I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm currently focusing on any security features related to the Database. What are the main requirements needed to be able to achieve a secured environment on the database level. The top factors i could think of are the following :

  1. Account used by the application to access the database (least privileged user account).
  2. Encrypted database.
  3. Control the access rights on the database.
  4. Data in the database should be hashed.
  5. Control the access rights on the server.
  • Do the clients communicate directly w the database or with an application on top of the database? Commented Nov 19, 2013 at 20:08
  • @NeilMcGuigan Yes direct communication. Commented Nov 20, 2013 at 10:46

2 Answers 2


In addition to what you have already listed, you should validate all the data passed to the database. Unvalidated input can lead to persistent cross-site scripting or SQL injection.

How to validate input passed to database:

  • Identify application inputs
  • Identify database entry points
  • Create and use validators
  • Use Type-Safe parameters in SQL statements (Stored procedures and Parameterized queries)

Logging and monitoring is another improvement. You can take action in case of any abnormal behaviour. For instance you can apply a set of rules to respond when your application makes a suspicious behaviour.There are tools/products which montiros database activity and protects them with a set of preconfigured defenses, and helps you build a custom security policy for your environment. You can search the web if you don't want to build yourself.

Additionally, you can use a host-based intrusion detection system such as OSSEC for log analysis, file integrity checking, policy monitoring, real-time alerting and active response.

  • Vulnerability scans were performed on the application level and vulnerabilities are handled. Wouldn't that cover XSS and SQL injection ? Commented Sep 27, 2013 at 7:31
  • If the scans you performed are capable of covering XSS and SQL injection attack, it may be sufficient. I editted and expanded my answer. Commented Sep 27, 2013 at 8:57

If you can, a best practice is to handle all database logic with Stored Procedures and grant the account that accesses the database access to only the stored procedures, this will help prevent a hacker that gains access to the application from directly accessing tables. Moving business logic to stored procedures can also improve performance if it reduces the number of calls the application has to make to the database. Never use dynamic sql, again, that opens you up to SQL injection and also hurts performance because it doesn't take advantage of cached query plans. It's also a best practice to encrypt your stored procedures.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .