Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Allowing users to access only the data they are authorized to access. It also encompasses protection of data during movement on the network and storage on disks and backups.

1
vote
0answers
13 views

Can CyberArk Manage SQL Credentials To Synchronize Password Changes?

My organization utilizes CyberArk to force expiration & reset of administrator & service account passwords on the domain. When it comes to SQL Server-related assets, I'm hitting an impasse ...
1
vote
2answers
36 views

Find user who kicked off a SQL Agent job at runtime

I have inherited a breakglass procedure that allows certain users to kick off a SQL Agent job that inflates their privileges on the instance. It currently sends an email to say that it has been ...
1
vote
0answers
31 views

ADD SENSITIVITY CLASSIFICATION on Azure SQL DB fails

I have received "A Vulnerability Assessment scan" email from Microsoft, where it claims I'm missing this line: ADD SENSITIVITY CLASSIFICATION TO [dbo].[Mytable].[creditor_amount] WITH (LABEL = '...
0
votes
1answer
52 views

How to secure SQL Server in an enterprise environment?

So I've been tasked with learning how to secure our SQL Servers. Here's the scenario: Individual users have read access to a table in SQL Server. This table have apx. 33 million rows, and growing (...
1
vote
1answer
22 views

At what point is SQL Server's is_policy_checked enforced? [duplicate]

At what point is SQL Server's is_policy_checked enforced - just at next password change or at each login?
3
votes
1answer
62 views

How to grant execute permissions to a stored procedure but not to the underlying databases

I am trying to allow a user to run a stored procedure while restricting them read/write access to the underlying tables. I am able to complete this with other stored procedures, but the one I am ...
1
vote
1answer
37 views

Postgres Column Level Security

I have a schema snow within a database testdb. I'm trying to achieve column level security for my users. My users are boss, manager and intern. I set all of this table up as the superuser me. They are ...
0
votes
1answer
32 views

Run PostgreSQL without admin / superuser

I'm trying to setup a secure append-only database with PostgreSQL or MySQL. My idea for that is to generate a database where no admin/superuser accounts exists and only users with limited privileges ...
0
votes
3answers
34 views

How safe are PostgreSQL triggers against attacks?

in my PostgreSQL database I setup some triggers to prevent DELETE and EDIT operations (the triggers make sure that these operations lead to nothing). However, I'm wondering how safe these triggers are?...
2
votes
4answers
86 views

What permissions are required for UPDATE STATISTICS #table WITH ROWCOUNT = xxx?

Can anyone point me to the correct documentation or additional permissions I need besides SA to do the following? When I run it, I receive the following error: Cannot find the object "#test" because ...
0
votes
1answer
65 views

Is there a way to have a system generated report of list of DBA in SQL Server? [closed]

I'm an auditor, and I want to ask if there is a list of system generated report of DBA users in SQL Server? Per my audit client, there is no way to generate it. However, I'm thinking that this is a ...
4
votes
1answer
75 views

Execute Permissions for a Store Procedure that creates databases

I have a Stored Procedure that creates a Database for a specific project which needs to run every month by one of our Data Analysts. The question is how do I structure this to enable the Analyst to ...
1
vote
1answer
31 views

Security Risks with having Test Stored Procedures that have SQL Injection Vulnerability

I noticed that some of the stored procedures used in our integration tests for data generation have SQL injection vulnerabilities. These procedures are taking into string parameters to build a SQL ...
1
vote
0answers
22 views

Mongodb - Security weakness while using --authenticationDatabase admin? [duplicate]

I was trying to create a new Mongodb instance based on my old Mongo Database. In my current DB I have an user and password configured. So, I can access my database using: $ mongo --host $MONGO_HOST -...
0
votes
1answer
26 views

Mapping an MSSQL Login to the secondary replica in a High Availability Group

I'm trying to map a login to a user in a database on the secondary replica of a two node High Availability group. Obviously this fails since the replica is offline. Is there a way for me to create ...
1
vote
2answers
41 views

Can anything reveal that 2 independant entries were created or updated at the same time?

Imaginary example, simplified to better explain the question. Let's say I have a form with the following fields : user email who did you vote for in 2012 who did you vote for in 2016 When submitted, ...
3
votes
3answers
83 views

What's an example of an exploitation of the security from enabling Ole Automation Procedures Server Configuration option?

