Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

2
votes
1answer
737 views

How to do MySQL User Accounting

I can't seem to find any information on this anywhere. I found a question here called Monitor MySQL activity per database? but that's not quite the answer either. I'd like to be able to log the ...
2
votes
0answers
46 views

security concerns over enabling data access for the current server

Included in the code of the creation of some stored procedures, I have the enabling of data access as you can see below. BEGIN TRY PRINT @@SERVERNAME PRINT DB_NAME() PRINT 'enable the ...
2
votes
0answers
26 views

InfluxDB - How can i limit the measures that an user can read by their tags?

I have some data that is collected by several sensors. Some users may own many of this sensors. So, i want to keep all the measures in a single database in InfluxDB. To differentiate the sensors i ...
2
votes
1answer
99 views

Security implications of running SSRS and an OLTP database on the same server

I am in the process of building a new environment for my company's Customer Relationship Management (CRM) system. This system is a commercially available product which uses SQL Server as its back end ...
2
votes
1answer
132 views

Can we protect data form Database Administrator by encrypting the data?

How can we protect data on my database which is MySQL form database administrator stealing it? Will encrypting it prevent it from being stolen? If yes, how as he already has access to the database ...
2
votes
0answers
241 views

Database Design - Multiple Dbs or Single - Security & Data [closed]

I've hit a brick wall with this and just cannot make a decision so want to throw this out there and see if there are any issues I have'n't considered. Basic Topography I have a system that currently ...
2
votes
1answer
251 views

Secure a hosted MySQL DB

We manage an internet based SaaS app which has a MySQL DB as its backend DB. It is a Windows 2008 R2 server running MySQL 5.5/Apache 2.2 I have started using MonYog to monitor the health of the DB ...
2
votes
0answers
1k views

which role-permission database design?

I want to manage roles and permissions. Most of designs on web look like this tables: Users Roles UserRoles Permissions RolePermissions Here, what is permissions? I am thinking for such a design ...
2
votes
1answer
109 views

What is the equivalent of a “Certificate of Destruction” when using a cloud-hosted database?

We have a Rails application hosted by Heroku and using an Heroku Postgres database. Some of the information we store is considered to be sensitive by our users, and we've been asked if we can provide ...
2
votes
1answer
640 views

“The SELECT permission was denied” only for some of my tables

In my database there are about 100 tables on 2 tables I get the following error when accessing the database by a SP (all data access uses SP): The SELECT permission was denied on the object 'XXX' ...
2
votes
0answers
296 views

PhpMyAdmin: UploadDir & SaveDir

Regarding UploadDir & SaveDir in phpmyadmin, I have them both set to './save' with permissions at 755. I am the only one using phpmyadmin, but still, could I make this tighter? Thanks PHP 5.3.3 ...
2
votes
1answer
107 views

How can I deny a user the ability to Alter DB files and options but still allow schema and data modifications?

I'm establishing a shared development instance for multiple single-database applications. I'm envisioning granting authorized users permissions to allow any schema and data modifications they need to ...
2
votes
2answers
815 views

What could trigger that a login created from a certificate is not visible in metadata

I am trying to create a login and grant it rights to run and unsafe assembly but the check on server_principals does not return the login when it already exists. The script works perfectly fine on my ...
2
votes
1answer
76 views

How do I stop tables from being created in my mysql database? [closed]

I have noticed recently that some tables are being created in my mysql database by a rogue process. These tables typically have six letters followed by 32 (e.g. ernidt32). They just have one column ...
2
votes
2answers
96 views

Is there a simple, safe and low cost way to implement a (limited) database to be outside (close) IT control? [closed]

This question is a spin off of the discussion here (What are the risks of building a database outside IT control?). Background: I'm a risk guy that builds little betas, mostly in Excel-VBA. I have a ...
1
vote
7answers
1k views

Implement Database Security?

I want to implement a database security on the database i created so no one can access it from SQL Server Management Studio, and that it will be only accessible through code. Is that possible? and if ...
1
vote
2answers
1k views

Any security related reasons to prefer Windows Authentication over Sql Server Authentication?

