Security related aspects of databases and database access.
4
votes
1answer
117 views
testing for 'Dangling Cursor'
While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor.
I was wondering ...
-1
votes
1answer
143 views
Theorical question on encryption methods [duplicate]
Possible Duplicate:
Encryption strategies for multi users access in production systems
I would like to develop a service on wich clients would connect and retrieve informations. These ...
12
votes
3answers
1k views
When using AES and CBC, can the IV be a hash of the plaintext?
[Originally on programmers.stackexchange.com with title: Can you encrypt with AES+CBC and search the encrypted data]
Basically, I'm going to go with Advanced Encryption Standard with either ...
5
votes
1answer
181 views
Secure access to a Microsoft Access Database
I have a server set up with medical files in a Access database.
I am taking over this job from an existing guy who has vanished, so I don't know all the details of the system. I can find out specific ...
7
votes
1answer
379 views
What evaluation criteria would you use for an Oracle scanning tool?
What evaluation criteria would you use to select the right Oracle scanning tool?
Context:
To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security ...
6
votes
3answers
987 views
Risk of configuring MySQL for remote access with a dynamic IP address?
I'm looking to make a MySQL database on a VPS, accessible to my home PC through cPanel. cPanel wants the domain name or IP address of the remote machine. However, with standard DSL, I have a dynamic ...
41
votes
6answers
6k views
SQL injection — but why isn't escape quotes safe anymore?
I haven't seen this question asked, and feel it's a valuable bit of information to have, especially because this is a huge source of mystery and confusion.
Raw SQL
When you're writing SQL -- for ...
10
votes
3answers
185 views
Different MySQL Users Security Benefits
Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
10
votes
3answers
3k views
Encrypting with Mongo
How can I achieve the following goals?
All compute and storage to be located in the cloud.
Encryption in transit of all data between web nodes and db nodes running MongoDB.
How to set up tunnels? ...
4
votes
2answers
151 views
What perils are there in allowing user input of parts of an ODBC connect string?
I'm developing an application that allows user to input hostnames, database names, usernames, and passwords for database access. The application will construct a ODBC connect string by filling in the ...
8
votes
6answers
4k views
xp_cmdshell: should it ever be used?
Can 'xp_cmdshell' ever be used safely within a stored proc and are there any situations for which there really is no other option? In other words, should it's useage within a stored proc always be ...
3
votes
2answers
370 views
I'm Trying to Find how to Exploit my SQL Code
I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think ...
8
votes
3answers
3k views
PostgreSQL Security Audit
Could anyone provide a good resource or check-list for a security review of PostgreSQL?
4
votes
1answer
570 views
HIPAA Compliance or What measures would you recommend to secure PHI for devs?
I work with a company that sells medical supplies and equipment. As part of this, we retain patient information or Protected Health Information (PHI). What measures have you taken when providing ...
17
votes
2answers
2k views
MySQL Server Hardening
Following the hardening theme....
What are some best practices, recommendations, required reading for securing MySQL.
2
votes
2answers
443 views
Encrypting a Database's Primary Key when sent to the browser
When dealing with either an oData-based application (ADO.NET Data Services), or something that otherwise publishes the PrimaryKey, or ForeignKey to the client...
Can someone explain to me be benefits ...
11
votes
4answers
1k views
Does stored procedure prevent SQL Injection in postgreSQL
Is it true that Stored procedure will prevent databases to be injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injection if we only use ...
6
votes
2answers
159 views
Online SQL Server database for a Business app. Security considerations
A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...
7
votes
4answers
689 views
What is the right way of storing database connection strings from the security point of view?
What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
9
votes
1answer
100 views
Is there a list of default, standard or third-party “users” for Oracle
When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle.
Additionally, third-party software often has its own set of ...
8
votes
2answers
618 views
Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code
Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality.
Apart from the generic arguments about 'security through obscurity' are there ...
