Security related aspects of databases and database access.

learn more… | top users | synonyms

4
votes
1answer
186 views

How to detect a database leak

Website keep getting hacked every day and every now and then we hear website owners react and tell "affected users that their password might had been compromised". Most sites that disclose such leaks ...
4
votes
2answers
187 views

What security risk does it mean if you have your db password and security token publicity available?

In Germany everyone is worried about a prominent political party that exposes their wp-config to the public: https://www.a***********r.de/wp-config.php How much of a security risk is that? The db, ...
4
votes
2answers
207 views

What perils are there in allowing user input of parts of an ODBC connect string?

I'm developing an application that allows user to input hostnames, database names, usernames, and passwords for database access. The application will construct a ODBC connect string by filling in the ...
4
votes
1answer
184 views

Database Security

Would having the IP address and name of my database visible to the public be a security risk? I have hosting with godaddy, a shared hosting plan. When I connect to my DB, via MS-SQL-MS, I can see the ...
4
votes
1answer
2k views

Databases in DMZ and Intranet

In a study project i have to plan a network for a small company (around 50 employees) and i am currently at the point, where i want to design the database architecture. I read that its common to have ...
4
votes
2answers
1k views

Secure yet reversible encryption for local data store

I'm working on a piece of software to store and manage records for a youth group. They've found that a lot of the time they spend on record-keeping and admin is taken up by scanning through looking ...
4
votes
1answer
2k views

Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?

I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not. I will present my findings so far here, but it will be good if you guys can confirm ...
4
votes
4answers
646 views

How to securely delete a table in MS-Access?

I have a Windows 7 computer which currently has a large working Microsoft Access 2007 database on it containing some tables with confidential data. I would like to securely delete/remove the tables ...
4
votes
2answers
170 views

Where should I store OAuth2 access tokens?

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security. However, I am not sure what the best practice is for ...
4
votes
1answer
188 views

How do banking software systems securely store account information in database?

Banking systems store account information in databases such as Oracle and databases are maintained and administered by DB administrators. The account information is stored in a table and a column of ...
4
votes
2answers
262 views

Is storing encrypted data in a database futile?

The way I see it: there are two ways to encrypt data for a web app. 1) Store a single encryption key on the server, and use it to encrypt / decrypt data at runtime. The obvious issue here is that if ...
4
votes
1answer
950 views

HIPAA: How am I required to secure PHI database access creds on my web server?

Assuming I have a database of PHI that my web application needs to access, how am I required to secure the credentials on the webserver that the web application uses to access this database? Is ...
4
votes
4answers
2k views

Database hardening techniques

So as I understand it database hardening is a process in which you remove the vulnerabilities that result from lax con-figuration options. This can sometimes compensate for exploitable vendor bugs. ...
4
votes
1answer
59 views

How do I protect the stored clients' public keys on a server?

I'm learning about security at the moment, and I want to store my clients' public keys on the server to facilitate distributing and managing those keys, my question is what are the possible ways to ...
4
votes
1answer
114 views

Best practice for direct SQL connection from DB to specific IPs on Internet

I am using AWS and looking for any comments on best practices regarding permitting connections to my DB from specific IPs on the Internet. I could give the DB a public IP and just lock down the ...
4
votes
1answer
488 views

Showing bank routing/account numbers, and storing them safely

EDIT: This is for the UK/Europe region. I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be ...
4
votes
2answers
1k views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
4
votes
1answer
2k views

Best practice for data security on a web application

I read a couple articles on privacy/security but still cannot get a clear picture of the best practice to ensure that an attacker will not be able to access users' private information. For storing ...
4
votes
1answer
204 views

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks?

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks? Reading the "What Are the Oracle Database Built-in Password Protections?" from ...
4
votes
1answer
375 views

What constitutes a Virtual Private Database?

I recently came across this term "Virtual Private Database" and I'm wondering what criteria need to be satisfied to allow use of the term. I first saw the term in an HP/Fortify doc: A virtual ...
4
votes
1answer
87 views

Safely store passwords in specific scenario

I have a specific network environment. Its a DTN(Delay Tolerant Network) network without continous connectivity, situated on the sea, where nodes are ships. There is also a server that is a part of ...
3
votes
7answers
571 views

How to provide security for passwords stored in Database? [duplicate]

Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
3
votes
4answers
198 views

Generate DB Password from license key - a good idea?

