SQL Server is Microsoft's relational database management system (RDBMS). It is a full-featured databse primarily designed to compete against competitors Oracle Database (DB) and MySQL.

learn more… | top users | synonyms

8
votes
1answer
5k views

Is an encrypted connection to MS-SQL Server really safe?

Quick intro: Small company, VERY limited resources. I pretty much do everything including coffe. I am a programmer, not a security guy. That's why i ask you... We have an MS-SQL 2008 Database ...
4
votes
2answers
327 views

With full access to the disk of an IIS web server, could you access the database server?

Here is a theoretical setup: You have a web server running Windows Server with IIS You have a website running here which connects to a database This website can start automatically when the server ...
3
votes
2answers
664 views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
2
votes
1answer
514 views

Does SQL Server CE 4 decrypt data securely?

I am going to store data in an encrypted SQL Server CE 4 database, where the database is doing the encryption. (Note that SQL CE is the embedded version, not the fully installed server.) When the ...
0
votes
1answer
1k views

What AES mode does SQL Server 2012 use?

I looked at this link that shows how to encrypt a SQL column via a certificate (RSA??) and AES256. I created a dummy table (script at GitHub) intentionally using identical plain text (Credit Card = ...
1
vote
2answers
2k views

UNION SQL Injection

I'm trying to demo SQL Injection with a UNION query but I'm not getting results. This is the C# code and the database is SQL Server 2008 R2: string cString = "server=.\\sqlexpress; ...
1
vote
1answer
680 views

Setting up ASP.NET web application on internet for first time; Are these security measures enough?

I have a web application running on IIS 7 in offices on LAN and I wish to upload it to hosting space on (Godaddy) because I like it to be used in my other offices (other cities). This application ...
1
vote
2answers
317 views

Good Practices to secure a Gaming Web Server, Memcached Server & MySQL Server

We have developed Game for Facebook platform. We have several Gaming Web Server, Memcached Server & MySQL Server. Here we have to work with facebook Payment API. We need to secure enough our ...
2
votes
0answers
1k views

Hack scenario when a person has a non-superuser shell [closed]

Suppose that there are following three machines in the network: Machine A: Microsoft Server 2003 Service Pack 2 FileZilla 0.9.29 beta ftp server (TCP 21) Mcafee ePolicy server (81), remote desktop ...
2
votes
2answers
192 views

E-mail Server Security

In recent news, Bitcoinica was compromised by an e-mail server infiltration. The hacker then applied social engineering, using one of the administrative e-mail accounts to reset the root credentials ...
2
votes
1answer
190 views

Is Creating a Restricted Database User in Microsoft SQL Server Decent Protocol

Forgive me for the heavy metaphor but it's a situation's complexity kind of goes over my head. Assume I'm Leonard Shelby (My short term memory only lasts 5 minutes). I'm a freelancer that reads ...
1
vote
2answers
615 views

Microsoft SQL server 2000 sp3a - isn't it oudated?

I just noticed that many servers use Microsoft SQL server 2000. But isn't 2000 outdated by 2003? Why are people still using 2000? Would there be any serious security vulnerability by using Microsoft ...
0
votes
2answers
78 views

Solution to site database [closed]

Our warehouse site desperately requires a database that runs efficiently, is secure and we can modify ourselves. Unfortunately the Company's policy does not allow any servers on site, only at ...
4
votes
2answers
1k views

Security web scanner tool for IIS/SQL Server

I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however ...
4
votes
2answers
213 views

Is this a safe way to connect to a server

I am using a software to backup my website .sql data every 3 days and it connects simply to the server logs in and downloads the .sql file to my computer. While its downloading the connection is not ...
16
votes
5answers
9k views

SQL field level encryption, how safe is it?

I am considering encrypting my database and/or encrypting only certain columns in a few tables. Is it worth the time? I mean, how much of a burden would it be on someone if they were to get a hold of ...
1
vote
1answer
361 views

Safe to store access details in a session?

Background I am about to create a website which will have a registration/login area. After the user has logged in he/she will have the ability to buy one or many modules which consist of static ...
3
votes
4answers
2k views

Is replacing all apostrophes with two apostrophes sufficient to prevent SQL-injection on MSSQL?

I'm working in a web site that doesn't use parameters on SQL queries. All the queries are adhoc and the way they are doing the input validation seems good to me, I'm not able to break it to do SQL ...
10
votes
3answers
6k views

How secure is the traffic with Sql Server Management Studio?

I was just using Sql Server Management Studio on my WiFi, and I was actually wondering how secure the traffic/database communication is. Is traffic from querying secure, or is it easily sniffed for ...
9
votes
4answers
829 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
5
votes
1answer
271 views

Using AD authentication in a publicly accessible webapp

I am sys admin working with a development team who is extending a publically accessible .net web app that currently uses forms authentication with usernames/passwords (hashed) stored in a sql ...
6
votes
3answers
2k views

IIS and SQLServer Hardening

long story short: I'm an engineer doing development, not administration. I have no direct access to the production server, so I can only tell the administration team the best configurations for ...
10
votes
2answers
1k views

Online SQL Server database for a Business app. Security considerations

A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...