This is a rather short question: When using Microsoft SQL Server (version 2005 and newer), are there any security related reasons to prefer Windows Authentication over SQL Server Authentication? ...
1
vote
1answer
101 views

How to change default security on SQL Server database so that everyone can use it?

I have a database hosted on my machine that I want co-workers to be able to access and edit through a program I created. My current connection string is: ...
1
vote
2answers
797 views

SQL Server Grant execute on all stored procedures without ddl permissions

I have some users in my database. They are member of db_datareader. They now also need to have execute permissions on stored procedures. I was just wondering what would happen if one of the stored ...
1
vote
1answer
65 views

Deny users permission to create tables in master

I have noticed that I can create tables, schemas, stored procedures etc. the master database. I don't know what is granting this permission. It's annoying, because when we open a *.sql file in SSMS, ...
1
vote
2answers
200 views

Is Database Mail worth the risk / a standard practice

I enabled Database Mail XPs and was testing it on my dev machine. I was just wondering if the DB Mail is a bad security choice, and if it more secure (or standard practice) to send this kind of ...
1
vote
2answers
810 views

How can I run a T-SQL Script using SQL Credentials?

I need to develop a T-SQL insert script for use on a remote SQL 2005 Express instance but I would like the script to include the necessary SQL credentials so all the user has to do is execute the ...
1
vote
2answers
2k views

Issues with module signing and SSIS catalog internal procedures

I'm trying to set up a stored procedure to execute an SSIS package. I want to allow a user to execute only this stored procedure, so I need it to run as a different user. I found this article which ...
1
vote
2answers
215 views

Securing Your MySQL Server within your team?

Recently I have been having an issue with our internal team members changing the password of the root user. I noticed the following things: OLD_PASSWORD = 1 (So all passwords on our development ...
1
vote
2answers
85 views

Known vulnerabilities for when a guest executes a stored procedure on SQL Server

I have a production database with crucial business information. Meanwhile, my company is involved in a project with some other company and we have to exchange some information on a regular basis. How ...
1
vote
3answers
120 views

User Rights - Can alter Sp's but not tables

How can i make user permissions so that user can CREATE\ALTER\DELETE Store Procedures, but cannot CREATE\ALTER\DELETE tables in database.
1
vote
1answer
227 views

Randomly generated password for mysql admin over time?

I have this idea of making my database's Admin account secured by creating the following: Trigger is activated every hour in mysql this trigger activates a stored procedure Stored procedure ...
1
vote
1answer
7k views

Set permissions on all objects for SQL users

I have a procedure that loops through all objects in the database and assigns them proper permissions to that object. I want to know if there is a better way to do this? I use a model database to ...
1
vote
1answer
46 views

Hypothetical: Security Intrusion

Had a random thought I was curious about. In the case of a security breach where a user gains access to the DB server through legitimate credentials (social engineering, phishing, fired employee, ...
1
vote
1answer
112 views

How to grant access to IP range in Postgres?

I would like to configure my Postgres DB to be accessed by any IP 10.8.101.*. I know I have to create a rule in pg_hba.conf but I'm not sure what it should look like. My LAN IP is currently ...
1
vote
1answer
359 views

How does SQL Server handle logins when the user is a part of multiple groups with various privileges?

I'm trying to wrap my head around how SQL Server decides to grant certain rights based on a users login privileges. If a user is part of a group "READ ONLY" which has access to DB1, but they are also ...
1
vote
1answer
123 views

What does exec(text) do?

I just found the following function in two RDS PostgreSQL 9.3 DBs: -- -- Name: exec(text); Type: FUNCTION; Schema: public; Owner: adam -- CREATE FUNCTION exec(text) RETURNS text LANGUAGE plpgsql ...
1
vote
2answers
54 views

Encrypted column - limit key access

I'm new to SQL encryption and have a SQL Server 2012 database. The database itself needs to be accessible by DBAs but the data within one of the columns a table should only be viewable in plain text ...
1
vote
1answer
1k views

How to change the login for a database's dbo user?