I have a need to enable to the Ole Automation Procedures Server Configuration Option on my SQL Server, but was wondering what specific kind of security risks do I incur by doing so? What is an ...
10
votes
2answers
866 views

Locked my sa user out

So I was trying to change some settings in my Microsoft SQL Server Management Studio 2019. I change the login mode from mixed (Windows and SQL authentication) to only Windows and now I am not able to ...
4
votes
1answer
51 views

SQL Server impersonation

This question is about impersonation in Microsoft SQL Server. I want to know that if I have impersonation permissions on a specific login then I can easily impersonate that login whenever I want and I ...
8
votes
1answer
142 views

Dropping the automatically created NT AUTHORITY and NT SERVICE accounts

So I recently moved jobs - one piece of code I've spotted in our build scripts for new SQL Server installations is below. IF EXISTS ( SELECT * FROM [sys].[syslogins] WHERE ...
2
votes
2answers
51 views

If database is compromised and downloaded, does it matter if user passwords are hashed?

I'm currently implementing as much security into a web app as possible, but I can't stop thinking about the database itself. For all the security I implement, such as salting and hashing passwords in ...
2
votes
0answers
37 views

How do I prevent PostgresQL users/roles from having access to any administrator functions?

When I create a user with CREATE ROLE user123 LOGIN on my system it is able to login and immediately perform \du and interact with pg_stat_activity, and probably many other things. I have ...
1
vote
1answer
22 views

Temporary role/privileges

Is it possible in PostgreSQL to temporary grant roles/privileges to a user? I'm thinking about this as a solution for the situation when there is a need to troubleshoot an issue and an user may need ...
0
votes
1answer
54 views

Finding all users with access to a table in SQL server

Wondering if there is any script out there to extract a list of all database logins with access to a particular table, whether its given thru a view, database role, etc.
0
votes
0answers
14 views

Windows Application MySQL Error Log Activity

I have a MySQL DB that has a publicly exposed port w/ limited IPs. I started getting errors in my Windows Application Error Log with Source=MySql and EventId=100. They are all some form of IP ...
2
votes
1answer
57 views

Dangerous MySQL functions

It is well-known that the SQL function SLEEP() can be used to attack web applications, e.g. as described here. The sleep function cannot be disabled since it is compiled into the MySQL code and does ...
0
votes
0answers
23 views

What are PostgreSQL Security Labels?

What are PostgreSQL Security Labels and how/where to use them compared to GRANT?
4
votes
1answer
192 views

Intermittent Login Issues with Windows Authentication

I have a strange one. I've been experiencing occasional login errors via windows authentication for the past couple weeks and the network team and I have yet to find a solution. I am running SQL 2016 ...
0
votes
1answer
20 views

enable the data access for the current server - is this operation logged somewhere?

I have a similar question related to the same subject: security concerns over enabling data access for the current server BEGIN TRY PRINT @@SERVERNAME PRINT DB_NAME() PRINT 'enable the ...
0
votes
1answer
46 views

What is the minimum input length required for sql injection?

Perhaps this belongs on the 'golf code' stack or elsewhere, if so, apologies and I'll remove it. I have been working on a older application and re-writing SQL statements as postgres functions to help ...
0
votes
1answer
193 views

Login failed for user NT AUTHORITY\IUSR

I have some developer colleagues in my office that are having a problem similar to this one: db connection uses an anonymous logon instead of the domain user the connection string (he is working on ...
0
votes
0answers
127 views

Column level security in SQL server

Is it possible to assign column level security in SQL Server directly on a table, without using a view? For example, for table 'tbl', if I want column 1 to be restricted for user 1, is it possible ...
1
vote
1answer
84 views

File permissions for database backups and certificate backups

I have backed up a database and backed up the database master key to the very same folder. Everyone has full access to this folder, however, only the database backup inherits the permissions of the ...
2
votes
0answers
46 views

Questions and advice for complying with Federal tax information (FTI) Security Guidelines for Federal, State and Local Agencies per Publication 1075

