Security related aspects of databases and database access.

learn more… | top users | synonyms

3
votes
2answers
121 views

Local Network Data Sync and Access Log

We have some confidential data for our research. Currently, we use an encrypted hard drive for storing the data and any researcher using the data takes it off the drive. However, we do not have any ...
3
votes
3answers
184 views

How to know who I am protecting database information from?

I am trying to determine whether I need to use transparent database encryption (TDE) or encryption at web server to protect data in a database. Here are a couple articles I've read on the subject, ...
2
votes
3answers
499 views

Why are triggers not often used to secure a database?

I did an intern for a company becoming PCI compliant and instead of using triggers to prevent SQL injection, I went through 1000s (if not more) lines of web-app code and called functions every time ...
2
votes
4answers
2k views

If a hacker were to compromise a GMail database

Assuming the systems that store the Gmail database is compromised what is preventing them from reading everyone's emails by looking at the data in the database? I assume nothing, and in order for ...
2
votes
4answers
266 views

“Out of the box” database security

When you install a RDBMS (say, PostgreSQL) and create a database, without taking any additional steps, what can you assume about the security/confidentiality of the data? I mean, is it encrypted by ...
2
votes
2answers
2k views

LDAP vs MySQL for Usernames and Passwords

I understand the LDAP databases are more secure, but is it always necessary to use LDAP instead of MySQL for usernames and passwords?
2
votes
2answers
566 views

IS TDE PCI-Compliant?

According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
2
votes
2answers
461 views

Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO

I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from ...
2
votes
2answers
630 views

Encrypting a Database's Primary Key when sent to the browser

When dealing with either an oData-based application (ADO.NET Data Services), or something that otherwise publishes the PrimaryKey, or ForeignKey to the client... Can someone explain to me be benefits ...
2
votes
2answers
118 views

Database security: Remove superuser role

I've recently heard on some IT-SEC conference, that good idea to secure database (probably against privilege-escalation attack) is to remove superuser role, and leave only user roles. I imagine that ...
2
votes
2answers
316 views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
2
votes
3answers
307 views

What things should a penetration tester know about databases?

I want to start learning about databases from a penetration tester's perspective and I would like to know what things will be useful on the long run. Also do you know any good books to kickstart my ...
2
votes
2answers
1k views

how long does it take to brute force varying encryption standards?

Let's say I want to encrypt information in a database. What would be the best encryption algorithm to use and why. I was thinking AES, since it's widely used as a government standard, but if the ...
2
votes
2answers
303 views

MySQL Access Control?

I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
2
votes
2answers
106 views

Is this logic security / performance wise or not?

Each physical user will have about 20 tables in the database. When a new user registers, another 20 tables will be created with access only for their new MySQL account. Data does not have to be ...
2
votes
1answer
1k views

How to secure MySQL based web session data table?

I have the following MySQL session schema: CREATE TABLE `SessionData` ( `id` varchar(50) COLLATE utf8_unicode_ci NOT NULL, `data` text COLLATE utf8_unicode_ci, `date` datetime DEFAULT NULL, ...
2
votes
1answer
706 views

iOS/Android authentication and security

Here is what I am trying to do and can anyone provide some best practice advice for authentication and security? Each user will have their own private database on the cloud. He will have his local ...
2
votes
2answers
128 views

How can I protect a client's mirror of the server's database?

The scenario is as follows: There are clients that users can access and work with. These clients can be online or offline. There is a central database on a server, holding all the authorization ...
2
votes
4answers
849 views

Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID

Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID" I know that not good to have clear text password in scripts (there is no alternative at the moment). But question is the ...
2
votes
1answer
30 views

/WEB-INF/web.xml showing MySQL credentials?

I found the file /WEB-INF/web.xml on a domain I'm associated with. The XML file contains: <database> <jndi-name>jdbc/mysql</jndi-name> <driver> ...
2
votes
1answer
258 views

Best practice for data security on a web application

I read a couple articles on privacy/security but still cannot get a clear picture of the best practice to ensure that an attacker will not be able to access users' private information. For storing ...
2
votes
2answers
69 views

How do vulnerability reports work?

I'm really interested in IT security and I would like to know how vulnerability reports work. Is there a central database for those things? I often see CVE-XXX-XXX on disclosures, but I don't ...
2
votes
1answer
132 views

Can we reverse engineer binlog with row format to make MySQL AES_ENCRYPT visible?

