Allowing users to access only the data they are authorized to access.

learn more… | top users | synonyms

3
votes
0answers
79 views

Is this user-storage database system efficient, effective and secure?

I am using: PHP Version 5.2.17-MIT-BACKPORT-GnuTLS SQLite 2.8.17 I have a database called users, which currently has a table called root. There will be others, once I get all the rows for root ...
3
votes
0answers
90 views

Are there any outstanding critical security issues for Sql Server 2000?

Are there any outstanding (unpatched) security issues for Sql Server 2000? This isn't really for me: I moved on from Sql Server 2000 long ago. However, when answering questions here and (more likely) ...
3
votes
0answers
335 views

User can create in SSRS, but can't manage objects

We have a user who can create, but is unable to manage objects in SSRS, even though he has content manager permissions and another user who has same permissions who is able to. It is SSRS 2008 R2, ...
2
votes
0answers
22 views

Decrypting Previously Encrypted Data Returns NULL

I'm having trouble decrypting data that has previously been encrypted and stored in a table. After opening my symmetric key and encrypting the data using EncyptByKey(), I get NULL values when ...
2
votes
0answers
27 views

Postgres role security for multi-tenant database

I have a multi-tenant application where the Postgres DB schemas are set up as follows: _admin (tables that are invisible in the UI to standard users but need to be read-accessible, common across all ...
2
votes
0answers
58 views

security concerns over enabling data access for the current server

Included in the code of the creation of some stored procedures, I have the enabling of data access as you can see below. BEGIN TRY PRINT @@SERVERNAME PRINT DB_NAME() PRINT 'enable the ...
2
votes
0answers
33 views

InfluxDB - How can i limit the measures that an user can read by their tags?

I have some data that is collected by several sensors. Some users may own many of this sensors. So, i want to keep all the measures in a single database in InfluxDB. To differentiate the sensors i ...
2
votes
0answers
1k views

which role-permission database design?

I want to manage roles and permissions. Most of designs on web look like this tables: Users Roles UserRoles Permissions RolePermissions Here, what is permissions? I am thinking for such a design ...
2
votes
0answers
301 views

PhpMyAdmin: UploadDir & SaveDir

Regarding UploadDir & SaveDir in phpmyadmin, I have them both set to './save' with permissions at 755. I am the only one using phpmyadmin, but still, could I make this tighter? Thanks PHP 5.3.3 ...
1
vote
0answers
11 views

How do I hide the “read …save as” notification for an accdr file

When I make the accdb file to an accdr file and open it with Access 2010, the database is created with Access 2010 and OpenGateSoftware’s UI builder. I get a notification bar at the top saying: Read ...
1
vote
0answers
18 views

Accessing Encrypted SQL Server database through a web-based application

I have secured a database within SQL Server Instance on my local machine using Netlib Encryptionizer. I can access the database by securing my SQL Server instance using the same password as encrypted ...
1
vote
0answers
38 views

Is there ANY risk in granting a superuser CREATE and ALTER procedure permissions in a specific schema?

I have a developer who has created a set of procedures/functions/views he uses to perform configuration analysis in a large application (provides much higher productivity than using the formal ...
1
vote
0answers
19 views

How to set minimal permissions to change SQL Azure Firewall rules

I have a desktop app that connects to SQL Azure database. Some users have dynamic IP addresses, and it is not possible to get them to use fixed addresses. I've written an ASP.NET page hosted on the ...
1
vote
0answers
45 views

Database has thousands of randomly named tables

Preface: First of all excuse me for bringing forwarding this weird question, as it could be just me. Situation: We have a Centos 6.5 Cloud VPS hosting our website, running MySQL 5.1 and it is also ...
1
vote
0answers
86 views

Are there security-issues with a read-only-account on Oracle-DBs?

