Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

2
votes
2answers
39 views

What are the risks of building a database outside IT control?

I've been looking for the best StackExchange community to ask this. I hope it fits well here. As a risk analyst in a trading business, I'm often confronted with large volumes of data, way beyond the ...
0
votes
2answers
993 views

Secure Linked Server - Non privledged user possible? Registry corruption?

Is it possible to use a non privledged Windows domain account to impersonate itself in a linked server? And why would it be unable to read the registry for available network protocols? Overview: ...
0
votes
2answers
85 views
+50

Securing Your MySQL Server within your team?

Recently I have been having an issue with our internal team members changing the password of the root user. I noticed the following things: OLD_PASSWORD = 1 (So all passwords on our development ...
2
votes
1answer
75 views

Can comments in stored procedures cause problems

We're running a webserver that calls stored procedures to compute complex queries. Using sp_who2, we've discovered a peculiar issue where an abnormal number of processes would be stuck on SELECT state ...
3
votes
2answers
93 views

How to export all the security-related information from a SQL Server database

As you guys probably know, SQL Server does not provide an out-of-the-box solution to export all the security related statements that are declared for each element in the database (both at the database ...
0
votes
0answers
10 views

Is forwarding a port(s) a security risk to all computers on the network or just one? [migrated]

I know forwarding ports can add some security risk, but if i forward a port to a conputer running linux would it add a security risk to all computers on my network or just the one?
1
vote
2answers
99 views

Numerous failed authentication attempts in error log

I'm having a hellacious time trying to figure out what is attempting to authenticate against a particular database server, running SQL Server 2008 R2 Standard Edition. The following is the error ...
1
vote
2answers
48 views

Changing the SQL Server service account - any additional considerations?

I have inherited a few instances that are running under LocalSystem. I need to change this to a domain account as we are changing our backup strategy to go to a network share and then to tape and I ...
0
votes
1answer
59 views

Do I need to explicitly grant permissions for a login under the sysadmin role for it to access a custom schema?

So I have a login that has sysadmin rights on the db server. However, it's not able to access database objects under a custom schema that was created (eg. it cannot select from tables with ...
2
votes
2answers
59 views

How to revert multiple impersonations?

When there are nested impersonations (as in exec as user = 'user1'; exec as user = 'user2'; exec as user = 'user1';), is there a way to revert all of them without having to use the revert command ...
3
votes
1answer
64 views

Secure database access from particular applications

I have an C#.NET application and a SQL Server database (SQL Server 2008 R2) and would like to restrict the access to some of the Tables when it has been accessed from some other application rather ...
2
votes
1answer
2k views

Reconcile users with logins using 'sp_change_users_login'

Sql Server 2008 (and 2005): I have a Sql Server instance, let's say, InstA, in a Domain (called AD). In that I have a domain Windows Authentication Login, called AD\Log1 that has an associated user, ...
1
vote
2answers
355 views

Protect SQL Server from hackers

Today, my SQL Server 2008 is attacked by hacker from IP address in China [4300 Login failure in last 7 hours]. I contacted GoDaddy support and below is what they told me. EXEC sp_readerrorlog 0, 1, ...
2
votes
4answers
505 views

SQL Server grant permissions to STANDBY database

So, first: the setup. We have SQL Server 2012 (ServerA) running in domain A. We have SQL Server 2012 (ServerB) running in domain B, separate subnet, no trusts. These are completely separate domains ...
0
votes
1answer
114 views

Best practices in securing Oracle Standard edition one [closed]

I have a database server with Oracle Standard Edition One. I'm interested what are the best practices to secure Oracle? I have Java web application installed in the same server. The Java application ...
4
votes
2answers
2k views

SELECT permission on view querying table from another database

SQL Server 2008 R2 SP1 My company uses the Great Plains (GP) financial system with several customizations. Our Value-Added-Reseller (VAR) for GP has setup most of these customizations in a separate ...
11
votes
2answers
3k views

How do you reset the sa password?