Suppose if I am using the mysql database based encryption using AES_ENCRYPT function & insert records, is it possible to decode the row formatted binlogs generated by MySQL to obtain the actual ...
2
votes
1answer
118 views

Is Creating a Restricted Database User in Microsoft SQL Server Decent Protocol

Forgive me for the heavy metaphor but it's a situation's complexity kind of goes over my head. Assume I'm Leonard Shelby (My short term memory only lasts 5 minutes). I'm a freelancer that reads ...
2
votes
1answer
522 views

DRY API Authentication Design Between Services

I am creating an API service that is going to require authentication. this will be the first part of a project that will include a front-end service for my website, and also open up the api for 3rd ...
2
votes
1answer
74 views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
2
votes
1answer
74 views

PCI Complient Storing Credit Card Data On Offline Tablet

I have a client that does work in rural areas where there are no cellphone or internet connections. They need a way to take credit card information in the field, bring it back to their office where ...
2
votes
0answers
338 views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile website to make my service also available for other mobile operating systems. Now, ...
2
votes
0answers
412 views

Where to store sensitive client details (MYSQL DB credentials) [duplicate]

I have a security related question about storing some client information - specifically their database login credentials. My app works based on the client and so the database details need to be set ...
1
vote
3answers
398 views

Is this approach of securing cookie secure?

I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
1
vote
1answer
169 views

Limiting database security

A number of texts signify that the most important aspects offered by a DBMS are availability, integrity, and secrecy. As part of a homework assignment I have been tasked with mentioning attacks which ...
1
vote
3answers
225 views

For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?

I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
1
vote
1answer
473 views

How to secure database table of users for an application?

I am working on a Windows application that utilizes a MySQL database for its user authentication and data storage. Within the application, the highest level of user (Administrator) can create and ...
1
vote
3answers
139 views

How can I prevent my database from being compromised if my CakePHP app is compromised?

I have an app server hosting a CakePHP app and a database server hosting the databases. The servers are physically separate. The databases contain encrypted sensitive information. The encryption keys ...
1
vote
1answer
58 views

PCI DSS compliance for storing PAN and PII in multi-tenant environment

I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the ...
1
vote
1answer
78 views

Security risks if a server in not supported anymore

I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements. What are the security risks that we might ...
1
vote
1answer
59 views

How to restrict access to a resource based on frequency of access?

I want to restrict access to a particular resource based on time (configurable). So suppose user A has time t configured from him. He can access the resource only once every t time units. The values ...
1
vote
2answers
248 views

Least insecure way to encrypt a field in the database so that it can still be included in queries

I have a table where all columns need to be encrypted (aside from the PK). This will be achieved using AES at the application level. However there is one particular field that needs to remain ...
1
vote
3answers
3k views

Database field type for password storage?

In the past I used varchar(255) for storing hashed passwords (no salt). Is this still enough? Or are longer fields required?
1
vote
1answer
556 views

Storing US employer identification number (EIN / FEIN) in a database

What are considerations for storing a United States Employer Identification Number (EIN / FEIN) in a database? Is this considered sensitive information along the lines of an SSN? Are there legal ...
1
vote
1answer
49 views

Multi Tenant Database - HIPAA

We are planning to develop a EHR/Billing Software and we are aware about HIPAA rules and regulations. Our current application architecture using a shared database with all client's(Provider/Practice) ...
1
vote
1answer
191 views

What does Gazzang zNcrypt actually protect against?

In an effort to increase security of our website, I'm reading up on Gazzang zNcrypt, which claims to protect data in databases from breaches. Technically, it seems to do filesystem encryption. As far ...
1
vote
2answers
159 views

Main requirements to secure my Application in any database related features

I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm ...
1
vote
1answer
61 views

Hybrid Encryption System - Is this unnecessary in this case? [closed]

I have a column in my database that I need to encrypt. The column can contain any arbitrary data. What I am thinking is to generate a public and private key pair first. Store the public key in a ...
1
vote
1answer
113 views

Isolating database? Is it possible?

I have been assigned CTF project for IT Security for my final year project in school. We are planning to have a flag that are base on SQL injection but for the user to overcome the challenge, they ...
1
vote
1answer
250 views

Authentication for a batch script

It seems amazing that there is no industry accepted best practice for this problem yet (or maybe just one I'm not aware of): What is the most secure way for a batch script, a program needing to ...
1
vote
1answer
188 views

users avatar names based on Primary Key, is it safe?

We upload users avatar with their primary key name. avatars name are 1.jpg,2.jpg,3.jpg,... according to their primary key. We implemented this to omit avatar field from database, instead with use ...
1
vote
1answer
46 views

Cracking encrypted SQB databases

I've recovered a .SQB SQL database backup file from a backup server and do not have the password. As I do not have the password available to me, I'm looking to determine what type of encryption is ...
1
vote
1answer
38 views

How do I store a user's secret key on a server?

I'm learning about security at the moment and one thing I'd like to try out is having a key server distribute keys to clients that will allow them to securely save and read data locally. My basic ...
1
vote
0answers
11 views

Specification Document

I have been asked to research on a certain database then write down a specification document which covers Authentication, Authorization and Encryption. Has anyone ever come across such a ...