Security related aspects of databases and database access.

learn more… | top users | synonyms

3
votes
2answers
133 views

Local Network Data Sync and Access Log

We have some confidential data for our research. Currently, we use an encrypted hard drive for storing the data and any researcher using the data takes it off the drive. However, we do not have any ...
3
votes
2answers
608 views

User authentication + database encryption with same password

I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
5
votes
1answer
1k views

Practices for storing username/password in Web applications

I have read the following question: Storing password in Java application but I don't find the answers useful for my case. So here is my question somehow related to that. I have a Java Web application ...
3
votes
2answers
310 views

Are there special attack vectors for statistical databases?

Are statistical databases vulnerable to SQL injection attacks? If so, what specific kind? Can you think of an example?
9
votes
2answers
1k views

Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code

Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality. Apart from the generic arguments about 'security through obscurity' are there ...
1
vote
0answers
122 views

What becomes of SIEM when a large database like teradata gets involved? [closed]

My topic sentence says it all. I want to know the effect on performance, storage and analysis capabilities when teradata database is added. I'm talking about 70TB of storage with internal ...
2
votes
2answers
2k views

how long does it take to brute force varying encryption standards?

Let's say I want to encrypt information in a database. What would be the best encryption algorithm to use and why. I was thinking AES, since it's widely used as a government standard, but if the ...
6
votes
5answers
5k views

How can I avoid putting the database password in a perl script?

I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
8
votes
3answers
1k views

Is it safe to store a single symmetric key encrypted with several different RSA public keys?

For the field-based encryption of a database containing sensitive information, I was thinking of the following design: Every user has a smartcard used for client certificate login. After login the ...
7
votes
1answer
1k views

Store user passwords in NoSQL database?

I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
4
votes
2answers
10k views

Where/How is an ODBC password stored when 'saved' in Access?

I have been working on a program that uses MS Access and ODBC to connect to an SQL server. One of the requirements is that the user need not know the password for the connection to the SQL server, so ...
0
votes
1answer
179 views

SIEM technology is it database friendly? [closed]

I have a few questions regarding the use of Databases in SIEM technology. I would appreciate if you guys can help me understand / answer these questions. The answers from you help me design the SIEM ...
12
votes
4answers
1k views

Encrypting IP addresses in a MySQL database

I'd like to encrypt IP addresses in my MySQL database, with the following constraints: Does not need to be resistant to attackers that can execute queries. Must be resistant to attackers that have ...
1
vote
1answer
188 views

Limiting database security

A number of texts signify that the most important aspects offered by a DBMS are availability, integrity, and secrecy. As part of a homework assignment I have been tasked with mentioning attacks which ...
2
votes
1answer
124 views

Is Creating a Restricted Database User in Microsoft SQL Server Decent Protocol

Forgive me for the heavy metaphor but it's a situation's complexity kind of goes over my head. Assume I'm Leonard Shelby (My short term memory only lasts 5 minutes). I'm a freelancer that reads ...
9
votes
1answer
893 views

How to make SQL injection in PostgreSQL's tsquery?

I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format: PHP raised unknown ...
2
votes
2answers
565 views

Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO

I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from ...
2
votes
2answers
107 views

Is this logic security / performance wise or not?

Each physical user will have about 20 tables in the database. When a new user registers, another 20 tables will be created with access only for their new MySQL account. Data does not have to be ...
3
votes
3answers
195 views

How to know who I am protecting database information from?

I am trying to determine whether I need to use transparent database encryption (TDE) or encryption at web server to protect data in a database. Here are a couple articles I've read on the subject, ...
2
votes
1answer
1k views

How to secure MySQL based web session data table?

I have the following MySQL session schema: CREATE TABLE `SessionData` ( `id` varchar(50) COLLATE utf8_unicode_ci NOT NULL, `data` text COLLATE utf8_unicode_ci, `date` datetime DEFAULT NULL, ...
1
vote
3answers
435 views

Is this approach of securing cookie secure?

I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
10
votes
4answers
5k views

Is it generally a bad idea to encrypt database fields?

I work on a tiny company, it's literally me (the programmer) and the owner. The owner has asked me to encrypt several fields in a database to protect the customers data. This is a web application that ...
2
votes
4answers
2k views

If a hacker were to compromise a GMail database

Assuming the systems that store the Gmail database is compromised what is preventing them from reading everyone's emails by looking at the data in the database? I assume nothing, and in order for ...
4
votes
2answers
3k views

How do I protect user data at rest?

I want to encrypt the username, email, and password fields in the database AND encrypt user files at rest. How can I do this? I am aware of software such as Gazzang and since there is not cost ...
4
votes
2answers
187 views

Is this a safe way to connect to a server

I am using a software to backup my website .sql data every 3 days and it connects simply to the server logs in and downloads the .sql file to my computer. While its downloading the connection is not ...
2
votes
3answers
5k views

Database field type for password storage?

