Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

1
vote
1answer
410 views

How to check Oracle database connection encryption type

How to check the Oracle database connection encryption type?(between Oracle database and other client applications)How do I assure between Oracle database and Toad the database connection is ...
0
votes
0answers
236 views

Oracle data obfuscation on specific columns with set field sizes

Would like to obfuscate data held in Oracle tables, but: Requirements only apply to specific columns e.g. personal data obfuscated value should not be longer then column size possibly only ...
1
vote
2answers
163 views

Questions since MySQL Startup

Have a weird question / (bug?) here. Using PHP My Admin I installed via apt-get on Ubuntu 13.10 Versions are as follows: Server version: 5.5.35-0ubuntu0.13.10.2 - (Ubuntu) Apache/2.4.6 (Ubuntu) ...
0
votes
1answer
428 views

PostgreSQL, storing encrypted data or encrypt database with pgcrypto - what is more secure? [duplicate]

I have two machines: client and server (a database server). I want to connect from client to server and manipulate data from database (insert, update, delete, select) using dblink. I would like to ...
0
votes
1answer
32 views

Select permission to each table

I have three schemas Production, HRecourse and Sales,tables in every week create and drop , I have six Users P_User1, P_User2, HR_User1, HR_User2 and S_User1 and S_User2. I have to grant then how i ...
0
votes
1answer
262 views

CHROOT install after I already installed Mysql 5.6

I installed some time ago Mysql 5.6 on Ubuntu server 12.04 and now I'd like to enhance security by putting mysql into a CHROOT environment on that same Ubuntu server. Is this possible without ...
57
votes
5answers
5k views

Do stored procedures prevent SQL injection?

Is it true that stored procedures prevent SQL injection attacks against PostgreSQL databases? I did a little research and found out that SQL Server, Oracle and MySQL are not safe against SQL injection ...
10
votes
2answers
2k views

Limit connection rights on SQL Server

I have an app to deploy in production that uses 'honor system' security. That is, all users connect to the DB using a SQL user/passwd credential and the app manages permissions itself. The latter part ...
1
vote
2answers
141 views

security tools for mysql [closed]

We are using MySQL Community version on Windows and are trying to secure it as best we can. Assuming that changing the version (for example purchasing the Enterprise edition) is not possible in our ...
4
votes
2answers
175 views

Easily give role in one database access to tables in another database on the same server

I have a database server (Sql Server 2008 R2 Enterprise) supporting two separate but related vendor products, each with it's own database (call them X and Y) In database X I a have a lot of users ...
8
votes
3answers
3k views

Is there a way to find out who changed the password for a login?

I am trying to find out who changed the password for a login in SQL Server 2008 R2. I have already checked default trace - and it does not log that event. The default trace will include these ...
2
votes
1answer
584 views

Two “Connect SQL” permissions in SQL Server 2012

What is the difference between these two "Connect SQL" permissions in SQL Server 2012?
7
votes
6answers
1k views

What security threats does the SA account and other known account names pose to security?

Does an known account name like sa, pose a security threat to database? When using windows authentication on SQL Server does it impose the same password policy(if it was set to say account lockout ...
5
votes
3answers
1k views

Does the PCI standard forbid the use of Windows Authentication?

We currently use Mixed Mode for our SQL Server Authentication. I've tried to convince our DBA to allow us to use Windows Authentication so we can use Team Foundation Server, however he absolutely ...
0
votes
1answer
72 views

Would it make security sense to split up tables into different databases and or servers?

What I am asking is would it be more secure if I had a customer table in one database server and the transactional data in another database server? This way if the database is compromised they are ...
2
votes
1answer
85 views

What is the equivalent of a “Certificate of Destruction” when using a cloud-hosted database?