I am currently working as IT-maintenance-guy for a classic MVC-system(oracle-db/jboss) at public sector. The newest feature should be the shutdown of my oracle-db-readOnly-Account cause of "security ...
1
vote
0answers
25 views

Security: direct remote access vs webinterface

I need to remotely connect to my (mongoDB) database and I currently allow direct access to the DB server port with user/pw login. I often read that this is generally a bad idea and that one should ...
1
vote
0answers
115 views

PostgreSQL DML statements

I am trying to trick an application into executing a DML statement AFTER starting a SELECT statement without using stacked queries so I cannot use the ; character anywhere in my query. I have resorted ...
1
vote
0answers
90 views

Secure view on row level with custom security tables

Let's say I have a following table that lists all member of my application. CREATE TABLE dbo.Member ( MemberId BIGINT, LoginName NVARCHAR(64), SecurityRole NVARCHAR(64) ) I assume that ...
1
vote
0answers
29 views

MySQL can't connect as user with password locally

I am running into a strange authentification issue. Users can't connect to MySQL locally using a password, but they can without one. mysql -h localhost -u someuser -psomepassword won't work ...
1
vote
0answers
92 views

SQL Server 2012 restrict CmdExec to sysadmin server role

I'm trying to restricting CmdExec rights to sysadmin server role in SQL Server 2012. I've googled but just found some solution which they were for older version of SQL Server. Can you please help?
1
vote
0answers
70 views

PostgreSQL security threats in external modules or PL languages

In reading the answer to question I came across a paragraph that indicated that some PostgreSQL PL languages and/or contrib modules can be used to compromise the security of the system. Is this only ...
1
vote
0answers
946 views

Can we configure Certificate-based Authentication to connect(logon) sql client?

Can we configure Certificate-based Authentication to connect(logon) sql client? or any other method to connect sql client using mutual authentication(sql server and sql client)?
1
vote
0answers
165 views

When does SQL Server follow the Minimum Password Age policy?

According to this SQL Server 2008 whitepaper, SQL Server should only pay attention to the Minimum Password Age policy when the Check_Expiration (Enforce Password Expiration) option is turned on. Page ...
1
vote
0answers
274 views

How I can create user defined roles

I have a database in mongoDB 2.6.4 in which I want to restrict the users as per their level. I want to give read privileges to some users and insert/update privileges to some other users on a ...
1
vote
0answers
150 views

Auditing AS 400 DB2 library user access

As part of the testing to check for authorized users having access to applications and libraries on AS 400 systems, I need help to figure out a list of users having access to applications hosted on ...
1
vote
0answers
46 views

MySql Audit Changes from Db Admin, Security

I know that you can use triggers (before insert, update, delete) to track the changes in history tables. But this only works if the changes are made by the applications. But in some circumstance, ...
1
vote
0answers
22 views

How do mySQL and web-interface deal with hashed data

I've recently been given access to a mySQL database which will sit behind a website designed to allow people to register their interest in a given subject and provide further information about ...
1
vote
0answers
485 views

Deny permissions for master in SQL Server

I created a new database on a SQL Server 2008 R2 instance and a login/user for it. I have set the user to db_owner so he can't view any other databases on that server but he can see and query the ...
1
vote
0answers
2k views

EXECUTE AS over Linked Servers

I have a front end that logs into the DB as "logInA", and only has permission to "schemaA" stored procs, which use EXECUTE AS "logInB", (I have also tried EXECUTE AS 'DBO'), to handle all the business ...
1
vote
0answers
753 views

ORACLE SSL using Microsoft Certificate Store for PKI

I am trying to set up PKI SSL authentication between client and server using a Microsoft Certificate Store. Client: Windows 7 64 bit with Oracle client 11.2.0.3.0 Server: Windows 2008 R2 64 bit with ...
0
votes
0answers
14 views

What is the best practice of storing mysql connection details to use in ruby/python scripts

I have ruby and python scripts that connect to mysql DBs. They are controlled in github and can populate to different servers. They run in a schedule way (not adhoc). What is the best practice of ...
0
votes
0answers
34 views

Error: 18456, Severity: 14, State: 11. Login-based server access validation failed with an infrastructure error

We are getting the above error on a SQL 2012 server running Windows Server 2008R2 when connecting using an application and a service account. The server also has Config Manager database and GAP policy ...
0
votes
0answers
23 views

Difference between Database Securable Scope and Database Securable?