I lost the sa password on a machine, and when I log in to the machine directly using an account in the admin group, SQL Server Management Studio will not allow me to log in using Windows ...
1
vote
1answer
110 views

Need advice on abnormal login auditing

Recently i am facing some slow issue for my web application. And i have check my visitor report and it shows normal traffic rate as usual. And then i check my db login auditing and find below login ...
3
votes
1answer
193 views

Security for Oracle linked server from SQL Server

I'm trying to make the linked server from SQL Server 2005 to Oracle more secure by not having user/pass on "Be made using this security context:" fields so only a specific user can access the data ...
1
vote
1answer
64 views

Create USER and LOGIN permissions

What permission should I give to a user or role so that it can Create Login or Create User in database.
6
votes
2answers
478 views

SSRS appears to be ignoring Permissions set using Report Manager

I have setup SSRS on SQL Server 2008 in native mode. As an administrator I can login to report manager, upload reports and run them, and also use the Web Service URL to generate reports. I have also ...
1
vote
1answer
42 views

How dangerous is it to have a user's password in plaintext in a cgi script?

I am setting up a MySQL database and am providing a web interface for it. Now, the DB is extremely simple and the interface just runs certain SELECT statements. I have created a user for my script to ...
2
votes
2answers
73 views

SQL Job step run as different sql account

I'm curious how to set up a SQL job step to be executed as a different SQL login account. It appears I need to set up a New Proxy Account which requires an existing credential. When I create a ...
2
votes
1answer
46 views

How do I add a user that has read access to only ONE database?

I have two databases admin and testdb ; Added a user Alice in the test database db.addUser( { user: "Alice",pwd: "Moon1234",roles: [ "readWrite" ] } ); But when I login using the user Alice, I can ...
0
votes
2answers
69 views

Known vulnerabilities for when a guest executes a stored procedure on SQL Server

I have a production database with crucial business information. Meanwhile, my company is involved in a project with some other company and we have to exchange some information on a regular basis. How ...
1
vote
1answer
46 views

Secure postgresql database encryption

According to this answer, it's not possible to have a fully secure database encryption with pgcrypto. Now, 2 years later (in postgresql 9.3) is there any new extension or new method to have a ...
1
vote
1answer
40 views

How to check Oracle database connection encryption type

How to check the Oracle database connection encryption type?(between Oracle database and other client applications)How do I assure between Oracle database and Toad the database connection is ...
0
votes
0answers
43 views

Oracle data obfuscation on specific columns with set field sizes

Would like to obfuscate data held in Oracle tables, but: Requirements only apply to specific columns e.g. personal data obfuscated value should not be longer then column size possibly only ...
1
vote
2answers
67 views

Questions since MySQL Startup

Have a weird question / (bug?) here. Using PHP My Admin I installed via apt-get on Ubuntu 13.10 Versions are as follows: Server version: 5.5.35-0ubuntu0.13.10.2 - (Ubuntu) Apache/2.4.6 (Ubuntu) ...
0
votes
1answer
82 views

PostgreSQL, storing encrypted data or encrypt database with pgcrypto - what is more secure? [duplicate]

I have two machines: client and server (a database server). I want to connect from client to server and manipulate data from database (insert, update, delete, select) using dblink. I would like to ...
0
votes
1answer
19 views

Select permission to each table

I have three schemas Production, HRecourse and Sales,tables in every week create and drop , I have six Users P_User1, P_User2, HR_User1, HR_User2 and S_User1 and S_User2. I have to grant then how i ...
0
votes
1answer
37 views

CHROOT install after I already installed Mysql 5.6

I installed some time ago Mysql 5.6 on Ubuntu server 12.04 and now I'd like to enhance security by putting mysql into a CHROOT environment on that same Ubuntu server. Is this possible without ...
1
vote
0answers
52 views

Secure database design for web-based medical data application [closed]

Background: I am in the process of creating a database which contains medical information (patient-specific, likely identifiable). The treating doctors shall have access to the database via a ...
56
votes
5answers
4k views

Do stored procedures prevent SQL injection?

Is it true that stored procedures prevent SQL injection attacks against PostgreSQL databases? I did a little research and found out that SQL Server, Oracle and MySQL are not safe against SQL injection ...
7
votes
2answers
656 views

Limit connection rights on SQL Server

I have an app to deploy in production that uses 'honor system' security. That is, all users connect to the DB using a SQL user/passwd credential and the app manages permissions itself. The latter part ...
1
vote
2answers
48 views

security tools for mysql [closed]

We are using MySQL Community version on Windows and are trying to secure it as best we can. Assuming that changing the version (for example purchasing the Enterprise edition) is not possible in our ...
4
votes
2answers
36 views

Easily give role in one database access to tables in another database on the same server

I have a database server (Sql Server 2008 R2 Enterprise) supporting two separate but related vendor products, each with it's own database (call them X and Y) In database X I a have a lot of users ...
8
votes
3answers
520 views

Is there a way to find out who changed the password for a login?

I am trying to find out who changed the password for a login in SQL Server 2008 R2. I have already checked default trace - and it does not log that event. The default trace will include these ...
1
vote
1answer
56 views

Two “Connect SQL” permissions in SQL Server 2012

What is the difference between these two "Connect SQL" permissions in SQL Server 2012?
7
votes
6answers
1k views

What security threats does the SA account and other known account names pose to security?

Does an known account name like sa, pose a security threat to database? When using windows authentication on SQL Server does it impose the same password policy(if it was set to say account lockout ...
5
votes
3answers
826 views

Does the PCI standard forbid the use of Windows Authentication?

We currently use Mixed Mode for our SQL Server Authentication. I've tried to convince our DBA to allow us to use Windows Authentication so we can use Team Foundation Server, however he absolutely ...
0
votes
1answer
43 views

Would it make security sense to split up tables into different databases and or servers?

What I am asking is would it be more secure if I had a customer table in one database server and the transactional data in another database server? This way if the database is compromised they are ...
2
votes
1answer
71 views

What is the equivalent of a “Certificate of Destruction” when using a cloud-hosted database?

We have a Rails application hosted by Heroku and using an Heroku Postgres database. Some of the information we store is considered to be sensitive by our users, and we've been asked if we can provide ...
0
votes
1answer
45 views

Harden a public login to only let it retrieve a list of other logins, and do nothing else

I'd like my app's login dialog to give users a drop-down-list of login names on the server. So I'm wondering about the most secure way to retrieve this. The best I can come up with is a login with a ...
1
vote
1answer
57 views

Multi tenancy by schema - Deny access to another tenants [closed]

In a multi tenant environment, where the multiple tenants are in the same database and a schema is used to separate each one of them, how can I create a database user (MS SQL SERVER) for each schema, ...
0
votes
0answers
56 views

How to protect MySQL database from widespread data theft and modification if SQL injection is successful?

I am looking into a practical defense in depth strategy which helps to limit the damage if, for some reasons, an attacker succeeds in performing an SQL injection. Supposing the website contains ...
4
votes
1answer
875 views

How do you disable anonymous login? - MySQL

According to the MySQL documentation, you can harden a MySQL server by adding passwords, or removing the anonymous accounts. If you want to prevent clients from connecting as anonymous users ...
1
vote
1answer
960 views

Rights needed to see database files in Properties dialog?

I have a contractor setting up a database application. The database is set up, the login for the app is set as the database owner, but has only 'public' at the server level. When the contractor logs ...
2
votes
2answers
163 views

How do I maintain more audit history?

I created a SQL Server audit and when I view the audit logs I only see today’s audit. I am saving it to a file and I want to store audit for one year. Is there a way to store database and server audit ...
0
votes
0answers
33 views

Handling data access in MS Report Builder 3.0

We have denormalised tables in our reporting database which provides data for creating ad-hoc reports in Report Builder 3.0. What is the best way to model the data access in Report Builder? The ...