I have an application wich needs to connect to the main database. I want this application to be accessible from outside the enterprise network. I think that the best way is to install the app in a SQL Server 2012 Virtual Machine with just this app, and somehow make this app visible from the internet.

The idea is to somehow configure the firewall to let just some MAC addresses and PC names (if more security could be added better) to be able to connect through a port and then execute the app.

I don't know how secure this would be or how to do it. Is this a proper way to do this, or is there a better way?

  • This would be very insecure. Access control through a MAC address can be easily circumvented. Just take a look at the many ways to change your own MAC addr. This question is also way too broad. I would recommend reading some online materials and then posting a question.
    – pm1391
    Mar 19 '18 at 12:34
  • I don't know what you mean by "app" I was under the impression that SQL Server was a relational database, not a virtualization platform. I do know that MAC addresses are easy to forge and do not traverse routers. Given that this does nothing to control access across the internet, there are lots of "better" solutions but you've told us nothing about the constraints.
    – symcbean
    Mar 19 '18 at 13:10
  • @pm1391 Thx, we have a desktop application where people enters the work they have done, as some of our workers work for several days out of the office, we are looking for a secure way to grant access to that aplication from internet.
    – U. Busto
    Mar 20 '18 at 9:54
  • I would take a look into a VPN then rather than opening up to the public internet. You can give your users usernames/passwords and track them pretty easily. best of luck
    – pm1391
    Mar 20 '18 at 13:11
  • @pm1391 VPN seems a good option, i will read more about it, thx
    – U. Busto
    Mar 20 '18 at 13:54

Please see my comment but hopefully this will provide you with a answer to get you started in the right direction. First, securing a application in the first place is not easy. Securing an application that is open to the Internet has the same principles, but is more difficult and certainly exposes you more. I would first question whether you need this application open to a outside network. If you do, I would recommend seeking help from someone because it is a big task and you do have persistent data stored in a database.

To explain why your current scheme is insecure, I'll offer a analogy. Restricting access via a Mac address is the same as restricting cars (via their license plate) onto a gated community. Sure, you have some access control, but its pretty easy for me to fake a license plate and slap it on my car to get pass your mac addr filter. The idea is to have multiple layers of defense. In this analogy, my house (inside the gated community) is your application. First, The gated community restricts users based on a more general field (ip address) commonly called a white list. This can be bypassed so the next layer would be your true user access control (aka your house door lock). Each user has a username and password so that anything they do can be traced a linked to them. If they do not have a username and password, they obviously can't get access to your house or application in this analogy. Once they get pass your house door lock, certain users might be restricted and can only access certain rooms in the house with their credentials. You can see how this becomes complicated.

The general idea is to create multiple levels of defense so that a attacker has to work very hard and "win" multiple times before getting access to anything. As always, this depends on how sensitive the application is. The more sensitive the data, the more controls that are placed. Please read about developing a threat model before starting. Best of Luck!

  • Thx fro your time, that seems interesting, we will keep thinkig on a secure way to do that, maybe using email parser or something like that
    – U. Busto
    Mar 20 '18 at 9:55

Security should always be implemented in layers

First consider perimeter access control. Network isolation through a combination of an isolated publicly accessible VLAN also known as a DMZ with strict ACL's to control ingress and egress routes to said network segment.

Next consider use of TLS or SSH based tunneling to the exposed application to protect the in transit data and authentication/authorization of said application.

Defense in-depth is always a layered approach to protecting that which is in-transit and that which is at rest.

Not the answer you're looking for? Browse other questions tagged or ask your own question.