I work for a government agency, and we've been requested via a freedom of information request for the layout of the tables of one of our systems, a data dictionary and schema design request.

What are the dangers in sharing this? My initial concerns are need to know concerns, making SQL injection attacks much easier, and a bunch of starting information for future vulnerabilities (ie, maybe a bug is introduced later that only affects varchar columns over 500 bytes in length... here's a handy list of all of ours!).

What else is of concern? I don't want to be an obstacle for the sake of being an obstacle, but as a DBA, this makes me REALLY nervous.

  • I didn't know what a freedom of information request was, so I just googled it. But are you really required to provide that kind of information? Database layout? Why should anyone have the right to know that? – reed Jun 21 '19 at 20:51
  • @reed FOIAs are very powerful. There needs to be a pressing reason not to provide the information. – forest Jun 23 '19 at 5:06

It's probably not a security issue. For context, think about open source software. When you have an open source application, the application source code and database schema are completely public; anybody can take a look and review them in as fine a detail as they care to. Organizations stand up and run instances of that very same open source software all the time, and no intrinsic security vulnerabilities are introduced merely by the public nature of the code/schema. It's true that vulnerabilities can be found by reviewing source, but even in this case I'm hard pressed to think of a security issue that has ever been found solely in a database schema and/or data dictionary.

So, as long as things like the table and column names, and data dictionary definitions don't intrinsically contain sensitive information or data, I don't see a security concern here.

That said, you may have an out in any case. Your schema is probably not subject to FOIA. It looks like application source code (and similarly a database schema) is generally not considered an agency record, and so would not be eligible for release under FOIA.

|improve this answer|||||
  • I would recommend directing OP to Law instead, since providing legal advice is a bad idea. – forest Jun 23 '19 at 5:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.