Security related aspects of databases and database access.

learn more… | top users | synonyms

4
votes
2answers
204 views

What perils are there in allowing user input of parts of an ODBC connect string?

I'm developing an application that allows user to input hostnames, database names, usernames, and passwords for database access. The application will construct a ODBC connect string by filling in the ...
4
votes
1answer
165 views

Database Security

Would having the IP address and name of my database visible to the public be a security risk? I have hosting with godaddy, a shared hosting plan. When I connect to my DB, via MS-SQL-MS, I can see the ...
4
votes
1answer
6k views

Encrypting data within SQLite database in JAVA - How to store key?

So, a bit of context before I start may be handy. I am developing a JAVA desktop application which will use an SQLite database to store/process data. The application will utilize authentication to ...
4
votes
1answer
2k views

Databases in DMZ and Intranet

In a study project i have to plan a network for a small company (around 50 employees) and i am currently at the point, where i want to design the database architecture. I read that its common to have ...
4
votes
2answers
1k views

Secure yet reversible encryption for local data store

I'm working on a piece of software to store and manage records for a youth group. They've found that a lot of the time they spend on record-keeping and admin is taken up by scanning through looking ...
4
votes
1answer
2k views

Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?

I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not. I will present my findings so far here, but it will be good if you guys can confirm ...
4
votes
4answers
627 views

How to securely delete a table in MS-Access?

I have a Windows 7 computer which currently has a large working Microsoft Access 2007 database on it containing some tables with confidential data. I would like to securely delete/remove the tables ...
4
votes
2answers
62 views

Where should I store OAuth2 access tokens?

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security. However, I am not sure what the best practice is for ...
4
votes
1answer
140 views

How do banking software systems securely store account information in database?

Banking systems store account information in databases such as Oracle and databases are maintained and administered by DB administrators. The account information is stored in a table and a column of ...
4
votes
2answers
234 views

Is storing encrypted data in a database futile?

The way I see it: there are two ways to encrypt data for a web app. 1) Store a single encryption key on the server, and use it to encrypt / decrypt data at runtime. The obvious issue here is that if ...
4
votes
1answer
893 views

HIPAA: How am I required to secure PHI database access creds on my web server?

Assuming I have a database of PHI that my web application needs to access, how am I required to secure the credentials on the webserver that the web application uses to access this database? Is ...
4
votes
4answers
2k views

Database hardening techniques

So as I understand it database hardening is a process in which you remove the vulnerabilities that result from lax con-figuration options. This can sometimes compensate for exploitable vendor bugs. ...
4
votes
1answer
59 views

How do I protect the stored clients' public keys on a server?

I'm learning about security at the moment, and I want to store my clients' public keys on the server to facilitate distributing and managing those keys, my question is what are the possible ways to ...
4
votes
1answer
1k views

Best practice for data security on a web application

I read a couple articles on privacy/security but still cannot get a clear picture of the best practice to ensure that an attacker will not be able to access users' private information. For storing ...
4
votes
1answer
187 views

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks?

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks? Reading the "What Are the Oracle Database Built-in Password Protections?" from ...
4
votes
1answer
368 views

What constitutes a Virtual Private Database?

I recently came across this term "Virtual Private Database" and I'm wondering what criteria need to be satisfied to allow use of the term. I first saw the term in an HP/Fortify doc: A virtual ...
4
votes
3answers
961 views

Anonymiszing sensitive data in MySQL DB while retaining searchability [closed]

I have a MySQL database that stores sensitive (personal) data about individuals; and have been tasked with ensuring that this data is encrypted in some way to protect the individuals and their data if ...
3
votes
7answers
562 views

How to provide security for passwords stored in Database? [duplicate]

Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
3
votes
4answers
195 views

Generate DB Password from license key - a good idea?

There's this web app which has a SQLServer database, and the connection string it uses to access the database is not stored in any configuration file. Rather, the designers decided it would be a good ...
3
votes
3answers
651 views

Best security practices for software development and release?

I am trying to figure out a way to limit access and also to establish processes to avoid any and all of my team members to compromise our entire production system. We have a team of 10 developers, 1 ...
3
votes
3answers
180 views

Is web application connected to a database via an application server is more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
3
votes
2answers
883 views

User authentication + database encryption with same password

I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
3
votes
2answers
556 views

I'm Trying to Find how to Exploit my SQL Code

I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think ...
3
votes
2answers
2k views

IS TDE PCI-Compliant?

According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
3
votes
2answers
665 views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
3
votes
2answers
433 views

Are there special attack vectors for statistical databases?

