Security related aspects of databases and database access.

learn more… | top users | synonyms

1
vote
3answers
151 views

Is this a secure function for checking if a user has not stolen a session cookie?

As an exercise for class, I'm creating a class that manages user sessions. The session details are stored in a database and also there is a $_SESSION[user_id] variable to carry in between pages. The ...
1
vote
2answers
45 views

Shared Database and PCI Compliance

Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a ...
1
vote
1answer
79 views

Flawed understanding of SQL Server Transparent Data Encryption (TDE)

We host a database for one of our applications on Microsoft SQL Azure. One of our clients was dissatisfied with the fact that TDE is not supported on SQL Azure (and the database is otherwise not ...
1
vote
1answer
204 views

Uploading Executable Files

Using proxy software, I was able to bypass a file upload control file-checking for an asp.net system I am pen testing. I noticed they are saving the file into the database as bytes, and it is ...
1
vote
1answer
136 views

PCI DSS compliance for storing PAN and PII in multi-tenant environment

I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the ...
1
vote
1answer
113 views

Security risks if a server in not supported anymore

I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements. What are the security risks that we might ...
1
vote
1answer
64 views

How to restrict access to a resource based on frequency of access?

I want to restrict access to a particular resource based on time (configurable). So suppose user A has time t configured from him. He can access the resource only once every t time units. The values ...
1
vote
2answers
391 views

Least insecure way to encrypt a field in the database so that it can still be included in queries

I have a table where all columns need to be encrypted (aside from the PK). This will be achieved using AES at the application level. However there is one particular field that needs to remain ...
1
vote
1answer
301 views

Protect database resources from fake data inputs via web forms

Scenario: I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
1
vote
1answer
748 views

Storing US employer identification number (EIN / FEIN) in a database

What are considerations for storing a United States Employer Identification Number (EIN / FEIN) in a database? Is this considered sensitive information along the lines of an SSN? Are there legal ...
1
vote
1answer
78 views

Connecting to Oracle Database from VBScript - Hiding Credentials

At work our first level support uses a ticket management system that allows us to add extra functionality via VBScripts that the application invokes. First level support also receives quite a few ...
1
vote
1answer
77 views

Good resources on ACH/banking details security?

In our web application, we allow customers to enter their bank account information as a method of payment (account number, routing number, bank name). This information goes nowhere at all; it's up to ...
1
vote
1answer
102 views

Cracking encrypted SQB databases

I've recovered a .SQB SQL database backup file from a backup server and do not have the password. As I do not have the password available to me, I'm looking to determine what type of encryption is ...
1
vote
1answer
186 views

Multi Tenant Database - HIPAA

We are planning to develop a EHR/Billing Software and we are aware about HIPAA rules and regulations. Our current application architecture using a shared database with all client's(Provider/Practice) ...
1
vote
1answer
163 views

Are there any secure ways to store the secret key used in a TOTP scheme?

I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash ...
1
vote
2answers
687 views

What does Gazzang zNcrypt actually protect against?

In an effort to increase security of our website, I'm reading up on Gazzang zNcrypt, which claims to protect data in databases from breaches. Technically, it seems to do filesystem encryption. As far ...
1
vote
2answers
182 views

Main requirements to secure my Application in any database related features

I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm ...
1
vote
1answer
67 views

Hybrid Encryption System - Is this unnecessary in this case? [closed]

I have a column in my database that I need to encrypt. The column can contain any arbitrary data. What I am thinking is to generate a public and private key pair first. Store the public key in a ...
1
vote
1answer
124 views

Isolating database? Is it possible?

I have been assigned CTF project for IT Security for my final year project in school. We are planning to have a flag that are base on SQL injection but for the user to overcome the challenge, they ...
1
vote
1answer
296 views

Authentication for a batch script

It seems amazing that there is no industry accepted best practice for this problem yet (or maybe just one I'm not aware of): What is the most secure way for a batch script, a program needing to ...
1
vote
1answer
191 views

users avatar names based on Primary Key, is it safe?

We upload users avatar with their primary key name. avatars name are 1.jpg,2.jpg,3.jpg,... according to their primary key. We implemented this to omit avatar field from database, instead with use ...
1
vote
0answers
30 views

How to sniff [possibly encrypted] TDS protocol data from the host the client application is installed on?

Let's say, there is an .NET application on a windows 7 host where I have administrator's access rights. The application works with remote MS-SQL server which I don't control, it also seems that the ...
1
vote
0answers
72 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
1
vote
3answers
416 views

Protect database data from everyone, including sys admins, etc

One of the things that has always bothered me about simple database data encryption: If the server is compromised, the database is effectively compromised. The attacker can use the same code as the ...
1
vote
0answers
68 views

What tools on unix can scan sql dumps for malware? [closed]

I'm attempting to check for malware, spam and any kind of injection/exploitation on a sql dump that has been provided and was wondering what kind of tools are there already in place to help with this? ...
1
vote
0answers
38 views

Storing Tenants Cloud Keys In a Database

Imagine you are building a public service where you need to store the customer's cloud credentials(like their aws secret and access keys) in your database to regularly use by your backend services in ...
1
vote
0answers
130 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
0answers
20 views

Specification Document

I have been asked to research on a certain database then write down a specification document which covers Authentication, Authorization and Encryption. Has anyone ever come across such a ...
1
vote
0answers
93 views

Store which parts of an IP address, for user to remain anonymous?

