Security related aspects of databases and database access.

learn more… | top users | synonyms

11
votes
4answers
21k views

How to know which database is behind a web application?

I've read that different databases (mysql, sql server,...) have different vulnerabilities and that they are vulnerable to some specific sql injections. When attacker try to perform a database attack ...
2
votes
3answers
1k views

Why are triggers not often used to secure a database?

I did an intern for a company becoming PCI compliant and instead of using triggers to prevent SQL injection, I went through 1000s (if not more) lines of web-app code and called functions every time ...
2
votes
4answers
1k views

Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID

Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID" I know that not good to have clear text password in scripts (there is no alternative at the moment). But question is the ...
0
votes
1answer
454 views

Protect database resources from fake data inputs via web forms

Scenario: I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
3
votes
2answers
921 views

User authentication + database encryption with same password

I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
3
votes
2answers
449 views

Are there special attack vectors for statistical databases?

Are statistical databases vulnerable to SQL injection attacks? If so, what specific kind? Can you think of an example?
9
votes
2answers
3k views

Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code

Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality. Apart from the generic arguments about 'security through obscurity' are there ...
1
vote
0answers
182 views

What becomes of SIEM when a large database like teradata gets involved? [closed]

My topic sentence says it all. I want to know the effect on performance, storage and analysis capabilities when teradata database is added. I'm talking about 70TB of storage with internal ...
8
votes
3answers
2k views

Is it safe to store a single symmetric key encrypted with several different RSA public keys?

For the field-based encryption of a database containing sensitive information, I was thinking of the following design: Every user has a smartcard used for client certificate login. After login the ...
7
votes
1answer
3k views

Store user passwords in NoSQL database?

I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
5
votes
2answers
17k views

Where/How is an ODBC password stored when 'saved' in Access?

I have been working on a program that uses MS Access and ODBC to connect to an SQL server. One of the requirements is that the user need not know the password for the connection to the SQL server, so ...
0
votes
1answer
329 views

SIEM technology is it database friendly? [closed]

I have a few questions regarding the use of Databases in SIEM technology. I would appreciate if you guys can help me understand / answer these questions. The answers from you help me design the SIEM ...
12
votes
4answers
2k views

Encrypting IP addresses in a MySQL database

I'd like to encrypt IP addresses in my MySQL database, with the following constraints: Does not need to be resistant to attackers that can execute queries. Must be resistant to attackers that have ...
1
vote
1answer
260 views

Limiting database security

A number of texts signify that the most important aspects offered by a DBMS are availability, integrity, and secrecy. As part of a homework assignment I have been tasked with mentioning attacks which ...
2
votes
1answer
195 views

Is Creating a Restricted Database User in Microsoft SQL Server Decent Protocol

Forgive me for the heavy metaphor but it's a situation's complexity kind of goes over my head. Assume I'm Leonard Shelby (My short term memory only lasts 5 minutes). I'm a freelancer that reads ...
9
votes
1answer
1k views

How to make SQL injection in PostgreSQL's tsquery?

I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format: PHP raised unknown ...
2
votes
2answers
993 views

Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO

I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from ...
2
votes
2answers
113 views

Is this logic security / performance wise or not?

Each physical user will have about 20 tables in the database. When a new user registers, another 20 tables will be created with access only for their new MySQL account. Data does not have to be ...
3
votes
3answers
223 views

How to know who I am protecting database information from?

I am trying to determine whether I need to use transparent database encryption (TDE) or encryption at web server to protect data in a database. Here are a couple articles I've read on the subject, ...
2
votes
1answer
2k views

How to secure MySQL based web session data table?

I have the following MySQL session schema: CREATE TABLE `SessionData` ( `id` varchar(50) COLLATE utf8_unicode_ci NOT NULL, `data` text COLLATE utf8_unicode_ci, `date` datetime DEFAULT NULL, ...
1
vote
3answers
509 views

Is this approach of securing cookie secure?

I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
5
votes
2answers
5k views

How do I protect user data at rest?

I want to encrypt the username, email, and password fields in the database AND encrypt user files at rest. How can I do this? I am aware of software such as Gazzang and since there is not cost ...
4
votes
2answers
214 views

Is this a safe way to connect to a server

I am using a software to backup my website .sql data every 3 days and it connects simply to the server logs in and downloads the .sql file to my computer. While its downloading the connection is not ...
2
votes
3answers
14k views

Database field type for password storage?

In the past I used varchar(255) for storing hashed passwords (no salt). Is this still enough? Or are longer fields required?
5
votes
2answers
2k views

What is better salted hash or openssl encryption?

