Security related aspects of databases and database access.

learn more… | top users | synonyms

0
votes
0answers
75 views

Private data encryption in database in case there is no password

I am currently investigating the architecture of the secure, but user friendly service, which combines storing of sensitive private data together with simple authorization procedure. The approach ...
-1
votes
2answers
138 views

How does salting increase security? [duplicate]

I'm currently going through a course on software security. I've recently been introduced to the idea of password salting, where a random value is concatenated to a password prior to being hashed and ...
0
votes
1answer
187 views

Securing user postal address in a database?

I've been assigned a web project that deals with shipping goods between two parties. I am unsure what a secure database scheme (if any) would be for storing the recipient's postal address and whether ...
1
vote
0answers
116 views

What tools on unix can scan sql dumps for malware? [closed]

I'm attempting to check for malware, spam and any kind of injection/exploitation on a sql dump that has been provided and was wondering what kind of tools are there already in place to help with this? ...
2
votes
4answers
92 views

For all the hassle it brings, why isn't password management handled by the database?

Right now, we might do something like password varchar(72), when defining a password column, with for example BCrypt. But there's a lot of folks that don't do this very effectively. Maybe they just ...
0
votes
1answer
193 views

Hipaa Compliant Server

I have an instance in Amazon EC2 and need to be HIPAA compliant. I have two questions, Should I need to do a block level encryption of the database storage. Should I need to encrypt sensitive data ...
18
votes
4answers
2k views

Is this verbose error message on the DOT website a security issue?

I was looking for a form on the US Department of Transportations website, and I came to a page that gave me an error, with a full debug report and stack trace. Hopefully, you can get the same result ...
2
votes
1answer
150 views

Good resources on ACH/banking details security?

In our web application, we allow customers to enter their bank account information as a method of payment (account number, routing number, bank name). This information goes nowhere at all; it's up to ...
4
votes
2answers
164 views

What security risk does it mean if you have your db password and security token publicity available?

In Germany everyone is worried about a prominent political party that exposes their wp-config to the public: https://www.a***********r.de/wp-config.php How much of a security risk is that? The db, ...
0
votes
3answers
445 views

What security issues will I face with outsourced VPS server?

Our small comapny wants to launch a paid service, hosted on the outsourced VPS server. The obvious risk is that the machine is physically not in our office and that possibly the database could be ...
3
votes
1answer
1k views

Databases in DMZ and Intranet

In a study project i have to plan a network for a small company (around 50 employees) and i am currently at the point, where i want to design the database architecture. I read that its common to have ...
1
vote
3answers
306 views

Is this a secure function for checking if a user has not stolen a session cookie?

As an exercise for class, I'm creating a class that manages user sessions. The session details are stored in a database and also there is a $_SESSION[user_id] variable to carry in between pages. The ...
17
votes
3answers
852 views

Protecting Health Care Database

I am doing a minor project on information security in which i am implementing techniques listed below to protect a HEALTH CARE database. Preventing SQL Injection (using prepared ...
0
votes
1answer
185 views

Secure distributed storing and querying of [medical] data?

Comparing ways of distributing and securely storing and querying structured and schemaless data. Currently I am using MongoDB, but am looking into (Postgres|MySQL)&CryptDB, Cassandra and others. ...
3
votes
2answers
587 views

Is AES encryption vulnerable?

I was reading weaknesses in AES encryption. Unfortunately, I have a website that uses AES: Its database is almost entirely AES encrypted. Is there a real threat? Would it be worth to refactor the web ...
0
votes
2answers
188 views

Asymmetric Data Storage+ No-Hash Password Storage?

Edit: removed a part of the original question; I'll break it down in a different post. I am following @Polynomial's answer to store information in a database. Here are my requirements: Only the ...
1
vote
0answers
46 views

Storing Tenants Cloud Keys In a Database

Imagine you are building a public service where you need to store the customer's cloud credentials(like their aws secret and access keys) in your database to regularly use by your backend services in ...
0
votes
1answer
511 views

How does Shodan crawl internet-connected devices?

I wonder how Shodan crawls internet-connected devices and adds them to its database. I know Google, for instance, finds new websites by following links in websites it already found, but that strategy ...
1
vote
0answers
192 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
1answer
131 views

Cracking encrypted SQB databases

I've recovered a .SQB SQL database backup file from a backup server and do not have the password. As I do not have the password available to me, I'm looking to determine what type of encryption is ...
3
votes
1answer
252 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
2
votes
1answer
158 views

/WEB-INF/web.xml showing MySQL credentials?

I found the file /WEB-INF/web.xml on a domain I'm associated with. The XML file contains: <database> <jndi-name>jdbc/mysql</jndi-name> <driver> ...
3
votes
1answer
2k views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
3
votes
3answers
741 views

How do I store a user's secret key on a server?

