I have a microsoft sql server database (2012) and its currently being backed up using maintenance plans. I have a full back up, differential back up and transaction logs backup in my plan. For security reason i would like to add password protection on these files. Is there any way to achieve this within my maintenance plan? Thanks in advance.
I found this link and it will work for me (for now at least).
https://msdn.microsoft.com/en-us/library/bb934049.aspx
The following is from Microsoft Website
Transparent Data Encryption (TDE)
Transparent Data Encryption (TDE) encrypts SQL Server and Azure SQL
Database data files, known as encrypting data at rest. You can take
several precautions to help secure the database such as designing a
secure system, encrypting confidential assets, and building a firewall
around the database servers. However, in a scenario where the physical
media (such as drives or backup tapes) are stolen, a malicious party
can just restore or attach the database and browse the data. One
solution is to encrypt the sensitive data in the database and protect
the keys that are used to encrypt the data with a certificate. This
prevents anyone without the keys from using the data, but this kind of
protection must be planned in advance.
TDE performs real-time I/O encryption and decryption of the data and
log files. The encryption uses a database encryption key (DEK), which
is stored in the database boot record for availability during
recovery. The DEK is a symmetric key secured by using a certificate
stored in the master database of the server or an asymmetric key
protected by an EKM module. TDE protects data "at rest", meaning the
data and log files. It provides the ability to comply with many laws,
regulations, and guidelines established in various industries. This
enables software developers to encrypt data by using AES and 3DES
encryption algorithms without changing existing applications.
Related
I'm writing a program on Visual studio using C#. My question is, after I publish the app .exe, is any hacker can see my codes like SQL user name , password etc. is it possible? How can I block this in development stage?
You can Encrypting Configuration Information
Part of securing an application involves ensuring that highly
sensitive information is not stored in a readable or easily decodable
format. Examples of sensitive information include user names,
passwords, connection strings, and encryption keys. Storing sensitive
information in a non-readable format improves the security of your
application by making it difficult for an attacker to gain access to
the sensitive information, even if an attacker gains access to the
file, database, or other storage location.
But all you are doing is not making it not easily decodable.
You simple cannot hide a connection string.
You should connect to a service that authenticates the client and service connects to the database. The database whould not even be publicly available. See WCF (Windows Communication Foundation).
Even encrypted files are not safe, hackers can try access main computers to clone source files....
I am using Sync framework default database provider to synchronization (Sync framework 2.1). Can anyone please give me bit explanation how data transfer between client and server with sync framework? Are there any security threat with this Synchronizing? Can we use encryption with default database provider?
I read the following article,
http://msdn.microsoft.com/en-us/sync/bb887608.aspx
From a synchronization perspective, Sync Framework supports the
ability to encrypt data as it travels between databases. On the
corporate side, SQL Server 2008 as well as existing IIS security can
be leveraged for user authentication as users exchange data.
we are using the default sync provider. Can we use default database provider to synchronize over the HTTPS or SSL? Basically what I need to know is, can someone see the data transferring between client to server?
Please give me your answer.
Regards,
This post help me when I was using this technology
Making database schema changes using Microsoft Sync framework without losing any tracking table data
Here you can find two articles with information
https://drive.google.com/folderview?id=0B_21acb3mbRQV3Mxdm5TeVVTcEU&usp=sharing
Hi if your are using ssl its enough for encryption purpuse
Hope it helps
Sync Framework OOTB doesn't encrypt data over the wire.
if you're synching over HTTP, then you can enable SSL to encrypt the traffic.
you can also enable TDS encryption on the SQL Connection.
We're working on a TCP server that secures its communication with its clients using TLS/SSL.
Currently we are storing our public (.cer file) and private (password protected, private key included .p12) certificates in the Windows certificate store. We are going to increase the number of TCP servers soon and depending on the traffic we'll be adding more and more in time.
To facilitate the deployment process and periodic certificate change (or in case we detect some sort of intrusion) we plan to store both (private and public) certificates in the system's common MySQL database that is accessible by the TCP servers.
Is storing the .cer and password protected .p12 files in BLOB columns a bad idea from a security point of view?
P.S: I don't think it is very relevant but the TCP server is being developed in c#.
Skipping the security concerns, your language is PKE with native support for the windows store, you are going to have to roll your own (increase complexity) with this change. It would be better as part of the server start to update the Windows Store.
From a security point of view, you now have additional points where the encrypted key are accessible. Is you password secure enough? This is not a best practice and should be managed by the systems admin doing the install and updates. Lastly, this increase of complexity also increase the attack surface.
My OSCommerce site includes a separately programmed feature for which I use SQL tables. I've decided to host its tables on a remote site offering free SQL accounts. I'd like to know if there could be any disadvantages to this approach.
Thanks
Syd
Disadvantages might include the longer time it will take to run the script since it has to make a connection over the network and the need to make sure that the database connection is made securely -- that the password for the database login isn't passed in clear text & that the permissions on the receiving end of the connection are set to allow connections from only that IP. Of course you'll also want to make sure that the free hosting company provides adequate security for the database itself -- "free" doesn't alway pay for the best set up or the most knowledgeable technicians...
You should connect to your MySQL database using MySQL's built-in SSL ability. This insures that all data transfered is highly protected. You should create self-signed x509 certificates and hard code them. This is free, and you don't need a CA like Verisign for this. If there is a certificate exception then there is a MITM and thus this stops you from spilling the password.
Another option is a VPN, and this is better suited if you have multiple daemons that require secure point to point connections.
I am assuming you are hosting the OSCommerce database on the same server as the webserver and your solution only allocates one database per customer. You can use the add-on tables in the same database as the regular OSCommerce tables as long as you prefix them with some prefix so that they won't have a namespace conflicts. If the code to the third party solution is any good, it won't be too hard to configure a table prefix so that the code will know what the new names for the tables are. This solves any potential latency problem and keeps the control in your hands. I use this trick to host multiple wordpress blogs in the same database.
Reason: We have a new client that wishes for the database containing all their info to be stored on their own personal database server. However the web server will be located at another location.
Question How can you secure the data from the time it is inputed until the time an external database saves it?
Through some reading it seems that SSL will only cover so much and that some sort of a secure connection must be set up between the two. Or does the SSL cover this connection as well? It somewhat seems that it should.
SSL provides a reasonable solution to transport security (keeping the data safe from prying eyes as it goes over the wire).
Lock down the endpoints between the two systems as far as practical. For example, in addition to encryption, our firewall blocks physical access to the database except from well-known IP addresses.
You still need to ensure that your web server is secure (since the data is available unencrypted there), and that their database server is secure (including encryption of sensitive data when stored in database tables).