There's this web app which has a SQLServer database, and the connection string it uses to access the database is not stored in any configuration file. Rather, the designers decided it would be a good ...
3
votes
3answers
735 views

Best security practices for software development and release?

I am trying to figure out a way to limit access and also to establish processes to avoid any and all of my team members to compromise our entire production system. We have a team of 10 developers, 1 ...
3
votes
3answers
274 views

Is web application connected to a database via an application server is more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
3
votes
2answers
921 views

User authentication + database encryption with same password

I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
3
votes
2answers
569 views

I'm Trying to Find how to Exploit my SQL Code

I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think ...
3
votes
2answers
2k views

IS TDE PCI-Compliant?

According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
3
votes
1answer
6k views

Encrypting data within SQLite database in Java - How to store key?

So, a bit of context before I start may be handy. I am developing a Java desktop application which will use an SQLite database to store/process data. The application will utilize authentication to ...
3
votes
2answers
711 views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
3
votes
2answers
449 views

Are there special attack vectors for statistical databases?

Are statistical databases vulnerable to SQL injection attacks? If so, what specific kind? Can you think of an example?
3
votes
2answers
1k views

Encrypting a Database's Primary Key when sent to the browser

When dealing with either an oData-based application (ADO.NET Data Services), or something that otherwise publishes the PrimaryKey, or ForeignKey to the client... Can someone explain to me be benefits ...
3
votes
1answer
404 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
3
votes
3answers
45 views

Is there a reason to create a database user without schema privileges?

One of the common things seen people setup is database users (for use by an actual application) that only have SELECT/UPDATE/INSERT/DELETE permissions. A separate user (that additionally has ...
3
votes
2answers
62 views

Presence of table “sqlmapoutput” in PostgreSQL database

I was pentesting a client's database and saw this one table "sqlmapoutput" in one of the user created schemas. It's a PostgreSQL DBMS. and he has no idea how it came there. There was no data in the ...
3
votes
1answer
237 views

Deleting credit card information after every transaction

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every ...
3
votes
2answers
1k views

Is AES encryption vulnerable?

I was reading weaknesses in AES encryption. Unfortunately, I have a website that uses AES: Its database is almost entirely AES encrypted. Is there a real threat? Would it be worth to refactor the web ...
3
votes
2answers
604 views

How to design SIEM RFP, keeping in view large database requirements?

I need some help regarding the design of SIEM requirments. In regard to large databases, what general requirements do I need to provide in order to provide coverage related to DB security? Some of ...
3
votes
1answer
202 views

testing for 'Dangling Cursor'

While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor. I was wondering ...
3
votes
1answer
54 views

Is it safe to store billing/postal addresses?

I'm currently building a web application in Ruby on Rails. Is it safe to store billing/postal addresses in a database? What could happen if the data were compromised? Are there any standard ...
3
votes
2answers
98 views

Encrypt DB Fields preserving search functionality

I would like to protect sensitive information stored on a Postgresql database, but I would not like to encrypt it all. The idea is to encrypt only those fields which hold sensitive information. I was ...
3
votes
2answers
418 views

Securing a script to prevent database from being exposed

We have an Ioncube encoded script running on an Apache web server which stores customer confidential information in a MySQL database. We have configured the script to run under its own account using ...
3
votes
1answer
441 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
3
votes
1answer
113 views

Should I make my api calls to update users contain a password or hashed auth key?

So Im creating an API for an app that in the backend involves updating users, deleting users, and some other user related stuff. Im using the slim framework and I was wondering when the user wants to ...
3
votes
1answer
252 views

How to sniff [possibly encrypted] TDS protocol data from the host the client application is installed on?

Let's say, there is an .NET application on a windows 7 host where I have administrator's access rights. The application works with remote MS-SQL server which I don't control, it also seems that the ...
3
votes
1answer
333 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
3
votes
1answer
2k views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
3
votes
1answer
402 views

Theory about split data in several isolated (different physical server) DBMS to gain in security?

Suppose the following scenario: 1- A web app (on WEBSERVER1) and its database (on DBMS1) having very sensible information deployed in the same physical server (lets said that for simplification). ...
3
votes
2answers
148 views

Local Network Data Sync and Access Log

We have some confidential data for our research. Currently, we use an encrypted hard drive for storing the data and any researcher using the data takes it off the drive. However, we do not have any ...
3
votes
3answers
223 views

How to know who I am protecting database information from?

I am trying to determine whether I need to use transparent database encryption (TDE) or encryption at web server to protect data in a database. Here are a couple articles I've read on the subject, ...