Security related aspects of databases and database access.

learn more… | top users | synonyms

2
votes
2answers
275 views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
4
votes
2answers
139 views

Is storing encrypted data in a database futile?

The way I see it: there are two ways to encrypt data for a web app. 1) Store a single encryption key on the server, and use it to encrypt / decrypt data at runtime. The obvious issue here is that if ...
2
votes
2answers
37 views

Are foreign keys linking to a table with PHI considered PHI under HIPAA?

Table 1 has PHI and it's encrypted. Table 2 doesn't have PHI, isn't encrypted and has a foreign key to Table 1. I'd like to recommend the strongest security. If there's a requirement in HIPAA, it's ...
9
votes
4answers
2k views

What's more secure? Hard coding credentials or storing them in a database? [duplicate]

I wonder which of these things is more secure. Imagine hard coded credentials, similar to this: if user.Equals("registereduser") && (password.Equals(encryptedpassword)) { Give access to ...
12
votes
3answers
2k views

What are the security benefits to a separate user database?

In the app I'm writing I separated the user and main databases a long time ago for "security reasons". However its getting harder and harder to justify the overhead and the difficulty of managing such ...
-1
votes
3answers
125 views

Authenticate User Salted Hash Without Username

I've got a page with a login system where you type your username and password, the salted hash gets pulled down from the database depending on the username ... SELECT hash FROM db WHERE username = ? ...
4
votes
1answer
102 views

How to detect a database leak

Website keep getting hacked every day and every now and then we hear website owners react and tell "affected users that their password might had been compromised". Most sites that disclose such leaks ...
-1
votes
0answers
25 views

Best practices to store user credential on a SaaS webapp

What are all the basic best practices to store user informations on a database for a SaaS web application? I mean basically two things: usernames and passwords. that's it. Seems simple but I know ...
1
vote
0answers
32 views

Is there a solution for On-the-fly-encryption with active directory rules & policies?

I am looking at having our servers' sql databases for a few program and documents to be always encrypted on the HDD, but available to AD users. So one or multiple users with the right AD privileges ...
5
votes
1answer
90 views

If I fill a hypothetical 1gb HDD with 1024 single 1mb files, will all sectors be overwritten?

When a file is deleted, its only marked as an unused sector of a hard drive. Im wondering if it's possible to fill a 1gb HDD with 1024 individual 1mb files to completely use every sector?
1
vote
1answer
76 views

Is it fine to store single-use beta keys plain-text?

Is it okay to store single-use beta keys in plain-text in the database? I'll be pre-generating and storing about 2M keys. The keys get passed around so that people can sign up with it, rather than let ...
3
votes
1answer
134 views

How to sniff [possibly encrypted] TDS protocol data from the host the client application is installed on?

Let's say, there is an .NET application on a windows 7 host where I have administrator's access rights. The application works with remote MS-SQL server which I don't control, it also seems that the ...
0
votes
1answer
37 views

How to encrypt or store data so that only a pool of processes can share it on Windows?

I am writing an application T1 which is using SQLite database to store some sensitive data and i am trying to encrypt it securely. The issue i am facing is that i don't want my symmetric key to be ...
1
vote
1answer
197 views

What are the risks of encrypting a database with a single symmetric key

An application is required to store sensitive data* on each user. Additional columns are added to the database which store cyphertext encrypted on the application server. The algorithm of choice is ...
0
votes
0answers
23 views

What type of security does Gazzang zNcrypt provide?

We have just planned to implement the same in our organization, and I believe this will encrypt files and data on disk. I have two questions: Does it provide column level encryption in database (if ...
2
votes
2answers
1k views

What does Gazzang zNcrypt actually protect against?

In an effort to increase security of our website, I'm reading up on Gazzang zNcrypt, which claims to protect data in databases from breaches. Technically, it seems to do filesystem encryption. As far ...
0
votes
2answers
147 views

Table or row level security in ASP.NET MVC 5 and Entity Framework 6

I've already asked this question on Stack Overflow, but no one answered, so maybe it's a more appropriate place to discuss it. Please let me know if I'm wrong and having duplicated question on ...
1
vote
1answer
21 views

Is it ok to have GRANT ANY ROLE privilege granted to an Oracle account which is expired & locked?

I know it's not considered secure to grant GRANT ANY ROLE privilege to other users apart from admins. But what if the user is expired & locked? In particular, I see these 2 users having this ...
2
votes
1answer
219 views

Is this a sensible way to encrypt user data?

I want to make a site for storing sensitive user data, that retains per-user data encryption in the event that the database is compromised. This is the model I was thinking of, to give the best ...
2
votes
3answers
168 views

Most secure location of database

Let's say I have a straight forward completely database driven web site application and I store my database on my web server in the DMZ. I won't be broadcasting the IP address of my database because I ...
1
vote
0answers
53 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
0
votes
1answer
152 views

How sqlmap works to get all database info

I am curious how sqlmap able to get all the info from the database? I am using burp as proxy to view all the request and response. From the response I couldn't see any information related to the ...
13
votes
5answers
7k views

How can I avoid putting the database password in a perl script?

I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
1
vote
1answer
35 views

Difference between Oracle Label Security and Oracle Virtual Private Database?