I'm learning about security at the moment and one thing I'd like to try out is having a key server distribute keys to clients that will allow them to securely save and read data locally. My basic ...
2
votes
0answers
25 views

Specification Document

I have been asked to research on a certain database then write down a specification document which covers Authentication, Authorization and Encryption. Has anyone ever come across such a ...
1
vote
1answer
429 views

Multi Tenant Database - HIPAA

We are planning to develop a EHR/Billing Software and we are aware about HIPAA rules and regulations. Our current application architecture using a shared database with all client's(Provider/Practice) ...
-2
votes
1answer
268 views

What are common problems that reveal PHP code? [closed]

What is the best method for securing PHP scripts that contain database passwords? From what I've read, PHP can be revealed when an error occurs and is not caught. Is there any way to reveal PHP by ...
0
votes
1answer
407 views

Which approach to encrypting data on a per-user basis is more secure?

As a bit of a thought experiment, I've been thinking through how one might design a web application where a user's data (say, from a form on a webpage) is stored, encrypted, on the server, using a ...
2
votes
1answer
308 views

Uploading Executable Files

Using proxy software, I was able to bypass a file upload control file-checking for an asp.net system I am pen testing. I noticed they are saving the file into the database as bytes, and it is ...
1
vote
1answer
339 views

Are there any secure ways to store the secret key used in a TOTP scheme?

I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash ...
2
votes
2answers
175 views

Store which parts of an IP address, for user to remain anonymous?

I'm thinking about building a very anonymous forum, where people can comment and upvote each other's comments anonymously. People are supposed to remain anonymous even if the forum's database contents ...
0
votes
2answers
172 views

What is truly unbreakable these days? [closed]

Just very curious, count my knowledge in cryptography, algorithms, and security in general as non-existent. Now I am aware that this might be a VERY broad question, but here it goes. What is the most ...
0
votes
1answer
381 views

Application Server <-> Database Firewall [closed]

What threats can a firewall between an application server and a database server mitigate that would not otherwise be mitigated when both the database server and application server are behind the same ...
4
votes
3answers
314 views

What is a good rebuttal to users who wish all data WITHIN Db be encrypted?

I am building an application in VB.NET (WinForms) utilizing SQL Server 2008 R2 as a Backend. The application is to track employee's money they defer each paycheck, or month, to deposit into separate ...
1
vote
1answer
333 views

Should I encrypt Long-lived Facebook Access Token when storing them in my DB?

I own an application that grabs some Long-Lived Facebook Access token, in order to be use later according to the corresponding logged user. Should I need to encrypt them before storing them, to avoid ...
1
vote
0answers
65 views

Secure 'pg_settings' for PostgreSQL

I have been looking for some kind of hardening guide towards PostgreSQL which I can use for a security audit of a PostgreSQL DB. I came across this url, have checked the same. Anything more to this?: ...
0
votes
1answer
215 views

Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [closed]

As part of hardening a MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed. For a server that is serving only as a MySQL server, what services and ...
0
votes
2answers
429 views

What are the Standard Practices for Securely Storing Encryption Keys in Databases

I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ? To add a ...
18
votes
4answers
3k views

What can an attacker do if he knew my database credentials?

If an attacker knows my database username and password, what can he possibly do if he doesn't have access to my server? Let's say my database is using Microsoft SQL Server. Is there a way he can use ...
2
votes
3answers
481 views

How can I prevent my database from being compromised if my CakePHP app is compromised?

I have an app server hosting a CakePHP app and a database server hosting the databases. The servers are physically separate. The databases contain encrypted sensitive information. The encryption keys ...
0
votes
1answer
255 views

A Question about Database Encryption [closed]

I've been looking around for an answer to this for some time now and I felt that this place would be a good venue to ask this. How can one improve the security in a MySQL database? The database that ...
3
votes
1answer
1k views

Best practice for data security on a web application

I read a couple articles on privacy/security but still cannot get a clear picture of the best practice to ensure that an attacker will not be able to access users' private information. For storing ...
2
votes
1answer
235 views

PCI DSS compliance for storing PAN and PII in multi-tenant environment

I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the ...
12
votes
4answers
7k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
3
votes
1answer
190 views

PCI Complient Storing Credit Card Data On Offline Tablet

I have a client that does work in rural areas where there are no cellphone or internet connections. They need a way to take credit card information in the field, bring it back to their office where ...
2
votes
2answers
90 views

How do vulnerability reports work?

I'm really interested in IT security and I would like to know how vulnerability reports work. Is there a central database for those things? I often see CVE-XXX-XXX on disclosures, but I don't ...
2
votes
2answers
263 views

How to securely provide data to a web server using a data warehouse?

We have a data warehouse that stores prices for our products. Once every business day, new data points are added representing the day's price for each product. On the website, a user sees this ...
5
votes
2answers
955 views

Encrypt user data when they log in with Facebook, Gmail, etc

I made a login system. The user can login by: using a normal email / password (bcrypted). using a service like facebook, gmail, etc. So far so good. Now I want to store sensitive information (ftp ...
1
vote
0answers
181 views

Security considerations for SQL database with employee data in blob field

With elevated SQL permissions, I am able to export a blob and retrieve a pdf with employee data (SSN) from a SQL Server database. This database is a backend to a third party web app we use internally ...
2
votes
2answers
1k views

What does Gazzang zNcrypt actually protect against?

In an effort to increase security of our website, I'm reading up on Gazzang zNcrypt, which claims to protect data in databases from breaches. Technically, it seems to do filesystem encryption. As far ...