I've been able to find writings on compliance topics (e.g. HIPAA, SARBANES-OXLEY, PCI DSS) but I haven't found much on FTI (Federal tax information) and Publication 1075 outside of the IRS website ...
0
votes
1answer
62 views

How do I add a directory, or bulk, of users to Microsoft SQL Server permissions

I have a front end program in Visual Basic that is using SQL Server as a "back end". The only way I can get permission for login to use the SQL server is by adding each name or computer individually ...
0
votes
1answer
45 views

Security user audit

This has probably been asked a million times already and for this i apologise, but is there a way or any T-SQL I can run that will tell me, the server, the database, users login name, what permissions ...
0
votes
1answer
48 views

MySQL - The DBMS must maintain a separate execution domain for each executing process

I'm trying to get a government system hardened and during that process I have to answer certain criteria. One of them is the below:  Rule Title: The DBMS must maintain a separate execution domain ...
0
votes
1answer
48 views

how to get complementary information from sp_readerrorlog

when auditing what are the failing logins in one of my server, using the sp_readerrorlog procedure I get the following result, when running the following query: EXEC sp_readerrorlog 0, 1, 'Login ...
0
votes
1answer
26 views

How to encrypt/secure single columns ins SQL Server?

I would like to secure some columns in my data warehouse. People who are generally allowed to query the database should get returned the columns but encoded. For example: SELECT PERSON_ID FROM PERSON ...
1
vote
0answers
36 views

sql server connectivity broke down to server after its IP address has moved to a subnet. How to restore its connectivity?

I a server called Vermont on a different domain, with a trust relationship. I can ping the server there. But when I try to connect to it, from my SSMS I get the following error: I used to connect ...
0
votes
0answers
27 views

Allowing a user to grant SELECT and VIEW DEFINITION permissions only on objects they create

How do I give access to a user so that they can grant SELECT and VIEW DEFINITION on any objects they create in a database. For example, I have a user MyUser in the roles db_datareader db_datawriter ...
2
votes
1answer
42 views

SSIS best practice to allow easily swappable/ secure/ accessible Database Connections?

I come from Pentaho PDI. There, I learned to have scripts load data to a [VariableDB]. That way, I can either initiate that VariableDB at runtime to "ProdDB" or even set the variable to different ...
3
votes
2answers
257 views

CREATE ASSEMBLY System.DirectoryServices.AccountManagement.dll without enabling TRUSTWORTHY

First, this is for SQL Server 2016. If I was on 2017+, I would be using sp_add_trusted_assembly. Just wanted to clarify that before asking the question. How do you register the assembly System....
1
vote
1answer
42 views

SQL Server TDE - Database backups and post restore behaviour

Below is my SQL Server details: SQL Server 2014 Enterprise SP2 GDR with Availability Group configured. List item NOTE: The Databases are FileStream Enabled. Below are the series of actions I did ...
0
votes
1answer
322 views

How to grant Unmask permission to a user at table level and column level in sql server?

How to grant unmask permission to a user for one particular table and to one particular column within a table? For example, if in table1 if column1 and column2 is masked and in table2 if column3 and ...
1
vote
1answer
60 views

How to safe delete (shred) a MySQL database?

I want to store sensitive data in a MySQL database for a while, so I'd like to know a way to delete a MySQL database without having a chance of recovery. In Linux, we have a tool named shred which ...
12
votes
2answers
1k views

Does changing “sa” password require a SQL restart (in mixed mode)?

We discovered a SQL "sa" account being used in a way it should not have been, so we are changing sa passwords on all our SQL instances. (We have SQL 2005 through 2017 servers running in mixed ...
1
vote
0answers
21 views

MS SQL 2008 R2, security and auditing

I have an 2008R2 SQL Server. There are a few AD groups added to the logins. Each group must have some permissions (and only these permissions if possible). Can someone help me with a few questions: ...
0
votes
0answers
38 views

How does LBAC (Label Based Access Control) work?

I'm having a hard time to understand how an LBAC works? What is the difference between label security and security policy? An example is much appreciated.
0
votes
1answer
28 views

PostgreSQL's PGP_SYM_ENCRYPT log security

In one of our project, I tried to use PostgreSQL's security extension pgcrypto. I found that is function, PGP_SYM_ENCRYPT is quite handy. Using this function enable me to query encrypted data with ...