I just finished a successful install of SQL Server 2014 Express, onto a domain-joined VM instance of Win8.1. During setup which I ran under DOMAIN\Admin I accepted the default configuration of adding ...
1
vote
2answers
211 views

Sending a database dump

Quite new to db admin here and I have a quick question. I am collaborating with another colleague off site and they would like me to send them a dump of our (1.5GB sql db) database via email as they ...
1
vote
1answer
4k views

SQL Server - Linked Server - Using OPENROWSET with windows integrated security

I have seen many articles regarding OPENROWSET using integrated security (Windows Authentication), but I could not make it work for me. It is working fine using SQL Server authentication: select * ...
1
vote
3answers
590 views

MySQL 5.7 - Where is the mysql_secret file on Windows 7?

I've just installed a copy of MySQL 5.7 for testing, and I love the fact that it now only creates a single root account, and puts the password into a file called .mysql_secret. There's just one ...
1
vote
2answers
1k views

Numerous failed authentication attempts in error log

I'm having a hellacious time trying to figure out what is attempting to authenticate against a particular database server, running SQL Server 2008 R2 Standard Edition. The following is the error ...
1
vote
1answer
316 views

Creating domain user login from another domain?

I have two domains named "Domain1" and "Domain2". I have SQL server 2005 in Domain2, and users in Domain1. How can I create a login in SQL Server 2005 (in Domain2) for the user that is present in ...
1
vote
1answer
284 views

Restrict access for Windows administrator in PostgreSQL

Is there a way to protect PostgreSQL from user with Windows administrator rights? Like this question but for Postgres.
1
vote
1answer
403 views

One call to `decryptbypassphrase` for decrypting all columns

If I use ENCRYPTBYPASSPHRASE to encrypt the full table then how can I decrypt full table easily by using DECRYPTBYPASSPHRASE? Actually I have to use DECRYPTBYPASSPHRASE ('passphrase', column_name) ...
1
vote
1answer
109 views

MySQL Database Temporarily Compromised?

Two days ago, I had connected to my ClearDB test server with MySQL workbench. I had left this workbench open and when I had checked it today, there were two new schemas named "test_justin" and ...
1
vote
1answer
358 views

When was the syslogin's password last updated?

In SQL Server, I see there's a field in syslogins titled "updatedate" which is a timestamp of the last time the login was updated. What constitutes an "update"? My goal is to only get a timestamp ...
1
vote
1answer
2k views

Rights needed to see database files in Properties dialog?

I have a contractor setting up a database application. The database is set up, the login for the app is set as the database owner, but has only 'public' at the server level. When the contractor logs ...
1
vote
2answers
465 views

Is it good practice to assign a system account for database owner?

I can see the owners of my databases usign this query SELECT name , SUSER_SNAME(owner_sid) FROM sys.databases What are the things I should consider when choosing an account for database ...
1
vote
1answer
62 views

Create Linked Server using Active Directory account

I was able to grant access in MSSQL to an Active Directory group and add a service account to that group. It's working fine, I'm able to use trusted connection to login on that MSSQL using both my ...
1
vote
2answers
39 views

Is there any danger in granting SUPER privileges to a user?

I had problems in restoring procedures in my db, so what I did was to grant SUPER privileges to my dbuser. This user is the same user used in my web application, so I would like to know if there is ...
1
vote
1answer
118 views

Grant access to all objects (with a few exceptions) to a role

In SQL Server 2014, I want to create a role that will have access (select, delete, update, insert, execute) to all the tables, views, stored procedures, except a certain list of tables that contain ...
1
vote
1answer
66 views

How to restrict table access to a application

I would like to know how I would go about restricting access to a table so that only a certain application can access the data within. Where I work, we have a database application that rather ...
1
vote
3answers
62 views

How do I keep a database physically secure? [closed]

This is more of a conceptual question. I am learning how to integrate Java and databases (using PostgreSQL at the moment) and my initial questions is: What are the guarantees that the data I ...