Security related aspects of databases and database access.

learn more… | top users | synonyms (1)

6
votes
2answers
171 views

Non-Sensitive/Non-Critical Database and Web server protections?

I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not ...
3
votes
2answers
51 views

Is there a form to know the PostgreSQL version using nmap?

I tried using the following command: nmap -p 5432 -v --script pgsql-brute myhost But I got no output related to the pgsql script nor the dbms version.
0
votes
2answers
124 views

Weird table names in SQLite database

This is the first time I'm using sqlmap against SQLite. When I run: sqlmap -u www.site.com:80/index.php?vulnParametr=p --dump-all --keep-alive --dbms=sqlite It gives me this: What is that? Is ...
1
vote
1answer
53 views

How can I track IPs to block malicious users?

TL;DR: I want to know should I store both REMOTE-ADDRESS and X-FORWARDED-FOR or either REMOTE-ADDRESS or X-FORWARDED-FOR? Details... Here is a few theories to get user's IP Theory1: If you don't ...
0
votes
1answer
22 views

SecureData even for admins with external login

Given: A WebService which stores user Data and a server with a database. A Administrator which can acces the sever wit hthe webservice and the server with the database. Foreach user is a ...
0
votes
1answer
29 views

Is it possible using a file level encryption in addition to TDE in Microsoft SharePoint?

For Microsoft SharePoint, TDE is a great encryption solution to keep databases encrypted. I've tried to find a possible solution to encrypt the files once more using an other level of encryption on ...
0
votes
1answer
162 views

How does the ERAD device gain access to your personal bank account?

I am trying to get specifics on how exactly this ERAD device is able to access and withdraw from personal bank accounts. http://www.dailykos.com/stories/2016/6/8/1536190/-Oklahoma-has-started-using-...
-1
votes
1answer
107 views

What is resource isolation for Database security

Does resource isolation mean different users are assigned different resources such as memory and processors as their own resources? How such resource isolation improve database security? Can you ...
6
votes
0answers
51 views

Why would I use at-rest encryption over a DB's key-based encryption?

Goal I want to store encrypted data in a database. Constraints Application-level encryption (encrypting before sending to the DB) is not a reasonable option for my use case. The DB providers I'm ...
2
votes
0answers
11 views

Is there a database with XSS vectors, possible reference and test information?

I recently had the idea to develop an public database in which unique XSS vectors will be registered and get a reference assigned similar to the CVE system. I made a local PoC already and registered ...
2
votes
0answers
248 views

Proper credit card encryption for use in a blacklist

I have a general encryption question. I have read through many of the encryption related questions here and I can't find any specifically addressing my concern. This is the hypothetical scenario: I ...
2
votes
0answers
568 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
2
votes
0answers
54 views

Storing Tenants Cloud Keys In a Database

Imagine you are building a public service where you need to store the customer's cloud credentials(like their aws secret and access keys) in your database to regularly use by your backend services in ...
2
votes
0answers
28 views

Specification Document

I have been asked to research on a certain database then write down a specification document which covers Authentication, Authorization and Encryption. Has anyone ever come across such a documentation?...
1
vote
0answers
29 views

AWS DMS to use CloudHSM

I have a source database that need to be migrated to another one. This target will be created and integrated with CloudHSM so that the data migrated is encrypted. For migration I am planning to use ...
1
vote
0answers
30 views

Are exposed database names on shared server a security hole?

I was working for a client this week, and they use PostgreSQL database for web applications. They have their database on a shared server. When I connected to the database host with pgAdmin, I was ...
1
vote
0answers
128 views

Multi-Region MySQL Deployment on AWS - How to Encrypt?

Problem: AWS offers the managed RDS MySQL database service in which you can encrypt and manage keys using AWS's Key Management System (KMS). Unfortunately encrypted database snapshots cannot be copied ...
1
vote
0answers
208 views

How does the Facebook App on iPhone access the SMS data from iMessages? What are the details?

(This is not a repeat question to "How is Facebook accessing my iPhone texts in order to recommend friends?", linked below. I wish to know the internal details of how downloading the Facebook app on a ...
1
vote
0answers
96 views

Is there a solution for On-the-fly-encryption with active directory rules & policies?

I am looking at having our servers' sql databases for a few program and documents to be always encrypted on the HDD, but available to AD users. So one or multiple users with the right AD privileges ...
1
vote
0answers
260 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
1
vote
0answers
185 views

Amazon Web Services - Relational Database Service - Security Scan

My company is utilizing AWS for it's infrastructure including Mysql RDS instances for our databases. Everything we have is in a VPC and requires access through our VPN. Our databases are all not ...
1
vote
0answers
298 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
1
vote
0answers
316 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
0answers
86 views

Secure 'pg_settings' for PostgreSQL

I have been looking for some kind of hardening guide towards PostgreSQL which I can use for a security audit of a PostgreSQL DB. I came across this url, have checked the same. Anything more to this?: ...
1
vote
0answers
246 views

Security considerations for SQL database with employee data in blob field

With elevated SQL permissions, I am able to export a blob and retrieve a pdf with employee data (SSN) from a SQL Server database. This database is a backend to a third party web app we use internally ...
0
votes
0answers
9 views

Pentesting a Data Warehouse?

One client has recently implemented AWS and has a EC2 instance running. We have made one scoping call and further to that they provided me with a diagram that I have modified to avoid any issue: ...
0
votes
0answers
21 views

Using Nginx to block non-GET requests

I'm running a CouchDB instance on my server. A certain database within it (not the entire CouchDB instance) is exposed at a subdomain on my website via this Nginx configuration: server { listen ...
0
votes
0answers
94 views

Hashing Identifiers to Create Pseudonyms

I'm wanting to share datasets between two organisations in a pseudonymised way such that they link together via mutual entities (e.g. people) but so that the entities cannot be identified. E.g.: ...
0
votes
0answers
28 views

Get data file off critical database host

Re-wording this question to hopefully be more understandable. Thanks for the feedback. We have a data warehouse which sits in our production environment. Our data engineers can get to the host via ...
0
votes
0answers
78 views

What type of security does Gazzang zNcrypt provide?

We have just planned to implement the same in our organization, and I believe this will encrypt files and data on disk. I have two questions: Does it provide column level encryption in database (if ...
0
votes
0answers
91 views

Private data encryption in database in case there is no password

I am currently investigating the architecture of the secure, but user friendly service, which combines storing of sensitive private data together with simple authorization procedure. The approach ...