With the amount of hacking that is flooding the news recently, I would like to learn about database security. What are some good books/tutorials/videos on how to make databases more secure?
Not in any order of popularity:
1. Brute-force (or not) cracking of weak or default usernames/passwords
2. Privilege escalation
3. Exploiting unused and unnecessary database services and functionality
4. Targeting unpatched database vulnerabilities
5. SQL injection
6. Stolen backup (unencrypted) tapes
http://mobile.darkreading.com/9289/show/8506121498da7d8ae483...
What you should be careful about is the things surrounding the database: the .php files (or whatever) that read/write the database, and the system it is running on.
Basic security practice for the web: NEVER trust user input: check and recheck all the GET/POST variables, check that numbers are numbers, that strings are correct strings (they have no funny characters, such as " or ; (for databases) or <>"&' (for HTML) or . (for paths)). Check all input into the databases (to prevent SQL injections) and all output for to the user (for XSS).
Basic security practice for sysadmins: Use up-to-date OS and software. Use strong passwords. Almost never run root. Make remote access hard.
This seems easy, and for the most part, it is. It's just so many things that people forget to check for them all.
It's not characters that get you, it's lack of escaping or escaping for the wrong context (e.g. magic_quotes won't work for HTML)
• For SQL use prepared statements exclusively (never let "oh, it's just a number so I don't need to" fool you)
• Escaping doesn't differ between "trusted" and "untrusted" data (and these boundaries are too easy to break eventually).
Just escape everything, always. In PHP it means every `echo $var` is a likely vulnerability and `echo htmlspecialchars($var, ENT_QUOTES)` (in HTML except script) or `json_encode($var)` (in script) is a must.
Obviously, you should do defense in depth, so input validation is great and some filtering just-in-case may be warranted, but escaping alone (assuming done well) is sufficient for security, while filtering alone is not.
I cannot vote this up enough. Also, depending on what database you are using (eg Oracle) if you don't use prepared statements (aka bind variables) you are guarantee killing your DB performance.
People have argued with me in the past that for things like sorting the data they cannot use bind variables. In that case, use the user input to select which safe string to use, eg:
if user_select_sort == 'by_account_num'
return 'order by account_num asc'
elsif user_select_sort == 'by_transaction_date'
return 'order by transaction_date'
else
return ''
end if
Why not just pass numbers instead?
[1]http://ha.ckers.org/sqlinjection/
[2]https://docs.google.com/viewer?url=http://www.ihteam.net/pap...