Security related aspects of databases and database access.

learn more… | top users | synonyms (1)

2
votes
1answer
211 views

Hiding remote database credentials in application

If I'm building an application that connects to a remote database, where should I hide the credentials? I've seen many suggest that you go through a web-application and use POST and GET requests to ...
24
votes
4answers
22k views

Is it generally a bad idea to encrypt database fields?

I work on a tiny company, it's literally me (the programmer) and the owner. The owner has asked me to encrypt several fields in a database to protect the customers data. This is a web application that ...
3
votes
2answers
1k views

Is AES encryption vulnerable?

I was reading weaknesses in AES encryption. Unfortunately, I have a website that uses AES: Its database is almost entirely AES encrypted. Is there a real threat? Would it be worth to refactor the web ...
0
votes
1answer
146 views

Web app and database on same server, what is benefit of encrypting database data?

If a web app and a database are on the same server, what is the security benefit of encrypting database data? Obviously passwords should be hashed either way. I assume that if an attacker can ...
2
votes
3answers
141 views

How could a shared password database be implemented?

In the traditional form, a password database is similar to any other database file, except the contents are encrypted using a key derived from a passphrase entered by the user. The user enters their ...
2
votes
4answers
5k views

LDAP vs MySQL for Usernames and Passwords

I understand the LDAP databases are more secure, but is it always necessary to use LDAP instead of MySQL for usernames and passwords?
0
votes
2answers
60 views

Which of these DBMS offers the lowest security for SQLI? [closed]

Which of these DBMS offers lowest security for SQLI? Oracle, MYSQL, SQL Server, ProstgreSQL or DB2? Why? Could you explain to me, why some are more vunerable to SQLI?
0
votes
2answers
207 views

Encrypt database records to be accessed by multiple users

I want to encrypt serialised customer details and store in a database to protect against attacks where the attacker has access to the raw database records. The records then need to be accessible by ...
0
votes
1answer
222 views

Securing user postal address in a database?

I've been assigned a web project that deals with shipping goods between two parties. I am unsure what a secure database scheme (if any) would be for storing the recipient's postal address and whether ...
1
vote
1answer
266 views

Encrypted quiz data in PHP and JS

I'm developing a quiz with which you can win a few cool prizes. Therefore I'm afraid, that someone might try to hack/manipulate it. All participants have to be logged in and the website takes 15 ...
2
votes
2answers
360 views

High level design for secure web application

I'm looking for some advise on designing a secure web app for storing passwords. Why reinvent the wheel? Because I don't trust a 3rd party with all of my passwords. Here are my thoughts: There are ...
18
votes
3answers
2k views

Knowing when there has been a data breach from your database

How do companies know when there has been a data breach? For example, do they monitor event logs for login audits or do they wait until a paste is made of their data in a pastebin type site? Is it ...
0
votes
1answer
179 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
0
votes
2answers
64 views

Is authenticating via the database secure

Sorry for this probably noobish question. So far, I've read password comparison/verification is implicitly understood to be made on the application layer and not in the database. For example in PHP, ...
0
votes
2answers
93 views

What is the severity if someone read the ConnectionStrings_Prod.config?

I was doing an pen test in a website and the programmer did a big mistake and I was able to read any file. So I read the web.config and see the password for database was in ...
2
votes
3answers
249 views

If a phone is encrypted at a platform storage level do I need to encrypt my data stored on it?

I am writing a mobile app which would be expected to store sensitive data. It needs to be stored for offline use. I am wondering now that Android and iOS provide encryption at rest do I need to ...
0
votes
1answer
259 views

How to secure sensitive data in application with message queue

Currently we are creating one small service, where we are using some sensitive data from users(not worth zillions but to me it is like password). The idea is that application itself only inserts this ...
0
votes
3answers
908 views

My site was hacked and the attacker got data from the config file [closed]

A few days ago my website was hacked. I found out that the 'hacker' ran queries directly into the database, so he somehow got access to my database credentials. I'm using laravel 4 and the config ...
7
votes
2answers
310 views

Privacy violation even when queries with too few results are rejected

I was reading a Computing security book1 and saw a question regarding database security and privacy. I can't quite figure out the answer, so I thought I will ask here. One approach to ensure ...
17
votes
5answers
3k views

Is sending plaintext passwords to a SQL Server database a security risk?

I have a database which has stored procedures which take plaintext passwords. It hashes them and inserts them into the DB. If an attacker has access to the DB connection, it is possible to intercept ...
4
votes
1answer
197 views

Database Security

Would having the IP address and name of my database visible to the public be a security risk? I have hosting with godaddy, a shared hosting plan. When I connect to my DB, via MS-SQL-MS, I can see the ...
1
vote
2answers
91 views

What do we have to keep in mind when opening up our data to a third party?

