6 ms·

With the amount of hacking that is flooding the news recently, I would like to learn about database security. What are some good books/tutorials/videos on how t

With the amount of hacking that is flooding the news recently, I would like to learn about database security. What are some good books/tutorials/videos on how to make databases more secure?

estel 15y ago
The Web Application Hacker's Handbook is most widely cited in a more general sense. I'm reading it myself at the moment - http://www.amazon.com/Web-Application-Hackers-Handbook-Discovering/dp/0470170778 http://www.amazon.com/Web-Application-Hackers-Handbook-Disco...
Joakal 15y ago
SQL injections seem to be the prominent exploit by them. Not in any order of popularity: 1. Brute-force (or not) cracking of weak or default usernames/passwords 2. Privilege escalation 3. Exploiting unused and unnecessary database services and functionality 4. Targeting unpatched database vulnerabilities 5. SQL injection 6. Stolen backup (unencrypted) tapes http://mobile.darkreading.com/9289/show/8506121498da7d8ae48394480223d1f2&t=68d089bd0a4d2a12101720a1a53d9e9a http://mobile.darkreading.com/9289/show/8506121498da7d8ae483...
tomp 15y ago
I believe that most databases are secure, especially the open source ones. What you should be careful about is the things surrounding the database: the .php files (or whatever) that read/write the database, and the system it is running on. Basic security practice for the web: NEVER trust user input: check and recheck all the GET/POST variables, check that numbers are numbers, that strings are correct strings (they have no funny characters, such as " or ; (for databases) or <>"&' (for HTML) or . (for paths)). Check all input into the databases (to prevent SQL injections) and all output for to the user (for XSS). Basic security practice for sysadmins: Use up-to-date OS and software. Use strong passwords. Almost never run root. Make remote access hard. This seems easy, and for the most part, it is. It's just so many things that people forget to check for them all.
- ern 15y ago
  Another obvious weak point is not controlling access to copies of production databases. Developers getting access to copies of production databases full of personal info is terrifying, and yet not uncommon.
- pornel 15y ago
  Yes, let's secure our databases against O'Reillys and AT&Ts submitting their funny names! <g> It's not characters that get you, it's lack of escaping or escaping for the wrong context (e.g. magic_quotes won't work for HTML) • For SQL use prepared statements exclusively (never let "oh, it's just a number so I don't need to" fool you) • Escaping doesn't differ between "trusted" and "untrusted" data (and these boundaries are too easy to break eventually). Just escape everything, always. In PHP it means every `echo $var` is a likely vulnerability and `echo htmlspecialchars($var, ENT_QUOTES)` (in HTML except script) or `json_encode($var)` (in script) is a must. Obviously, you should do defense in depth, so input validation is great and some filtering just-in-case may be warranted, but escaping alone (assuming done well) is sufficient for security, while filtering alone is not.
  - fendale 15y ago
    > For SQL use prepared statements exclusively (never let "oh, it's just a number so I don't need to" fool you) I cannot vote this up enough. Also, depending on what database you are using (eg Oracle) if you don't use prepared statements (aka bind variables) you are guarantee killing your DB performance. People have argued with me in the past that for things like sorting the data they cannot use bind variables. In that case, use the user input to select which safe string to use, eg: if user_select_sort == 'by_account_num' return 'order by account_num asc' elsif user_select_sort == 'by_transaction_date' return 'order by transaction_date' else return '' end if Then if someone sends in something tricky, it will just order wrong.
    - lmz 15y ago
      On the other hand some uses of bind variables can kill performance: http://www.dbspecialists.com/specialists/specialist2003-11.html http://www.dbspecialists.com/specialists/specialist2003-11.h...
odiroot 15y ago
I'd recommend: https://www.owasp.org https://www.owasp.org if you're working on the Web.

With the amount of hacking that is flooding the news recently, I would like to learn about database security. What are some good books/tutorials/videos on how to make databases more secure?

estel 15y ago

The Web Application Hacker's Handbook is most widely cited in a more general sense. I'm reading it myself at the moment - http://www.amazon.com/Web-Application-Hackers-Handbook-Discovering/dp/0470170778 http://www.amazon.com/Web-Application-Hackers-Handbook-Disco...

Joakal 15y ago

SQL injections seem to be the prominent exploit by them. Not in any order of popularity: 1. Brute-force (or not) cracking of weak or default usernames/passwords 2. Privilege escalation 3. Exploiting unused and unnecessary database services and functionality 4. Targeting unpatched database vulnerabilities 5. SQL injection 6. Stolen backup (unencrypted) tapes http://mobile.darkreading.com/9289/show/8506121498da7d8ae48394480223d1f2&t=68d089bd0a4d2a12101720a1a53d9e9a http://mobile.darkreading.com/9289/show/8506121498da7d8ae483...

tomp 15y ago

I believe that most databases are secure, especially the open source ones. What you should be careful about is the things surrounding the database: the .php files (or whatever) that read/write the database, and the system it is running on. Basic security practice for the web: NEVER trust user input: check and recheck all the GET/POST variables, check that numbers are numbers, that strings are correct strings (they have no funny characters, such as " or ; (for databases) or <>"&' (for HTML) or . (for paths)). Check all input into the databases (to prevent SQL injections) and all output for to the user (for XSS). Basic security practice for sysadmins: Use up-to-date OS and software. Use strong passwords. Almost never run root. Make remote access hard. This seems easy, and for the most part, it is. It's just so many things that people forget to check for them all.

ern 15y ago
Another obvious weak point is not controlling access to copies of production databases. Developers getting access to copies of production databases full of personal info is terrifying, and yet not uncommon.
pornel 15y ago
Yes, let's secure our databases against O'Reillys and AT&Ts submitting their funny names! <g> It's not characters that get you, it's lack of escaping or escaping for the wrong context (e.g. magic_quotes won't work for HTML) • For SQL use prepared statements exclusively (never let "oh, it's just a number so I don't need to" fool you) • Escaping doesn't differ between "trusted" and "untrusted" data (and these boundaries are too easy to break eventually). Just escape everything, always. In PHP it means every `echo $var` is a likely vulnerability and `echo htmlspecialchars($var, ENT_QUOTES)` (in HTML except script) or `json_encode($var)` (in script) is a must. Obviously, you should do defense in depth, so input validation is great and some filtering just-in-case may be warranted, but escaping alone (assuming done well) is sufficient for security, while filtering alone is not.
- fendale 15y ago
  > For SQL use prepared statements exclusively (never let "oh, it's just a number so I don't need to" fool you) I cannot vote this up enough. Also, depending on what database you are using (eg Oracle) if you don't use prepared statements (aka bind variables) you are guarantee killing your DB performance. People have argued with me in the past that for things like sorting the data they cannot use bind variables. In that case, use the user input to select which safe string to use, eg: if user_select_sort == 'by_account_num' return 'order by account_num asc' elsif user_select_sort == 'by_transaction_date' return 'order by transaction_date' else return '' end if Then if someone sends in something tricky, it will just order wrong.
  - lmz 15y ago
    On the other hand some uses of bind variables can kill performance: http://www.dbspecialists.com/specialists/specialist2003-11.html http://www.dbspecialists.com/specialists/specialist2003-11.h...

odiroot 15y ago

I'd recommend: https://www.owasp.org https://www.owasp.org if you're working on the Web.