6

My question is prompted by the fact that WinHost.com has some really cheap shared hosting for SQL Server where you don't need to manage your own Virtual Private Server. Unfortunately there is no firewall so you can access the server from anywhere on the net as long as you know the username and password.

Personally, I'm not bothered by this for a startup project (which is the context of this question). Seems like a perfectly reasonable way to cut costs until you start making money. But there are others who would look at this like it's just the worst security catastrophe in the world just waiting to happen.

I can think of a few things that might happen.

  1. Brute force attack.
  2. Denial of service attacks.
  3. Someone somehow gets a hold of some credentials to login, and now they can because their IP isn't blocked. This seems like the biggest problem to me... particularly if you have sensitive information.

For 1) this is not going to happen if you have a strong enough password. 2) would just be an annoyance as worst case scenario you move your database to a more secure hosting service. 3) Seems like the only real threat in my eyes.

So if I was presenting this as an option to someone who wanted to get a solution developed cheaply but wanted them to be fully aware of the risks, would this pretty much cover the possibilities or am I missing anything significant?

8
  • 1
    Are you tied to specifically SQL Server? The hosting I typically use (which at the basic level works out to a few $ per month) includes MySQL with default being open only to the hosted server but allowing turning Remote Access on if you want it (and to a certain degree "at your own risk"). If you limit access to only the hosted server (which would either be on the same server as the database or within a small protected group of servers) then the risks go way down. But I don't know if there are hosts offering similar for SQL Server. Mar 8, 2021 at 16:51
  • 2
    I'm normally all for, "Depends on your risk tolerance", but only having the option of a database server open to the internet? That's just not worth the convenience, and is a terrible idea in direct contradiction to best practices. Go somewhere else. Mar 8, 2021 at 17:02
  • "only having the option". Thankfully it wasn't the only option for the project in question and we didn't go with it. Originally we thought our option with Azure would be $300/mo but we found a different option for about a tenth of that. The "expert" managing our Azure stuff was sadly a bit uneducated about the available options we had, but he did eventually figure it out. For an app in early development with only a handful of real users who aren't being charged anything though, I would take the WinHost option at $15/mo over $300/mo if "just don't do it" was the only sort of responses I got.
    – BVernon
    Mar 8, 2021 at 18:28
  • 3
    That is, I'm the sort of person that I have to know the specifics about the possibilities and then be able to present that to a decision maker. I never want to say "it's just not worth it... but I can't tell you specifically why... but just don't do it because lots of people say so." I think that's terrible. If I have to rule out an option, I should be able to say exactly why, and that's the point of this post. I don't care if the end of it is that I will end up justifying why we should never do this rather than why we should consider it. That's fine... but I need to know why.
    – BVernon
    Mar 8, 2021 at 18:32
  • 1
    If you "can't" afford the lowest tier of Azure hosting for a single DB, you don't have a startup; you have lunch money and a dream. It's never worth it to cheap out on fundamentals.
    – Ian Kemp
    Mar 8, 2021 at 22:11

4 Answers 4

6

First hoping that IP address control can add strong security is kind of a brave assumption. IP theft should always be considered as a possible attack.

Next, if there is no firewall at all in front of a SQL server, the most serious risk is not legimitimate requests (i.e. with a correct username and password) coming from unlegitimate origins, but rogue attacks targetting possible flaws on the server itself, like unpatched vulnerabilities, or unwanted services left opened. This one would really be a risk on a production server.

Finally, end users should not directly connect to the database server on modern systems. A database server is a very large piece of code that admins prefere to hide behind an application server which is the only system that directly connects to the database. But if the application server and the database server are not in the same datacenter, the security of the database is only provided by its passwords. Full stop. At best, you could try to setup a VPN between the application host and the database server to provide an additional security layer, but I do not know whether it is an option on WinHost.

In the end, all this will boils down to security has a cost and the higher the security, to more expensive. But only you can know whether your security requirements are or not compatible with WinHost hosting: what are the threats, what is the risk/cost if the database is compromissed.

Now for your question:

Someone somehow gets a hold of some credentials to login ...

If you are there, do not worry for IP blocking or not, specially if you have sensitive or valuable informations. It is just time to change all the passwords and control the current data with the last safe backup... IP theft is a thing...

2
  • Great answer. We didn't go with WinHost, but in some respects what you said is encouraging because if IP security isn't to be too strongly considered against an intentional hacker then it means in some regards WinHost isn't really less secure. Our end users don't access the db directly, but only through the application as you say. I agree on the VPN... I didn't get to the point of talking to support, but I'm almost certain it was not an option. Your point about attacks on unpatched server flaws is a very good one and makes me curious to learn of such real world instances... do you know any?
    – BVernon
    Mar 8, 2021 at 18:43
  • 1
    I should mention that I'm certain they have a firewall on the server machine itself... it's only the ports their users need to connect to their SQL instances that are open. So I believe vulnerabilities should at least be limited to what could normally be done through port 1433 (or whatever equivalent ports are opened for their users).
    – BVernon
    Mar 8, 2021 at 18:52
12

There are many vulnerabilities associated with database management systems. Basic security issues include:

  1. Deployment security issues.
  2. Application level (DBMS) security issues.
  3. Abuse of database features
  4. Zero day attacks
  5. Data leaks

When your application is developed, another attack surface will be added to your database.

You can avoid brute-force attacks by using a strong password. But preventing against DDOS is somewhat difficult.

You can show them the risk associated with the system and have them sign to agree to this risk, if they cannot afford to mitigate the risk. But accepting a huge risk is also not acceptable.

3

I don't know how much money we are talking about, but your project should be adequately funded and security shouldn't be an afterthought. I am sure there is enough competition and that you should be able to find a suitable alternative.

The lack of a configurable firewall is a big downside I must say. You often get what you pay for. If you have a strong password, the server should withstand brute force attacks but it will be attacked by bots non-stop, resulting in wasted resources, possibly degraded performance. That's the nature of the Internet, servers are probed and attacked constantly.

But it is always possible that a 0-day for SQL Server will emerge at some point, and that is where the value of reducing the attack surface lies. If only one IP address is whitelisted for access, then the damage is pretty much contained.

Plus, there may be other services exposed on the server in addition to SQL Server. If they are not firewalled they may provide a possible opening for hackers.

I know what you are thinking, you can always migrate later when the project becomes profitable. But the reality of IT projects is that temporary setups very often become permanent, because we are lazy and migration can be a time-consuming experience and disrupting for customers. It's not something that we enjoy doing, we usually do this only when there is no choice because the current setup is no longer sustainable. So I warn you :)

You might as well host it yourself in the beginning, at least you'll have more control but you need the skills to properly configure and maintain the machine.

1

You can and should configure the software firewall on your virtual Windows(?) server. Just allow the ports for RDP and SQL server, and only for the IP ranges relevant for you. Also make sure that your SQL server provides TLS-encrypted connections so your credentials and data is encrypted in-transit.

2
  • I can't with WinHost. They give you an ip to connect to the SQL Server instance and that's it. That's why I'm asking the question
    – BVernon
    Mar 8, 2021 at 9:05
  • 1
    Ok, I assumed that you do not need to manage the VPS, but still have access to. As they are providing the database management for your, WinHost is IMHO responsible for the security in this case. I'd contact their support to provide details on the applied security measures (encryption, brute-force detection, DDoS-prevention, ...) and what you can do on your side.
    – andaris
    Mar 8, 2021 at 9:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.