We have a Rails application hosted by Heroku and using an Heroku Postgres database. Some of the information we store is considered to be sensitive by our users, and we've been asked if we can provide ...
0
votes
1answer
55 views

Harden a public login to only let it retrieve a list of other logins, and do nothing else

I'd like my app's login dialog to give users a drop-down-list of login names on the server. So I'm wondering about the most secure way to retrieve this. The best I can come up with is a login with a ...
1
vote
1answer
88 views

Multi tenancy by schema - Deny access to another tenants [closed]

In a multi tenant environment, where the multiple tenants are in the same database and a schema is used to separate each one of them, how can I create a database user (MS SQL SERVER) for each schema, ...
1
vote
1answer
1k views

Rights needed to see database files in Properties dialog?

I have a contractor setting up a database application. The database is set up, the login for the app is set as the database owner, but has only 'public' at the server level. When the contractor logs ...
2
votes
2answers
234 views

How do I maintain more audit history?

I created a SQL Server audit and when I view the audit logs I only see today’s audit. I am saving it to a file and I want to store audit for one year. Is there a way to store database and server audit ...
3
votes
2answers
192 views

Prevent SysAdmin from doing a Database Restore

I am a sysadmin on my SQL Server 2008, and I need to be, but I would like to setup my security on the Production server to prevent me from accidentally restoring to the production database. I ...
2
votes
1answer
165 views

SQL Server 2005 and Standalone VB application

I'm new to this forum and just want to ask some questions/suggestions on how to manage my database.. I'm having an application with sql server 2005 database as a backend. I want make the ...
0
votes
2answers
346 views

How secure is mongodb with elastic beanstalk and EC2

I have a questions. I run MongoDB on one of instances of EC2 and application on Elastic BeansTalk. I restricted access to DB: only application can access it. DB instance has Elastic IP because it is ...
1
vote
1answer
1k views

How to transfer the ownership of the dbo schema in SQL Server 2012

I've accidentally given a user the ownership of the db_owner schema (using the check box in the UI as below) and now I cannot: Transfer ownership to another user Drop the user from DB (though I can ...
2
votes
1answer
1k views

How to setup Oracle SSL using self-signed certificate between client and DB?

I want my DB to send the data to the client in an encrypted way. I Googled and found that Oracle has SSL. Unfortunately, I can't find a step by step tutorial which explains how to create a ...
2
votes
2answers
95 views

Searching transaction logs for changes

I currently have a database with an attached CMS. The CMS has about 50+ people with various permission levels that can log in etc... I would like to know if there is a way I can look at the ...
5
votes
1answer
128 views

Security implications of guest account and database chaining on sql server?

I have another database Ydb accessing data in database Kdb. They both have the same owner. In order to allow cross database chaining, it seems I need the guest user to be enabled in Kdb. I did so ...
2
votes
3answers
865 views

Encrypt MySQL database on a Linux VPS?

I'm working on a rails app for our church, which stores some fairly sensitive information about our people in a MySQL database. We have our own windows server running Hyper-V so the original ...
1
vote
1answer
46 views

Adding the domain account to a security group on the SQL Server computer that has sufficient privileges to log on as a service

After reading this article, http://www.red-gate.com/supportcenter/content/knowledgebase/SQL_Backup/KB200710000173 I have some problems configuring point 2) and 3): 2) Create a SQL Server login that ...
1
vote
2answers
163 views

How can I create an ad-hoc domain user on SQL Server

Okay, so here's the problem. I have an application I need to install and run locally for testing and debugging. The application has been designed to run on a domain and as such expects to log into the ...
1
vote
1answer
121 views

Creating domain user login from another domain?

I have two domains named "Domain1" and "Domain2". I have SQL server 2005 in Domain2, and users in Domain1. How can I create a login in SQL Server 2005 (in Domain2) for the user that is present in ...
3
votes
1answer
805 views

Using AD groups vs roles in SQL Server

What is best practice for sql server security? Using AD groups that are given rights on schema objects or should I add the AD groups to a database role which is given rights on schema objects ? If the ...
2
votes
2answers
533 views

How to restrict users to select only query through application textbox field?

