Security related aspects of databases and database access.
0
votes
1answer
22 views
Are there any secure ways to store the secret key used in a TOTP scheme?
I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash ...
1
vote
0answers
50 views
Store which parts of an IP address, for user to remain anonymous?
I'm thinking about building a very anonymous forum, where people can comment and upvote each other's comments anonymously. People are supposed to remain anonymous even if the forum's database contents ...
0
votes
2answers
101 views
What is truly unbreakable these days? [closed]
Just very curious, count my knowledge in cryptography, algorithms, and security in general as non-existent. Now I am aware that this might be a VERY broad question, but here it goes. What is the most ...
0
votes
1answer
41 views
Application Server <-> Database Firewall [closed]
What threats can a firewall between an application server and a database server mitigate that would not otherwise be mitigated when both the database server and application server are behind the same ...
4
votes
3answers
160 views
What is a good rebuttal to users who wish all data WITHIN Db be encrypted?
I am building an application in VB.NET (WinForms) utilizing SQL Server 2008 R2 as a Backend.
The application is to track employee's money they defer each paycheck, or month, to deposit into separate ...
0
votes
0answers
22 views
Why is it not advisable to have the database and web server on the same machine? [duplicate]
I'm bringing this across from a question on stackoverflow, but I'd like to focus specifically on the security aspects of it (and not the performance, etc..).
My hypothesis is that the cost of ...
0
votes
1answer
40 views
Should I encrypt Long-lived Facebook Access Token when storing them in my DB?
I own an application that grabs some Long-Lived Facebook Access token, in order to be use later according to the corresponding logged user.
Should I need to encrypt them before storing them, to avoid ...
0
votes
0answers
14 views
Secure 'pg_settings' for PostgreSQL
I have been looking for some kind of hardening guide towards PostgreSQL which I can use for a security audit of a PostgreSQL DB.
I came across this url, have checked the same. Anything more to this?:
...
0
votes
1answer
34 views
Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [closed]
As part of hardening a MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed.
For a server that is serving only as a MySQL server, what services and ...
0
votes
2answers
76 views
What are the Standard Practices for Securely Storing Encryption Keys in Databases
I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ?
To add a ...
17
votes
4answers
3k views
What can an attacker do if he knew my database credentials?
If an attacker knows my database username and password, what can he possibly do if he doesn't have access to my server? Let's say my database is using Microsoft SQL Server. Is there a way he can use ...
1
vote
3answers
106 views
How can I prevent my database from being compromised if my CakePHP app is compromised?
I have an app server hosting a CakePHP app and a database server hosting the databases. The servers are physically separate. The databases contain encrypted sensitive information. The encryption keys ...
0
votes
1answer
56 views
A Question about Database Encryption [closed]
I've been looking around for an answer to this for some time now and I felt that this place would be a good venue to ask this.
How can one improve the security in a MySQL database?
The database that ...
1
vote
1answer
138 views
Best practice for data security on a web application
I read a couple articles on privacy/security but still cannot get a clear picture of the best practice to ensure that an attacker will not be able to access users' private information.
For storing ...
1
vote
1answer
51 views
PCI DSS compliance for storing PAN and PII in multi-tenant environment
I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the ...
4
votes
4answers
244 views
avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?
Summary
Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
2
votes
1answer
64 views
PCI Complient Storing Credit Card Data On Offline Tablet
I have a client that does work in rural areas where there are no cellphone or internet connections. They need a way to take credit card information in the field, bring it back to their office where ...
2
votes
2answers
65 views
How do vulnerability reports work?
I'm really interested in IT security and I would like to know how vulnerability reports work.
Is there a central database for those things? I often see CVE-XXX-XXX on disclosures, but I don't ...
1
vote
2answers
77 views
How to securely provide data to a web server using a data warehouse?
We have a data warehouse that stores prices for our products. Once every business day, new data points are added representing the day's price for each product.
On the website, a user sees this ...
3
votes
1answer
237 views
Encrypt user data when they log in with Facebook, Gmail, etc
I made a login system. The user can login by:
using a normal email / password (bcrypted).
using a service like facebook, gmail, etc.
So far so good. Now I want to store sensitive information (ftp ...
0
votes
0answers
47 views
Security considerations for SQL database with employee data in blob field
With elevated SQL permissions, I am able to export a blob and retrieve a pdf with employee data (SSN) from a SQL Server database. This database is a backend to a third party web app we use internally ...
1
vote
1answer
141 views
What does Gazzang zNcrypt actually protect against?
In an effort to increase security of our website, I'm reading up on Gazzang zNcrypt, which claims to protect data in databases from breaches.
Technically, it seems to do filesystem encryption. As far ...
4
votes
1answer
59 views
Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks?
Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks?
Reading the "What Are the Oracle Database Built-in Password Protections?" from ...
1
vote
0answers
170 views
How to secure API (private key) for mobile apps
I am building a web service that has to be only accessible for iOS apps.
In the future I want to expand to a mobile website to make my service also available for other mobile operating systems.
Now, ...
4
votes
2answers
102 views
Data integrity of malicious content in the database
From a data integrity standpoint, if I persist the following code into my database:
<script>
alert('hi');
</script>
should I sanitize it before persistence, for instance making ...
