The sql-server tag has no wiki summary.
3
votes
1answer
98 views
What can be used to keep xp_CmdShell in SQL Server disabled?
It's a well known fact that anyone with "SA" privs can turn on xp_CmdShell and use it and that includes any would-be attackers that can gain access to SQL Server as a login that has "SA" privs. There ...
-4
votes
3answers
103 views
Database connection from front end
I want to know why calling a database from the front end is considered a bad practice for security.
It is really so bad as to justify building an application layer with all its drawbacks: costs, ...
2
votes
2answers
83 views
Implications of using domain\computername$ account to serve SQL data to IIS
One of our coders is trying to get Windows Authentication to work on a new web app that he's developing (.Net 4.0, MVC, via IIS 7.0/7.5).
The application connects to a SQL Server database back-end ...
2
votes
1answer
98 views
Is an encrypted connection to MS-SQL Server really safe?
Quick intro: Small company, VERY limited resources. I pretty much do everything including coffe. I am a programmer, not a security guy. That's why i ask you...
We have an MS-SQL 2008 Database ...
4
votes
2answers
88 views
With full access to the disk of an IIS web server, could you access the database server?
Here is a theoretical setup:
You have a web server running Windows Server with IIS
You have a website running here which connects to a database
This website can start automatically when the server ...
1
vote
2answers
135 views
Encrypting Fields in Database
I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
2
votes
1answer
147 views
Does SQL Server CE 4 decrypt data securely?
I am going to store data in an encrypted SQL Server CE 4 database, where the database is doing the encryption. (Note that SQL CE is the embedded version, not the fully installed server.)
When the ...
0
votes
1answer
128 views
What AES mode does SQL Server 2012 use?
I looked at this link that shows how to encrypt a SQL column via a certificate (RSA??) and AES256.
I created a dummy table (script at GitHub) intentionally using identical plain text (Credit Card = ...
1
vote
2answers
265 views
UNION SQL Injection
I'm trying to demo SQL Injection with a UNION query but I'm not getting results.
This is the C# code and the database is SQL Server 2008 R2:
string cString = "server=.\\sqlexpress; ...
1
vote
1answer
219 views
Setting up ASP.NET web application on internet for first time; Are these security measures enough?
I have a web application running on IIS 7 in offices on LAN and I wish to upload it to hosting space on (Godaddy) because I like it to be used in my other offices (other cities).
This application ...
1
vote
2answers
152 views
Good Practices to secure a Gaming Web Server, Memcached Server & MySQL Server
We have developed Game for Facebook platform. We have several Gaming Web Server, Memcached Server & MySQL Server.
Here we have to work with facebook Payment API.
We need to secure enough our ...
2
votes
0answers
385 views
Hack scenario when a person has a non-superuser shell [closed]
Suppose that there are following three machines in the network:
Machine A:
Microsoft Server 2003 Service Pack 2
FileZilla 0.9.29 beta ftp server (TCP 21)
Mcafee ePolicy server (81), remote desktop ...
2
votes
2answers
137 views
E-mail Server Security
In recent news, Bitcoinica was compromised by an e-mail server infiltration. The hacker then applied social engineering, using one of the administrative e-mail accounts to reset the root credentials ...
2
votes
1answer
93 views
Is Creating a Restricted Database User in Microsoft SQL Server Decent Protocol
Forgive me for the heavy metaphor but it's a situation's complexity kind of goes over my head.
Assume I'm Leonard Shelby (My short term memory only lasts 5 minutes). I'm a freelancer that reads ...
1
vote
2answers
209 views
Microsoft SQL server 2000 sp3a - isn't it oudated?
I just noticed that many servers use Microsoft SQL server 2000. But isn't 2000 outdated by 2003? Why are people still using 2000? Would there be any serious security vulnerability by using Microsoft ...
0
votes
2answers
74 views
Solution to site database [closed]
Our warehouse site desperately requires a database that runs efficiently, is secure and we can modify ourselves. Unfortunately the Company's policy does not allow any servers on site, only at ...
4
votes
2answers
445 views
Security web scanner tool for IIS/SQL Server
I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however ...
4
votes
2answers
139 views
Is this a safe way to connect to a server
I am using a software to backup my website .sql data every 3 days and it connects simply to the server logs in and downloads the .sql file to my computer. While its downloading the connection is not ...
10
votes
5answers
2k views
SQL field level encryption, how safe is it?
I am considering encrypting my database and/or encrypting only certain columns in a few tables. Is it worth the time? I mean, how much of a burden would it be on someone if they were to get a hold of ...
1
vote
1answer
170 views
Safe to store access details in a session?
Background
I am about to create a website which will have a registration/login area. After the user has logged in he/she will have the ability to buy one or many modules which consist of static ...
6
votes
3answers
884 views
How secure is the traffic with Sql Server Management Studio?
I was just using Sql Server Management Studio on my WiFi, and I was actually wondering how secure the traffic/database communication is. Is traffic from querying secure, or is it easily sniffed for ...
6
votes
3answers
175 views
Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?
I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
5
votes
1answer
195 views
Using AD authentication in a publicly accessible webapp
I am sys admin working with a development team who is extending a publically accessible .net web app that currently uses forms authentication with usernames/passwords (hashed) stored in a sql ...
5
votes
3answers
564 views
IIS and SQLServer Hardening
long story short: I'm an engineer doing development, not administration. I have no direct access to the production server, so I can only tell the administration team the best configurations for ...
6
votes
2answers
159 views
Online SQL Server database for a Business app. Security considerations
A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...
