Security related aspects of databases and database access.

learn more… | top users | synonyms

3
votes
1answer
103 views

How to sniff [possibly encrypted] TDS protocol data from the host the client application is installed on?

Let's say, there is an .NET application on a windows 7 host where I have administrator's access rights. The application works with remote MS-SQL server which I don't control, it also seems that the ...
2
votes
1answer
162 views

Is this a sensible way to encrypt user data?

I want to make a site for storing sensitive user data, that retains per-user data encryption in the event that the database is compromised. This is the model I was thinking of, to give the best ...
2
votes
1answer
127 views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
1
vote
1answer
55 views

Is it fine to store single-use beta keys plain-text?

Is it okay to store single-use beta keys in plain-text in the database? I'll be pre-generating and storing about 2M keys. The keys get passed around so that people can sign up with it, rather than let ...
1
vote
1answer
135 views

What are the risks of encrypting a database with a single symmetric key

An application is required to store sensitive data* on each user. Additional columns are added to the database which store cyphertext encrypted on the application server. The algorithm of choice is ...
0
votes
1answer
22 views

Diceware & Database hosting

I'm currently setting up a new SQL database with DotEasy as my Hosting/Database provider. I've heard a lot about Diceware being one of the best methods of creating a really strong password, so I ...
2
votes
0answers
23 views

Are foreign keys linking to a table with PHI considered PHI under HIPAA?

Table 1 has PHI and it's encrypted. Table 2 doesn't have PHI, isn't encrypted and has a foreign key to Table 1. I'd like to recommend the strongest security. If there's a requirement in HIPAA, it's ...
1
vote
0answers
69 views

Proper credit card encryption for use in a blacklist

I have a general encryption question. I have read through many of the encryption related questions here and I can't find any specifically addressing my concern. This is the hypothetical scenario: I ...
1
vote
0answers
103 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
1
vote
0answers
180 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
1
vote
0answers
43 views

Storing Tenants Cloud Keys In a Database

Imagine you are building a public service where you need to store the customer's cloud credentials(like their aws secret and access keys) in your database to regularly use by your backend services in ...
1
vote
0answers
159 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
0answers
21 views

Specification Document

I have been asked to research on a certain database then write down a specification document which covers Authentication, Authorization and Encryption. Has anyone ever come across such a ...
1
vote
0answers
51 views

Secure 'pg_settings' for PostgreSQL

I have been looking for some kind of hardening guide towards PostgreSQL which I can use for a security audit of a PostgreSQL DB. I came across this url, have checked the same. Anything more to this?: ...
1
vote
0answers
150 views

Security considerations for SQL database with employee data in blob field

With elevated SQL permissions, I am able to export a blob and retrieve a pdf with employee data (SSN) from a SQL Server database. This database is a backend to a third party web app we use internally ...
0
votes
0answers
31 views

Amazon Web Services - Relational Database Service - Security Scan

My company is utilizing AWS for it's infrastructure including Mysql RDS instances for our databases. Everything we have is in a VPC and requires access through our VPN. Our databases are all not ...
0
votes
0answers
59 views

Private data encryption in database in case there is no password

I am currently investigating the architecture of the secure, but user friendly service, which combines storing of sensitive private data together with simple authorization procedure. The approach ...
0
votes
0answers
193 views

Starting database security for web app that logs in with Facebook/Google JS SDKs

I have been making a web app that uses Facebook and Google JavaScript APIs to login (no email login) on the client side and currently it accesses a localhost MySQL database directly using PHP and ...