My question is prompted by the fact that WinHost.com has some really cheap shared hosting for SQL Server where you don't need to manage your own Virtual Private Server. Unfortunately there is no firewall so you can access the server from anywhere on the net as long as you know the username and password.
Personally, I'm not bothered by this for a startup project (which is the context of this question). Seems like a perfectly reasonable way to cut costs until you start making money. But there are others who would look at this like it's just the worst security catastrophe in the world just waiting to happen.
I can think of a few things that might happen.
- Brute force attack.
- Denial of service attacks.
- Someone somehow gets a hold of some credentials to login, and now they can because their IP isn't blocked. This seems like the biggest problem to me... particularly if you have sensitive information.
For 1) this is not going to happen if you have a strong enough password. 2) would just be an annoyance as worst case scenario you move your database to a more secure hosting service. 3) Seems like the only real threat in my eyes.
So if I was presenting this as an option to someone who wanted to get a solution developed cheaply but wanted them to be fully aware of the risks, would this pretty much cover the possibilities or am I missing anything significant?