Im using php and I was looking to store passwords in a mysql database. I was wondering what would be safer to use a salted hash or openssl encryption? If i use a unique random generated salted hash ...
3
votes
2answers
418 views

Securing a script to prevent database from being exposed

We have an Ioncube encoded script running on an Apache web server which stores customer confidential information in a MySQL database. We have configured the script to run under its own account using ...
4
votes
1answer
375 views

What constitutes a Virtual Private Database?

I recently came across this term "Virtual Private Database" and I'm wondering what criteria need to be satisfied to allow use of the term. I first saw the term in an HP/Fortify doc: A virtual ...
2
votes
1answer
505 views

Authentication for a batch script

It seems amazing that there is no industry accepted best practice for this problem yet (or maybe just one I'm not aware of): What is the most secure way for a batch script, a program needing to ...
1
vote
1answer
1k views

Storing US employer identification number (EIN / FEIN) in a database

What are considerations for storing a United States Employer Identification Number (EIN / FEIN) in a database? Is this considered sensitive information along the lines of an SSN? Are there legal ...
4
votes
3answers
291 views

What security standards should be implemented in a simple web application

I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I ...
5
votes
2answers
834 views

mysql security logging

Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time? Im trying to detect brute force attempts. ...
1
vote
0answers
738 views

A proposal for Data Transmission and Password Encryption [closed]

I need to implement a sensitive data protection scheme which can meet the requirements on secure data transmission, protection and storage, assuming mutually trusted third party is not available, that ...
4
votes
4answers
646 views

How to securely delete a table in MS-Access?

I have a Windows 7 computer which currently has a large working Microsoft Access 2007 database on it containing some tables with confidential data. I would like to securely delete/remove the tables ...
0
votes
1answer
410 views

Enterprise Encryption Considerations

What are the different aspects to consider for Enterprise Encryption policy? So far the resources I have are: https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet ...
7
votes
1answer
653 views

What evaluation criteria would you use for an Oracle scanning tool?

What evaluation criteria would you use to select the right Oracle scanning tool? Context: To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security ...
3
votes
1answer
823 views

DRY API Authentication Design Between Services

I am creating an API service that is going to require authentication. this will be the first part of a project that will include a front-end service for my website, and also open up the api for 3rd ...
2
votes
1answer
512 views

Best security algorith for storing passwords [duplicate]

Possible Duplicate: Which password hashing method should I use? I want the best cryptography algorithm for storing passwords in database, which one should I use and how can I implement ...
2
votes
2answers
161 views

How can I protect a client's mirror of the server's database?

The scenario is as follows: There are clients that users can access and work with. These clients can be online or offline. There is a central database on a server, holding all the authorization ...
5
votes
2answers
222 views

In the case of the Gawker data breach, would strong passwords be ok?

In the Gawker data breach, was just the database stolen and that gave free access to all user data? Or did the hackers still need to read the MD5's of the usernames and passwords to gain access to the ...
1
vote
1answer
205 views

users avatar names based on Primary Key, is it safe?

We upload users avatar with their primary key name. avatars name are 1.jpg,2.jpg,3.jpg,... according to their primary key. We implemented this to omit avatar field from database, instead with use ...
13
votes
6answers
3k views

Filter user input before the database or upon display?

Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
4
votes
3answers
1k views

Does Hash/Salted password really help when DB is compromised?

I came across this article and got a basic understanding hash, salt and brute force attack. My question is in the article, the author emphasises how hard it is to reverse the hash/salted password to ...
5
votes
1answer
12k views

AES-256 OR RSA-2048 for web application security?

I'm developing a web application with a database backend using Django that will be accessed from the Internet. The database will contain sensitive information and I'd like some advice on the approach ...
5
votes
3answers
2k views

storing the third party credentials in the database/some secure place

This question is about storing the third party credentials in the database/some secure place so that it can not be accessed by only authorized user. Our system connect to the third party system using ...
5
votes
5answers
2k views

What are the likely threats to a public-facing DB instance?

Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash. We've been running an instance of MySQL internally for years and it's worked OK, but I ...
5
votes
2answers
365 views

What to do in response to a source code and/or database leak by a third party hosting provider?

My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak. On first appearances, the web host ...
12
votes
3answers
3k views

When using AES and CBC, can the IV be a hash of the plaintext?

[Originally on programmers.stackexchange.com with title: Can you encrypt with AES+CBC and search the encrypted data] Basically, I'm going to go with Advanced Encryption Standard with either ...
10
votes
2answers
1k views

What are the SQL-injections issues of parameterized queries?

I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not: Set adoCon = Server.CreateObject("ADODB.Connection") adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
2
votes
1answer
943 views

iOS/Android authentication and security

Here is what I am trying to do and can anyone provide some best practice advice for authentication and security? Each user will have their own private database on the cloud. He will have his local ...
3
votes
1answer
202 views

testing for 'Dangling Cursor'

While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor. I was wondering ...