In the past I used varchar(255) for storing hashed passwords (no salt). Is this still enough? Or are longer fields required?
4
votes
2answers
1k views

What is better salted hash or openssl encryption?

Im using php and I was looking to store passwords in a mysql database. I was wondering what would be safer to use a salted hash or openssl encryption? If i use a unique random generated salted hash ...
3
votes
2answers
266 views

Securing a script to prevent database from being exposed

We have an Ioncube encoded script running on an Apache web server which stores customer confidential information in a MySQL database. We have configured the script to run under its own account using ...
4
votes
1answer
307 views

What constitutes a Virtual Private Database?

I recently came across this term "Virtual Private Database" and I'm wondering what criteria need to be satisfied to allow use of the term. I first saw the term in an HP/Fortify doc: A virtual ...
1
vote
1answer
274 views

Authentication for a batch script

It seems amazing that there is no industry accepted best practice for this problem yet (or maybe just one I'm not aware of): What is the most secure way for a batch script, a program needing to ...
1
vote
1answer
696 views

Storing US employer identification number (EIN / FEIN) in a database

What are considerations for storing a United States Employer Identification Number (EIN / FEIN) in a database? Is this considered sensitive information along the lines of an SSN? Are there legal ...
3
votes
3answers
218 views

What security standards should be implemented in a simple web application

I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I ...
5
votes
2answers
547 views

mysql security logging

Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time? Im trying to detect brute force attempts. ...
1
vote
0answers
531 views

A proposal for Data Transmission and Password Encryption [closed]

I need to implement a sensitive data protection scheme which can meet the requirements on secure data transmission, protection and storage, assuming mutually trusted third party is not available, that ...
4
votes
4answers
386 views

How to securely delete a table in MS-Access?

I have a Windows 7 computer which currently has a large working Microsoft Access 2007 database on it containing some tables with confidential data. I would like to securely delete/remove the tables ...
0
votes
1answer
333 views

Enterprise Encryption Considerations

What are the different aspects to consider for Enterprise Encryption policy? So far the resources I have are: https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet ...
7
votes
1answer
499 views

What evaluation criteria would you use for an Oracle scanning tool?

What evaluation criteria would you use to select the right Oracle scanning tool? Context: To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security ...
2
votes
1answer
604 views

DRY API Authentication Design Between Services

I am creating an API service that is going to require authentication. this will be the first part of a project that will include a front-end service for my website, and also open up the api for 3rd ...
3
votes
1answer
442 views

Best security algorith for storing passwords [duplicate]

Possible Duplicate: Which password hashing method should I use? I want the best cryptography algorithm for storing passwords in database, which one should I use and how can I implement ...
2
votes
2answers
137 views

How can I protect a client's mirror of the server's database?

The scenario is as follows: There are clients that users can access and work with. These clients can be online or offline. There is a central database on a server, holding all the authorization ...
4
votes
2answers
184 views

In the case of the Gawker data breach, would strong passwords be ok?

In the Gawker data breach, was just the database stolen and that gave free access to all user data? Or did the hackers still need to read the MD5's of the usernames and passwords to gain access to the ...
11
votes
2answers
2k views

What are the security benefits to a separate user database?

In the app I'm writing I separated the user and main databases a long time ago for "security reasons". However its getting harder and harder to justify the overhead and the difficulty of managing such ...
1
vote
1answer
191 views

users avatar names based on Primary Key, is it safe?

We upload users avatar with their primary key name. avatars name are 1.jpg,2.jpg,3.jpg,... according to their primary key. We implemented this to omit avatar field from database, instead with use ...
6
votes
6answers
1k views

Filter user input before the database or upon display?

Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
4
votes
3answers
926 views

Does Hash/Salted password really help when DB is compromised?

I came across this article and got a basic understanding hash, salt and brute force attack. My question is in the article, the author emphasises how hard it is to reverse the hash/salted password to ...
49
votes
6answers
11k views

SQL injection — but why isn't escape quotes safe anymore?

I haven't seen this question asked, and feel it's a valuable bit of information to have, especially because this is a huge source of mystery and confusion. Raw SQL When you're writing SQL -- for ...
4
votes
1answer
8k views

AES-256 OR RSA-2048 for web application security?

I'm developing a web application with a database backend using Django that will be accessed from the Internet. The database will contain sensitive information and I'd like some advice on the approach ...
4
votes
3answers
899 views

storing the third party credentials in the database/some secure place

This question is about storing the third party credentials in the database/some secure place so that it can not be accessed by only authorized user. Our system connect to the third party system using ...
5
votes
5answers
717 views

What are the likely threats to a public-facing DB instance?

Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash. We've been running an instance of MySQL internally for years and it's worked OK, but I ...
5
votes
2answers
256 views

What to do in response to a source code and/or database leak by a third party hosting provider?

My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak. On first appearances, the web host ...