I'm reading the Security best practices document for Server 2008 and I noticed that they list both a database securable scope, and a database securable. How should I differentiate between these? ...
0
votes
0answers
19 views

Analyze databases for “risky” fields/data as deployed

What is the best way to analyze databases, both by field names and field content, to determine whether there is a privacy or security risk with having the data "as is"? Is there a way to script a ...
0
votes
0answers
36 views

How can I prevent users from accessing certain data?

Here is a screenshot of my database in MS Access 2016: On the left, I have all my tables, queries and forms. I would like to prevent users from accessing these data as well as the VBA code (i.e "...
0
votes
0answers
37 views

how to force mysql 5.5 server to allow tls/ssl encrypted connections only?

given a mysql Server 5.5 community edition (which came with SLES 11sp4). i configured it to support TLS and it works fine. but i did not found any options or parameters to FORCE IT to do TLS/SSL ...
0
votes
0answers
8 views

Mysql log access denied fastcgi script

Is there one way to log attempts from a user to log in from the cgi script? Whe you are running a mysql server with a lot o virtual hosts, sometimes you see this message y mysql error log. There is ...
0
votes
0answers
42 views

Why default db privilleges are not applied on a new schema?

I have a user with all privileges granted by default in database properties. I create a new schema as postgres and table there. I expect that the user should have an access to this table but it looks ...
0
votes
0answers
19 views

PostgreSQL: Recommended way of user creation/management for development, test and production. I use Ruby on Rails

I am trying to think of the best (aka recommended or common professional practice) way to create users/roles in PostgreSQL database for development, test and production environments. I have to say ...
0
votes
0answers
14 views

impact on Nodejs app - Disable Server-Side Execution of JavaScript --noscripting

What does the startup option --noscripting do exactly? What is the impact on a Nodejs app? What does not work anymore if we Disable Server-Side Execution of JavaScript? The admin guys are the only ...
0
votes
0answers
26 views

SQL developer security concerns

What security risks are there when I connect to the database using SQL developer? I've been restricted to use it to access the database from my desktop because it connects to the db over a remote port....
0
votes
0answers
22 views

Is it secure to disclose the key value of tables

I am currently working on a web application. And the application would link user to data with primary key of some table so user can find the key value (int). Is the application still safe? Or should ...
0
votes
0answers
29 views

Accessing database from a number of servers

I have a few servers that access a database, and I was wondering what is the best way to handle access to the database. Is it secure that each server will be able to access the database, or should I ...
0
votes
0answers
807 views

Database Role Membership: db_executor vs db_datareader and db_datawriter in SQL Server 2008R2?

I have a couple of users who have only public and db_executor memberships in their Server Login object, User Mapping properties in the one database (let's call it A), now that our front end ...
0
votes
0answers
147 views

Security for SSIS packages in SQL Server - use a domain account?

I have an SSIS package that I want to deploy to SQL Server A. This package needs to access tables on SQL Server A, and another SQL Server, B. What is the best way to set this up? Should I create a ...
0
votes
0answers
31 views

Procedure Security Layer

I want discuss an idea with you and get your opinions what you think about it. From database (SQL Server 2008 R2) administration view and general security, its good practice to create DB roles and set ...
0
votes
0answers
30 views

SQL database rejoined to new SQL Server 2008 R2. Users are still unable to connect

The below error appears when our users attempt to connect to our database following a complete rebuild of our SQL server and restore of the MDL file: We have created user accounts on the new SQL ...
0
votes
0answers
342 views

Login failed for a user in a Domain Local Group

I have recently been considering moving from using SQL Logins in my applications, to a model using Windows Authentication using Active Directory groups My intention is to allow users access to ...
0
votes
0answers
458 views

Oracle data obfuscation on specific columns with set field sizes

Would like to obfuscate data held in Oracle tables, but: Requirements only apply to specific columns e.g. personal data obfuscated value should not be longer then column size possibly only ...
0
votes
0answers
55 views

How to secure SQL database?

I made a little application with a MySQL database. I want to secure my database.I think user name and password is not enough to protect it. Because anyone can access the database by copying database ...