Questions tagged [sql-server]

SQL Server is Microsoft's relational database management system (RDBMS). It is a full-featured databse primarily designed to compete against competitors Oracle Database (DB) and MySQL.

18 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
1answer
474 views

SQL Server Asymmetric Encryption Keys

I have used SQL Server database with data to be encrypted and I will use symmetric key for encryption and will encrypt it by asymmetric key now comes the question how to give user permission to ...
1
vote
2answers
66 views

Private way to connect to my SQL Server database

I'm running on linux and I am using a SQL Server database server on some other machine. My python code has to sit in a directory that many other users have read access to. I also have a "...
1
vote
0answers
38 views

Does TDE not protect against disk theft?

I read the following on Microsoft's site. Can someone please clarify - "With TDE, is the data stored in my data, log, and backup files protected from a disk theft?" Yes, but only if the files ...
1
vote
0answers
171 views

Disk Encryption VS SQL TDE Encryption

I am trying to understand what would be the benefit of using SQL TDE on top of underlying disk encryption. My understanding is that disk encryption will prevent malicious users pulling out the disk ...
1
vote
0answers
81 views

OWASP scan on SQL Server Compact Edition

On running a dependency check on my projects library, the tool reported multiple vulnerabilities in System.Data.SqlServerCe.dll, and CVE-2012-1856 with the highest score of 9.3 The version of the ...
1
vote
0answers
242 views

Nessus ADV180002: Microsoft SQL Server January 2018 Security Update (Meltdown) (Spectre)

I have a MS Server 2012 r2 running ArcServe 17.5, which uses MSSQL Server Express 2014. When Nessus runs a scan of this system, I am getting the plugin 105613 - ADV180002: Microsoft SQL Server January ...
1
vote
0answers
196 views

Sql Server access from DMZ

I'm developing a B2B website open to the internet. I've deployed the website on an application server that is in its own network and is only allowed to communicate to the intranet on two ports: To ...
1
vote
0answers
202 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
1
vote
0answers
161 views

I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?

I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection? In the configuration of the Database ...
1
vote
0answers
89 views

Encrypt SQL Server traffic on a LAN

I have a .NET client application that runs on several machines on a local area network. All machines (including the server which is running MSSQL Server 2016) are running either Windows 7, 8 or 10. ...
1
vote
0answers
115 views

SSRS custom assembly security issues

I want to invoke a custom assembly that uses protected services (like DirectoryServices, etc...) with reporting Services. On the web, I see a recurring example of configuration (inspired by this ...
1
vote
0answers
309 views

Security considerations for SQL database with employee data in blob field

With elevated SQL permissions, I am able to export a blob and retrieve a pdf with employee data (SSN) from a SQL Server database. This database is a backend to a third party web app we use internally ...
0
votes
0answers
44 views

Is whitelisting Google Apps Scripts Actually safe?

Google offers a way to connect it's apps (like google sheets) to a sql server. In order to do this, you need to whitelist their google apps scripts IPv4 subnets. I don't see how this could be secure ...
0
votes
0answers
33 views

Secure access to MS SQL from web applications

MS SQL provides two primary authentication methods, Windows Authentication or SQL Server Authentication. Since local MS SQL accounts are problematic to maintain and monitor this option is not ...
0
votes
0answers
458 views

Windows Firewall blocking local access to SQL Server?

I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
0
votes
0answers
194 views

How to store SSN in asp.net web-based application on a short-term basis?

After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
0
votes
0answers
53 views

SQL RLS for NIST compliance

Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
0
votes
0answers
514 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...