-1
votes
1answer
50 views
Network and data security for small online businesses? [closed]
What is the most efficient way of protecting small online business from outside threats. Everything too much expensive is not a solution.
I've been looking for good web application firewall and at ...
1
vote
1answer
72 views
Security risks if a server in not supported anymore
I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements.
What are the security risks that we might ...
0
votes
1answer
146 views
How to secure and limit access to a web based application hosted on a local server
I have security concerns over a web based application. I want to limit access to the application only to a whitelisted IP addresses. Here are my thoughts on that:
To host the application myself.
The ...
2
votes
3answers
452 views
Is “Why Should You Avoid AES In MySQL?” true?
From a 2012 Smashing Magazine article quite a bold statement is made to avoid AES in MySQL itself. Or as they put it "Why Should You Avoid AES In MySQL?". However, if you search for SQL encryption, ...
-2
votes
1answer
60 views
Should I do science of computing or systems analyst? [closed]
I want to become a federal analyst of cyber crimes and I dont't know what's the right university course for me, I would like to know what's the cons and pros of choosing one or another course and ...
6
votes
1answer
242 views
SQL Server of my hosting provider allows me to see all databases. How secure is my mine?
My hosting provider allows access to its SQL Server. When I connected to it by SQL Management Studio, all hosted databases were visible.
I can't get the details on these databases, I get this ...
4
votes
1answer
169 views
How secure is MongoDB wire protocol?
I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
1
vote
1answer
57 views
How to restrict access to a resource based on frequency of access?
I want to restrict access to a particular resource based on time (configurable). So suppose user A has time t configured from him. He can access the resource only once every t time units. The values ...
3
votes
1answer
162 views
Theory about split data in several isolated (different physical server) DBMS to gain in security?
Suppose the following scenario:
1- A web app (on WEBSERVER1) and its database (on DBMS1) having very sensible information deployed in the same physical server (lets said that for simplification). ...
1
vote
1answer
60 views
Oracle database privileges [closed]
I have a 10.2.0.5.0 Oracle Database and a list of users who i need to grant some privileges to (Mainly to generate reports and so on).
I used impersonation, which means i created one Oracle user so ...
1
vote
2answers
149 views
Main requirements to secure my Application in any database related features
I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm ...
8
votes
2answers
238 views
What's ownership concept for?
I fail to grasp the necessity of using concept of owner (ownership) and find clear explanation of its necessity.
What cannot be done without concept of owner(ownership) in filesystem/database object ...
3
votes
3answers
177 views
How do poor-quality initialization vectors affect the security of CBC mode?
(If the consensus is that this question belongs on crypto, rather than here, please feel free to [tell me to] migrate it.)
From what I have read (looking specifically at AES in Cipher Block Chaining ...
1
vote
1answer
61 views
Hybrid Encryption System - Is this unnecessary in this case? [closed]
I have a column in my database that I need to encrypt. The column can contain any arbitrary data.
What I am thinking is to generate a public and private key pair first. Store the public key in a ...
4
votes
1answer
271 views
Is Postgres password-based authentication secure?
According to Postgres's documentation, Postgres's password authentication method uses MD5 hashing to secure the password:
The password-based authentication methods are md5 and password. These
...
4
votes
1answer
220 views
HIPAA: How am I required to secure PHI database access creds on my web server?
Assuming I have a database of PHI that my web application needs to access, how am I required to secure the credentials on the webserver that the web application uses to access this database?
Is ...
0
votes
1answer
71 views
What are the risk associated with granting full permission (Any) to DB Admin users to the Database?
Usually in a well controlled environment, Database Admins are granted specific rights like Read, Modify...etc. No one has the right (ANY) to perform on any Database. Certain requirements dictate to ...
3
votes
6answers
281 views
Ban or delete abusive users [closed]
I'd like to hear recommendations on a best practice for handling abusive users (for whatever reason) on an authenticated Website.
Is there any point in keeping the user in the database with a ...
4
votes
3answers
450 views
MS-SQL Monitoring/Auditing of PHI for HIPAA
We're currently looking for a solution (hardware or software-based) that can monitor and audit all PHI viewing activity per new HIPAA rules. We use MS-SQL for our production database. We have the ...
2
votes
2answers
450 views
IS TDE PCI-Compliant?
According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
5
votes
2answers
438 views
If encrypted data in a database are accessed by application, does that mean that the application has the decryption key?
I'm using an application linked to a database which holds confidential data (numbers). According to the developer, this data is encrypted. However, i can easily generate a report that will show the ...
6
votes
2answers
251 views
Can a web application administrator access the database of that application?
We have a web application linked to a database. The database is secured but contains unmasked confidential numbers. Can a normal administrator who can access the application, access those numbers in ...
5
votes
1answer
3k views
Building a web app with encrypted MySQL database entries?
I have some experience in building PHP based websites with MySQL access, storing encrypted user details, but all other fields being plain text. My most recent project will require sensitive data to be ...
1
vote
2answers
221 views
Least insecure way to encrypt a field in the database so that it can still be included in queries
I have a table where all columns need to be encrypted (aside from the PK). This will be achieved using AES at the application level. However there is one particular field that needs to remain ...
1
vote
1answer
393 views
How to secure database table of users for an application?
I am working on a Windows application that utilizes a MySQL database for its user authentication and data storage.
Within the application, the highest level of user (Administrator) can create and ...