I'm thinking about building a very anonymous forum, where people can comment and upvote each other's comments anonymously. People are supposed to remain anonymous even if the forum's database contents ...
1
vote
0answers
44 views

Secure 'pg_settings' for PostgreSQL

I have been looking for some kind of hardening guide towards PostgreSQL which I can use for a security audit of a PostgreSQL DB. I came across this url, have checked the same. Anything more to this?: ...
1
vote
2answers
139 views

How to securely provide data to a web server using a data warehouse?

We have a data warehouse that stores prices for our products. Once every business day, new data points are added representing the day's price for each product. On the website, a user sees this ...
1
vote
0answers
112 views

Security considerations for SQL database with employee data in blob field

With elevated SQL permissions, I am able to export a blob and retrieve a pdf with employee data (SSN) from a SQL Server database. This database is a backend to a third party web app we use internally ...
1
vote
1answer
73 views

Oracle database privileges [closed]

I have a 10.2.0.5.0 Oracle Database and a list of users who i need to grant some privileges to (Mainly to generate reports and so on). I used impersonation, which means i created one Oracle user so ...
1
vote
0answers
135 views

What becomes of SIEM when a large database like teradata gets involved? [closed]

My topic sentence says it all. I want to know the effect on performance, storage and analysis capabilities when teradata database is added. I'm talking about 70TB of storage with internal ...
1
vote
0answers
556 views

A proposal for Data Transmission and Password Encryption [closed]

I need to implement a sensitive data protection scheme which can meet the requirements on secure data transmission, protection and storage, assuming mutually trusted third party is not available, that ...
1
vote
2answers
149 views

Opinions on my “Encryption at rest” implementation idea

Ok so basic overview of the environment I'm envisioning: Webapp w/ db backend storing sensitive data, possibly phi; standard user:pass auth due to unteachable users. My idea was to encrypt row data ...
0
votes
2answers
65 views

Authenticate User Salted Hash Without Username

I've got a page with a login system where you type your username and password, the salted hash gets pulled down from the database depending on the username ... SELECT hash FROM db WHERE username = ? ...
0
votes
3answers
757 views

Password and username used to connect to database in source code [duplicate]

In PHP scripts that communicate with the database I have the username and password to the database in plain text i.e. mysqli_connect('localhost:3306', 'root', 'PASSWORD!'). From OWASP Do not ...
0
votes
2answers
147 views

What is truly unbreakable these days? [closed]

Just very curious, count my knowledge in cryptography, algorithms, and security in general as non-existent. Now I am aware that this might be a VERY broad question, but here it goes. What is the most ...
0
votes
1answer
59 views

Should content from database be sanitized again

Suppose I save content into the database after sanitizing it. Is there still a need to sanitize it again when retrieving it? If yes, why?
0
votes
3answers
152 views

What security issues will I face with outsourced VPS server?

Our small comapny wants to launch a paid service, hosted on the outsourced VPS server. The obvious risk is that the machine is physically not in our office and that possibly the database could be ...
0
votes
1answer
185 views

How does Shodan crawl internet-connected devices?

I wonder how Shodan crawls internet-connected devices and adds them to its database. I know Google, for instance, finds new websites by following links in websites it already found, but that strategy ...
0
votes
1answer
160 views

What are common problems that reveal PHP code? [closed]

What is the best method for securing PHP scripts that contain database passwords? From what I've read, PHP can be revealed when an error occurs and is not caught. Is there any way to reveal PHP by ...
0
votes
1answer
101 views

What are the risk associated with granting full permission (Any) to DB Admin users to the Database?

Usually in a well controlled environment, Database Admins are granted specific rights like Read, Modify...etc. No one has the right (ANY) to perform on any Database. Certain requirements dictate to ...
0
votes
1answer
42 views

Which is the best way to secure login password and safeguard user data? (even DBAs couldn't connect data to users)

Lets say that I'm building an website and a app which saves the users' secrets. The user logs in and can save into the app his deepest secrets. I'm worried about two things: - Should I save the ...
0
votes
1answer
45 views

Indexing encrypted data for efficient searching

I have implemented encryption for certain columns in a database. In some cases it may be necessary to search by these columns, either for exact matches or for substrings. At the moment, there is less ...
0
votes
3answers
50 views

How can I mitigate attacks that rely on poisoned data as a developer?

A few years ago, there was a high-profile attack on a Wired editor, where the hackers added a credit card to the target's amazon account, then used that self-added credit card to gain access to the ...
0
votes
2answers
104 views

Are files hosted on cloud servers/websites/databases manually checked by people?

I was wondering ... when I upload a file to, say, Dropbox, does anybody personally check it to see what it is? Say I upload a copy of my Blu-ray movie to cloud storage ... will anyone check, and ...
0
votes
1answer
57 views

Storing data permanently vs temporarily

My lecturer said that since hard disk space is so cheap these days, most organisations do not delete the data on the disk. Rather, they only logically delete it (remove the link to the data). If this ...
0
votes
1answer
154 views

Hipaa Compliant Server

I have an instance in Amazon EC2 and need to be HIPAA compliant. I have two questions, Should I need to do a block level encryption of the database storage. Should I need to encrypt sensitive data ...