I am working on a class project, and our lecturer ask a question with this title, I searched in net but I could not find a clear answer. if there is difference what are they? thanks
2
votes
0answers
106 views

Proper credit card encryption for use in a blacklist

I have a general encryption question. I have read through many of the encryption related questions here and I can't find any specifically addressing my concern. This is the hypothetical scenario: I ...
0
votes
1answer
32 views

Diceware & Database hosting [duplicate]

I'm currently setting up a new SQL database with DotEasy as my Hosting/Database provider. I've heard a lot about Diceware being one of the best methods of creating a really strong password, so I ...
0
votes
3answers
292 views

Sending database name in request headers

I am doing a project with an architecture of single server and multiple database. Every client request will contain a header containing database name that this request should connect. Is this a good ...
5
votes
1answer
164 views

Showing bank routing/account numbers, and storing them safely

EDIT: This is for the UK/Europe region. I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be ...
3
votes
1answer
101 views

Deleting credit card information after every transaction

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every ...
1
vote
1answer
72 views

Is storing a client's folder structure a security risk?

At work, we generate sensitive report files for our clients. Currently, these files are stored in cloud storage. Some partners want the files on their local machine, instead, so we will need the ...
1
vote
2answers
172 views

How to keep database record secret even from developer having access to it?

Imagine a web-based email app, such as GMail. The email should only be readable by the sender and the recipients. No one else, including the developer having access to the database server or ...
2
votes
2answers
172 views

Store which parts of an IP address, for user to remain anonymous?

I'm thinking about building a very anonymous forum, where people can comment and upvote each other's comments anonymously. People are supposed to remain anonymous even if the forum's database contents ...
-2
votes
1answer
256 views

What are common problems that reveal PHP code? [closed]

What is the best method for securing PHP scripts that contain database passwords? From what I've read, PHP can be revealed when an error occurs and is not caught. Is there any way to reveal PHP by ...
0
votes
2answers
81 views

Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?

Regarding the following OWASP Vulnerabilities: Insecure Direct Object References By that I mean letting someone see /account/123/not-theirs (this could be the wrong reference I'm using above). SQL ...
1
vote
1answer
199 views

Security risks if a server in not supported anymore

I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements. What are the security risks that we might ...
0
votes
2answers
106 views

SQL Injection in a Web Service URL as a Parameter Value [closed]

Obviously SQL Injection via the payload of a message is a very common practice and therefore it is always key to cover this (I already have in my code). However I'm just wondering about how possible ...
45
votes
9answers
14k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
1
vote
1answer
79 views

What's the value of data partition encryption for database files on a postgres database server?

We're in the process of rolling out a postgres based web app, and I'm trying to understand the value of encrypting the entire database. In postgres's case, the only way to do this is store the ...
2
votes
2answers
87 views

How to appropriately secure a database using different db users

I was thinking recently of the steps to secure a database server. Most of us are aware how to handle the security on the application side, although a malicious user might find his way to bypass the ...
0
votes
0answers
52 views

Amazon Web Services - Relational Database Service - Security Scan

My company is utilizing AWS for it's infrastructure including Mysql RDS instances for our databases. Everything we have is in a VPC and requires access through our VPN. Our databases are all not ...
0
votes
2answers
102 views

Place database in the DMZ and in the internal network

Is it sufficient to have single database inside the DMZ which the webservers in the DMZ receives their data from. Or if setup with two databases is a better solution, that would be to have a ...
9
votes
4answers
643 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
2
votes
2answers
200 views

Storing lots of passwords that different levels of employees need access to

I am wondering what other people do for storing passwords. Our current model at my employer is fundamentally flawed in my opinion, so I am trying to see what other people do so I can select the best ...
1
vote
2answers
134 views

Is bruteforcing the last character of a salt a good idea?

Would it be a good idea security-wise to store salts with their last character removed, and then bruteforce the last character to further the amount of time it would take to create rainbow tables and ...
53
votes
7answers
18k views

SQL injection — why isn't escape quotes safe anymore?

Raw SQL When you're writing SQL -- for anything that takes human input really, a lot of things have been done to avoid the injection. Everyone that's heard of SQL injection knows that (I'm going to ...
2
votes
1answer
119 views

Hiding remote database credentials in application

If I'm building an application that connects to a remote database, where should I hide the credentials? I've seen many suggest that you go through a web-application and use POST and GET requests to ...
14
votes
4answers
9k views

Is it generally a bad idea to encrypt database fields?

I work on a tiny company, it's literally me (the programmer) and the owner. The owner has asked me to encrypt several fields in a database to protect the customers data. This is a web application that ...
3
votes
2answers
484 views

Is AES encryption vulnerable?

I was reading weaknesses in AES encryption. Unfortunately, I have a website that uses AES: Its database is almost entirely AES encrypted. Is there a real threat? Would it be worth to refactor the web ...
0
votes
1answer
96 views

Web app and database on same server, what is benefit of encrypting database data?

If a web app and a database are on the same server, what is the security benefit of encrypting database data? Obviously passwords should be hashed either way. I assume that if an attacker can ...
2
votes
3answers
101 views

How could a shared password database be implemented?

In the traditional form, a password database is similar to any other database file, except the contents are encrypted using a key derived from a passphrase entered by the user. The user enters their ...