We have a database with pictures (amongst other things). We have a few apps that can connect to this database via a php webservice (send https requests to a php file to retrieve stuff from the db and ...
2
votes
2answers
603 views

Web server interaction with a database server

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
1
vote
0answers
272 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
0
votes
1answer
170 views

PCI Compliant Secure Vault Design and Implementation

I often see the phrase “Secure Vault” in PCI DSS documentations and I want to know if a “Secure Vault” must be a highly protected file with sophisticated technologies stored on a very secure hardware ...
1
vote
2answers
262 views

Separate database column for salt

Is it advisable to store the salt in a separate database column or should we concatenate it together with the password? Is there any difference? I have come across implementations of both types. ...
0
votes
1answer
107 views

Application-Server connection security

I have this school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as ...
57
votes
9answers
7k views

How do you explain to experts that a database server should not reside in the DMZ?

Our security experts, database administrators, network team and infrastructure team are all saying it's OK to have the database server located in the DMZ along with the HTTP server and middle-ware ...
1
vote
3answers
325 views

Validating Credentials - Logic in Application vs Database

I am studying Web Application Security, A Beginner's Guide Paperback – November 3, 2011 by Bryan Sullivan (Author), Vincent Liu (Author) On pp 69, "Validating Credentials", they say you can ...
19
votes
4answers
19k views

Is “Why Should You Avoid AES In MySQL?” true?

From a 2012 Smashing Magazine article quite a bold statement is made to avoid AES in MySQL itself. Or as they put it "Why Should You Avoid AES In MySQL?". However, if you search for SQL encryption, ...
0
votes
1answer
92 views

Which is the best way to secure login password and safeguard user data? (even DBAs couldn't connect data to users)

Lets say that I'm building an website and a app which saves the users' secrets. The user logs in and can save into the app his deepest secrets. I'm worried about two things: - Should I save the ...
3
votes
3answers
1k views

Anonymiszing sensitive data in MySQL DB while retaining searchability [closed]

I have a MySQL database that stores sensitive (personal) data about individuals; and have been tasked with ensuring that this data is encrypted in some way to protect the individuals and their data if ...
-1
votes
1answer
58 views

Where do I start securing my system? [closed]

I am working for a company with perhaps the least security possible. We have servers, databases, web applications, and websites that are all unsecured. There only exists one account: root, which ...
0
votes
1answer
161 views

Indexing encrypted data for efficient searching

I have implemented encryption for certain columns in a database. In some cases it may be necessary to search by these columns, either for exact matches or for substrings. At the moment, there is less ...
1
vote
2answers
164 views

Shared Database and PCI Compliance

Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a ...
-1
votes
1answer
177 views
2
votes
0answers
538 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
6
votes
2answers
932 views

Authentication: Username (email) and password hashed together in one database field

I am currently developping a platform with a PHP framework for our client. The head of the client's IT department wants us to handle authentication with one database field containing ...
1
vote
1answer
217 views

Hipaa Compliant Server

I have an instance in Amazon EC2 and need to be HIPAA compliant. I have two questions, Should I need to do a block level encryption of the database storage. Should I need to encrypt sensitive data ...
2
votes
1answer
1k views

Flawed understanding of SQL Server Transparent Data Encryption (TDE)

We host a database for one of our applications on Microsoft SQL Azure. One of our clients was dissatisfied with the fact that TDE is not supported on SQL Azure (and the database is otherwise not ...
2
votes
3answers
624 views

How do attackers find the database technology used by a web application?

These days there are several database technologies are available for data storage purpose. While performing injection attacks, how do attackers actually identify the database used by a website? If ...
-1
votes
2answers
364 views

How to securely store users' private keys? [closed]

I'm building an application that needs to store a public/private key pair generated by the user. What's the best way to do this? Encrypt the private key in the db with some application-generated ...
5
votes
6answers
12k views

Mysql - two-way encryption of sensitive data (email addresses) outside of Apache, PHP and MySQL

We store user email addresses in our database, like many other websites. While we do take pride in the security measures in place, sometimes "just enough" is just not enough. We've begun looking into ...
1
vote
1answer
250 views

Connecting to Oracle Database from VBScript - Hiding Credentials

At work our first level support uses a ticket management system that allows us to add extra functionality via VBScripts that the application invokes. First level support also receives quite a few ...
2
votes
1answer
292 views

Where to store uploaded images from perspective of security

It is quite common that uploaded files (images, videos, etc.) are stored on a file server because of performance and database-recovery-time reasons. But is there a benefit of storing such files in ...
1
vote
2answers
285 views

Opinions on my “Encryption at rest” implementation idea

Ok so basic overview of the environment I'm envisioning: Webapp w/ db backend storing sensitive data, possibly phi; standard user:pass auth due to unteachable users. My idea was to encrypt row data ...
1
vote
3answers
834 views

Protect database data from everyone, including sys admins, etc

One of the things that has always bothered me about simple database data encryption: If the server is compromised, the database is effectively compromised. The attacker can use the same code as the ...
1
vote
1answer
78 views

Should content from database be sanitized again

Suppose I save content into the database after sanitizing it. Is there still a need to sanitize it again when retrieving it? If yes, why?
5
votes
5answers
947 views

When hashing passwords, is it okay to store the algorithm used right there in the database?

Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
2
votes
1answer
68 views

Display link to admin section or not?

I have a question and answers site. I have an admin section. From that section I can delete users, threads, responses, and edit various other things. I have some simple code at the start of the admin ...