2

We build software which needs a SQL SERVER database. This database will hold private user information (address,bank, ...)

My question is: Should I install my database in a fresh SQL Server instance, or can I use an exiting instance?

(I doesn't want to wast user resources but also want to deny unauthorized access)

3

If the existing database has strong security controls then there's no reason to have a separate one. If there are not strong controls on the existing database, and setting up strong security controls is not possible on the existing database then you will need to have a separate database to better protect the data.

  • so because we will not know if they are using strong security controls i will have to use my own instance to be 100% sure i did my best to protect the information right? or should the user decide the installation mode? – WiiMaxx Aug 4 '14 at 14:48
  • 1
    If you can't be sure of the other database's security then another database would seem prudent. If you are doing this as a job for a client you should probably consult them. – GdD Aug 4 '14 at 14:53
  • Simply creating different users and managing permissions to the database in question should be enough, if the server hosting SQL Server is well controlled, as @gdD said. E.g., if the database server is exposed to a public IP, that's not good for your database. If the server is on an internal network and believed to be in good standing, you could just create a new database on the existing instance. Security is per instance OR per database, depending. The database could also be encrypted. If the new instance ends up being on the same box, that's not going to be much better. – ps2goat Jun 3 '15 at 5:45
1

Quite frankly, your first stop should be a well regarded pentest company.

Given the nature of your question, I would want to see some evidence you've managed to secure your network first.

Afterall, if you've got a network that looks like a piece of Swiss cheese, it really doesn't matter how many SQL instances you run or how many servers you run them on !

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.