0

I run a multiplayer gaming service that provides a server list for clients and servers. At the moment it uses an SQLite database stored locally (which is insecure in itself). I am drawing up plans to convert it to either MySQL or Microsoft SQL Server in order to provide redundancy and also the ability to view real-time server statistics online.

Now, knowing that a single database is a disaster waiting to happen (plus it is a gigantic attack vector, too) I plan to introduce redundancy by:

  • Having two database servers, one for internal and one for web (web will be a slave to internal, but the flow of data will not be bidirectional);
  • Web database will be completely cleared and regenerated when data duplication takes place from the internal database;
  • Web will not have account information stored on it;
  • Non-default ports will be used and the firewall will be restricted to only allow specific hosts to connect;

Am I being over-zealous with my security precautions, or should I be adding more layers of security?

Some statistics that may influence any answers:

  • 44.8% of players are Russian;
  • The service sees around 50 billion requests (admittedly they're small) each month;
  • There are around 50 new users each month, with this number steadily increasing (and will see a spike in a couple of months when I start advertising it);
  • It runs on AWS EC2 servers (I plan to use AWS RDS for the databases)
  • 1
    Why MySQL or M$Sql over Aurora? – Robert Mennell Jun 16 '16 at 20:02
  • @RobertMennell MSSQL for me is easier to use (more experience), and Aurora is something I'm considering. – AStopher Jun 16 '16 at 20:03
  • 1
    If you can use MySQL Aurora is the way to go. Then you can have triggers all over the place. – Robert Mennell Jun 16 '16 at 20:05
  • @RobertMennell M$Sql – TessellatingHeckler Jun 16 '16 at 22:38
1

I suggest a more proactive approach as well by doing your own penetration testing against a non-production server setup specifically for this sort of thing.

We use BurpSuite's scanner feature to test our own products - it has really helped augment our quest to find vulnerabilities. ZAP is a free alternative I've heard good things about, but have not personally used it. Pay particular attention to any SQL injection issues they identify.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.