2

I'm currently trying to research which get compromised more often; databases or codebases? My guess would be that databases are the obvious answer and most of the time easier to compromise, because of an plethora possible attack vectors. I imagine codebases are harder to compromise since they are usually located on a server which should have better security in general than some flunky website that's vulnerable to SQL injection or other techniques.

However, I need to have a source for this and am having some trouble finding one. I'm not sure if this would be considered opinion-based or off-topic, but I was hoping some of you might know some studies that dig in to this. I would also be happy with some numbers from an article, or a better way of searching for the information.

Specifically I'm looking for cases where the attacker is able to view the code used for the program (for example by gaining access to the developers machine, or breaching a server and having a look at the files).

closed as too broad by Steffen Ullrich, Deer Hunter, Ohnana, Rory Alsop Feb 1 '16 at 15:53

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    A good source for such info is the Data Breach Investigations Report – paj28 Feb 1 '16 at 9:18
  • 1
    This isn't off-topic but I can't find of any good methodology to answer your question. The DBIR cited above would be the closest to an objective global assessment that is available. Never seen papers on how many e.g. Github repos contain malware or on how many servers run purposedly broken code. – Steve Dodier-Lazaro Feb 1 '16 at 10:10
  • 1
    @SteffenUllrich Damn, guess I'm still not specific enough. My main interest would be for keys and passwords stored in files in comparison to a database. For example; would it be safer to store a key for a service (let's say... an SMS sending service as example) in the codebase or in a database? This would be mainly server side languages I'm talking about, so no JS or HTML worries. My idea is that, since (I think) codebases are less often compromised (viewed) it would be safer to store them there, than in a database of sorts. – Bono Feb 1 '16 at 11:09
  • 1
    @Bono Service keys belong into neither. Any secret credentials should be a part of the configuration. Which leads us to a third attack target: configuration files on the production machine. – Philipp Feb 1 '16 at 11:30
  • 1
    While this is an interesting topic the discussion here suggests that the current question is too broad. Therefore I recommend to close it and to create a new question (unless it exists already) about how to store the necessary secrets in the best way. – Steffen Ullrich Feb 1 '16 at 11:36