Currently I have an internal CRM application that houses all my data and runs my entire company. The front end is ASP, and the back end is SQL. The external site will run SQL

What I'd like to do is to have an external site for customer's to log in, manage their accounts, etc., but I am very concerned about my data and data security. Are there any best practices that I can follow to "replicate" data to the external databases? Are there some suggested methods people have done in this scenario?

My goal is to have the two databases linked with certain data. Changes inside would be queued somehow to the outside, and vice versa. If it is live, that wouldn't be the end of the world either.

1 Answer 1


The method I'm familiar with would be to to only have an internal database. The firewall separating your internal and DMZ networks can be configured to only allow appropriate communications through, in your case 1443 (or your SQL port) between the web server and database.

However, you can't simply rely on your firewall for security. Proper SQL permissions would be necessary to only allow access to your web data. And of course you should be validating user input to protect against SQL injection.

If you do want to go the replication route, check out the MS offerings such as SQL Server Transactional Replication.

  • Thanks for the advice! I was going to do an internal database initially but my apprehension is that any opening in my perimeter is just another place for a problem. My data contains customer information, social security information, credit card information, so I "feel" as if having a complete separation from the outside is ideal. However, I do know that there are several downsides to having two sets of data floating around. Mar 26, 2012 at 21:33
  • Have you considered moving the sensitive data to another instance? That way you could still allow your external app access to the data it needs, without worrying about your important data. Also, disregard the part about SQL replication, that would also require a pinhole through your firewall.
    – Colin
    Mar 26, 2012 at 22:46
  • Hm, ok, so I could create a new instance on the current server with permissions to particular data sets, and have the external application interface with that - Is this what you're suggesting? Mar 27, 2012 at 14:37
  • I was thinking a separate server, but you could do two instances on the same hardware. I'd suggest having them listen on different ports, then setting your firewall rules to only allow communication over the port for the less sensitive instance.
    – Colin
    Mar 27, 2012 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.