EDIT: This is for the UK/Europe region. I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be ...
0
votes
3answers
351 views

Sending database name in request headers

I am doing a project with an architecture of single server and multiple database. Every client request will contain a header containing database name that this request should connect. Is this a good ...
3
votes
1answer
239 views

Deleting credit card information after every transaction

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every ...