Are statistical databases vulnerable to SQL injection attacks? If so, what specific kind? Can you think of an example?
3
votes
2answers
1k views

Encrypting a Database's Primary Key when sent to the browser

When dealing with either an oData-based application (ADO.NET Data Services), or something that otherwise publishes the PrimaryKey, or ForeignKey to the client... Can someone explain to me be benefits ...
3
votes
2answers
519 views

Web server interaction with a database server

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
3
votes
1answer
133 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
3
votes
2answers
35 views

Presence of table “sqlmapoutput” in PostgreSQL database

I was pentesting a client's database and saw this one table "sqlmapoutput" in one of the user created schemas. It's a PostgreSQL DBMS. and he has no idea how it came there. There was no data in the ...
3
votes
1answer
207 views

Deleting credit card information after every transaction

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every ...
3
votes
2answers
931 views

Is AES encryption vulnerable?

I was reading weaknesses in AES encryption. Unfortunately, I have a website that uses AES: Its database is almost entirely AES encrypted. Is there a real threat? Would it be worth to refactor the web ...
3
votes
2answers
583 views

How to design SIEM RFP, keeping in view large database requirements?

I need some help regarding the design of SIEM requirments. In regard to large databases, what general requirements do I need to provide in order to provide coverage related to DB security? Some of ...
3
votes
1answer
197 views

testing for 'Dangling Cursor'

While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor. I was wondering ...
3
votes
1answer
50 views

Is it safe to store billing/postal addresses?

I'm currently building a web application in Ruby on Rails. Is it safe to store billing/postal addresses in a database? What could happen if the data were compromised? Are there any standard ...
3
votes
2answers
91 views

Encrypt DB Fields preserving search functionality

I would like to protect sensitive information stored on a Postgresql database, but I would not like to encrypt it all. The idea is to encrypt only those fields which hold sensitive information. I was ...
3
votes
2answers
408 views

Securing a script to prevent database from being exposed

We have an Ioncube encoded script running on an Apache web server which stores customer confidential information in a MySQL database. We have configured the script to run under its own account using ...
3
votes
1answer
303 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
3
votes
1answer
111 views

Should I make my api calls to update users contain a password or hashed auth key?

So Im creating an API for an app that in the backend involves updating users, deleting users, and some other user related stuff. Im using the slim framework and I was wondering when the user wants to ...
3
votes
1answer
79 views

Best practice for direct SQL connection from DB to specific IPs on Internet

I am using AWS and looking for any comments on best practices regarding permitting connections to my DB from specific IPs on the Internet. I could give the DB a public IP and just lock down the ...
3
votes
1answer
229 views

How to sniff [possibly encrypted] TDS protocol data from the host the client application is installed on?

Let's say, there is an .NET application on a windows 7 host where I have administrator's access rights. The application works with remote MS-SQL server which I don't control, it also seems that the ...
3
votes
1answer
313 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
3
votes
1answer
2k views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
3
votes
1answer
390 views

Theory about split data in several isolated (different physical server) DBMS to gain in security?

Suppose the following scenario: 1- A web app (on WEBSERVER1) and its database (on DBMS1) having very sensible information deployed in the same physical server (lets said that for simplification). ...
3
votes
2answers
148 views

Local Network Data Sync and Access Log

We have some confidential data for our research. Currently, we use an encrypted hard drive for storing the data and any researcher using the data takes it off the drive. However, we do not have any ...
3
votes
3answers
221 views

How to know who I am protecting database information from?

I am trying to determine whether I need to use transparent database encryption (TDE) or encryption at web server to protect data in a database. Here are a couple articles I've read on the subject, ...
3
votes
1answer
804 views

DRY API Authentication Design Between Services

I am creating an API service that is going to require authentication. this will be the first part of a project that will include a front-end service for my website, and also open up the api for 3rd ...
3
votes
0answers
339 views

SQL security - ACID transactions and locking to prevent financial fraud (timing attack?) [closed]

I am trying to prevent something similar to this from happening: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ Basically the financial exchange was using non-ACID ...
3
votes
0answers
174 views

Proper credit card encryption for use in a blacklist

I have a general encryption question. I have read through many of the encryption related questions here and I can't find any specifically addressing my concern. This is the hypothetical scenario: I ...
3
votes
1answer
227 views

PCI Complient Storing Credit Card Data On Offline Tablet

I have a client that does work in rural areas where there are no cellphone or internet connections. They need a way to take credit card information in the field, bring it back to their office where ...