Security related aspects of databases and database access.
4
votes
2answers
169 views
What to do in response to a source code and/or database leak by a third party hosting provider?
My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak.
On first appearances, the web host ...
12
votes
3answers
1k views
When using AES and CBC, can the IV be a hash of the plaintext?
[Originally on programmers.stackexchange.com with title: Can you encrypt with AES+CBC and search the encrypted data]
Basically, I'm going to go with Advanced Encryption Standard with either ...
10
votes
2answers
581 views
What are the SQL-injections issues of parameterized queries?
I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not:
Set adoCon = Server.CreateObject("ADODB.Connection")
adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
6
votes
3answers
175 views
Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?
I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
2
votes
2answers
2k views
LDAP vs MySQL for Usernames and Passwords
I understand the LDAP databases are more secure, but is it always necessary to use LDAP instead of MySQL for usernames and passwords?
2
votes
1answer
596 views
iOS/Android authentication and security
Here is what I am trying to do and can anyone provide some best practice advice for authentication and security?
Each user will have their own private database on the cloud. He will have his local ...
4
votes
1answer
117 views
testing for 'Dangling Cursor'
While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor.
I was wondering ...
-1
votes
1answer
143 views
Theorical question on encryption methods [duplicate]
Possible Duplicate:
Encryption strategies for multi users access in production systems
I would like to develop a service on wich clients would connect and retrieve informations. These ...
5
votes
1answer
181 views
Secure access to a Microsoft Access Database
I have a server set up with medical files in a Access database.
I am taking over this job from an existing guy who has vanished, so I don't know all the details of the system. I can find out specific ...
6
votes
3answers
984 views
Risk of configuring MySQL for remote access with a dynamic IP address?
I'm looking to make a MySQL database on a VPS, accessible to my home PC through cPanel. cPanel wants the domain name or IP address of the remote machine. However, with standard DSL, I have a dynamic ...
10
votes
3answers
184 views
Different MySQL Users Security Benefits
Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
4
votes
2answers
151 views
What perils are there in allowing user input of parts of an ODBC connect string?
I'm developing an application that allows user to input hostnames, database names, usernames, and passwords for database access. The application will construct a ODBC connect string by filling in the ...
3
votes
2answers
369 views
I'm Trying to Find how to Exploit my SQL Code
I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think ...
8
votes
3answers
3k views
PostgreSQL Security Audit
Could anyone provide a good resource or check-list for a security review of PostgreSQL?
17
votes
2answers
2k views
MySQL Server Hardening
Following the hardening theme....
What are some best practices, recommendations, required reading for securing MySQL.
4
votes
1answer
568 views
HIPAA Compliance or What measures would you recommend to secure PHI for devs?
I work with a company that sells medical supplies and equipment. As part of this, we retain patient information or Protected Health Information (PHI). What measures have you taken when providing ...
2
votes
2answers
439 views
Encrypting a Database's Primary Key when sent to the browser
When dealing with either an oData-based application (ADO.NET Data Services), or something that otherwise publishes the PrimaryKey, or ForeignKey to the client...
Can someone explain to me be benefits ...
7
votes
4answers
687 views
What is the right way of storing database connection strings from the security point of view?
What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
6
votes
2answers
159 views
Online SQL Server database for a Business app. Security considerations
A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...
11
votes
4answers
1k views
Does stored procedure prevent SQL Injection in postgreSQL
Is it true that Stored procedure will prevent databases to be injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injection if we only use ...
9
votes
1answer
100 views
Is there a list of default, standard or third-party “users” for Oracle
When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle.
Additionally, third-party software often has its own set of ...