Say that I have a web application that lets users to type in a SQL query (SQL Server 2008+). I want users to be able to run any SELECT query and read whatever is in the database, but I do not want ...
3
votes
2answers
6k views

sp_send_dbmail with attachment

SQL Server 2008, connecting via SQL Server Authentication. I have a sproc in DatabaseA which calls sp_send_dbmail in msdb to send an email with a file attachment. The file is on the db server, not on ...
3
votes
1answer
2k views

User has no password set

I see these when running MySQLTuner.pl: -------- Security Recommendations ------------------------------------------- [!!] User '@debian' has no password set. [!!] User '@localhost' has no password ...
0
votes
3answers
179 views

Deny access to one database, allow all the rest

How can I deny access to specific databases from a login? I know that I can walk through and make the login a db_owner on all the ones I want the login to have access to, but how do I do the ...
1
vote
1answer
537 views

dcexec login failure

I have a SQL Server 2008 R2 instance that I have been trying to get Data Collection setup on. I get everything setup, but there is no data that gets uploaded. I've traced the root of the problem to be ...
2
votes
3answers
759 views

Is encrypted database possible?

I'm not a DBA but I've been asked to see if we can encrypt the data in sql server such that the admin, despite having access to SQL Server won't be able to see the data but application would still be ...
17
votes
1answer
3k views

MySQL : Why are there “test” entries in mysql.db?

Recently, I posted an answer to a question about mysql.db. Then, I got to thinking I should ask everyone this question: I have noticed for years that upon installation of MySQL 5.0+, mysql.db is ...
0
votes
2answers
454 views

What are reasonable privileges to grant typical users? [closed]

I find the list of privileges provided by MySQL to be a bit overwhelming. I'm not sure who should have what privileges. In my mind there are three typical users for my situation: root developer ...
1
vote
3answers
138 views

Securely remove columns (and traces thereof) from a SQL database

I've come upon a database that has previously held sensitive data (think "passwords/credit-card-numbers" kind of sensitive) in plain text. All of the sensitive data in question has been deleted, but ...
6
votes
2answers
40k views

Listing the existing SQL Server Logins and Users

I know we can check the logins and the users that are defined, using GUI in SQL Server, but am wondering how we can do this check using script. I ran the query below but it shows Principal_id which ...
3
votes
1answer
2k views

Is there a difference between granting SELECT a user and adding them to the db_datareader role?

I was asked to grant SELECT, INSERT and UPDATE to a given user for all tables in a database. I ended up adding the user to db_datareader and granting them INSERT and UPDATE at the database level. ...
3
votes
2answers
471 views

Server permissions of an activation stored procedure of a Server Broker queue

I have a stored procedure that queries the sys.dm_exec_requests view. In the stored procedure the view only returns one row, while the stored procedure needs to see all of them. The MSDN article on ...
0
votes
2answers
654 views

What does the Service Master Key protect?

I am looking for a complete list of items that the Service Master Key is used to protect in SQL Server 2008.
5
votes
1answer
229 views

SA permissions issues with many nested objects

I have a broker application that's relatively complicated. Today, after I made some changes, I started getting the error: The server principal 'sa' is not able to access the database 'XYZ' under ...
0
votes
1answer
404 views

Which databases can have row and column level security based upon Active Directory? [closed]

I have various database types, Oracle 11g, MySQL 5, Sql Server 2012. I have direct access. I can have other databases if I need them such as PostgreSQL. What I'm doing is protecting data at the ...
2
votes
1answer
799 views

Are passwordless logins like ##MS_SQLResourceSigningCertificate## , ##MS_AgentSigningCertificate## a vulnerability?

I'm new to MS SQL Server. Colleagues working in IT security, have run an scan showing come DB users with null password. Some of them are ( # included ) ##MS_SQLResourceSigningCertificate## ...
2
votes
1answer
210 views

Secure a hosted MySQL DB

We manage an internet based SaaS app which has a MySQL DB as its backend DB. It is a Windows 2008 R2 server running MySQL 5.5/Apache 2.2 I have started using MonYog to monitor the health of the DB ...
1
vote
1answer
78 views

User login error when trying to access secured SQL Server database

We have a username that was recently renamed from one username to another (think getting married). The Active Directory admin renamed the user because "it has always worked in the past". One vendor ...