Tell me more ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.
up vote 2 down vote favorite
1

Currently I have an internal CRM application that houses all my data and runs my entire company. The front end is ASP, and the back end is SQL. The external site will run SQL

What I'd like to do is to have an external site for customer's to log in, manage their accounts, etc., but I am very concerned about my data and data security. Are there any best practices that I can follow to "replicate" data to the external databases? Are there some suggested methods people have done in this scenario?

My goal is to have the two databases linked with certain data. Changes inside would be queued somehow to the outside, and vice versa. If it is live, that wouldn't be the end of the world either.

share|improve this question

1 Answer

up vote 1 down vote accepted

The method I'm familiar with would be to to only have an internal database. The firewall separating your internal and DMZ networks can be configured to only allow appropriate communications through, in your case 1443 (or your SQL port) between the web server and database.

However, you can't simply rely on your firewall for security. Proper SQL permissions would be necessary to only allow access to your web data. And of course you should be validating user input to protect against SQL injection.

If you do want to go the replication route, check out the MS offerings such as SQL Server Transactional Replication.

share|improve this answer
Thanks for the advice! I was going to do an internal database initially but my apprehension is that any opening in my perimeter is just another place for a problem. My data contains customer information, social security information, credit card information, so I "feel" as if having a complete separation from the outside is ideal. However, I do know that there are several downsides to having two sets of data floating around. – RogueSpear00 Mar 26 '12 at 21:33
Have you considered moving the sensitive data to another instance? That way you could still allow your external app access to the data it needs, without worrying about your important data. Also, disregard the part about SQL replication, that would also require a pinhole through your firewall. – Colin Mar 26 '12 at 22:46
Hm, ok, so I could create a new instance on the current server with permissions to particular data sets, and have the external application interface with that - Is this what you're suggesting? – RogueSpear00 Mar 27 '12 at 14:37
I was thinking a separate server, but you could do two instances on the same hardware. I'd suggest having them listen on different ports, then setting your firewall rules to only allow communication over the port for the less sensitive instance. – Colin Mar 27 '12 at 19:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.