SitePoint Sponsor

User Tag List

Results 1 to 4 of 4
  1. #1
    SitePoint Enthusiast
    Join Date
    Jul 2005
    Posts
    37
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Securing a Database that contains sensitive information

    I have been given the task of creating a database that will contain data that needs to be secure. Other than just encryption, what other things could I implement or do to protect that data?

  2. #2
    Non-Member Kalon's Avatar
    Join Date
    Aug 2010
    Location
    At my computer
    Posts
    2,012
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    If the data in the database will be updated by users via web forms, a must-do is validate all user inputs and sanitise user inputs with mysql_real_escape_string() (if using php) or prepared statements before passing them to any sql queries.

  3. #3
    SitePoint Enthusiast
    Join Date
    Jul 2005
    Posts
    37
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Validation is definitely a must on my list, as is limiting permissions. I was curious as to more of features or things I can implement to keep people out of the database that don't belong.

  4. #4
    SitePoint Addict
    Join Date
    Apr 2009
    Posts
    357
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)
    Here's some of my thoughts:

    Make sure the server is physically secure.

    Spend plenty of time working on restricting access to the database to only allowed programs or hosts.

    Spend more time working on the granular authentication scheme you'll use to restrict user access to the data.

    Consider who has access to any database backups.

    How is data that's presented to users secured after it's viewed? Think about what and where any data gets cached.

    I'm sure there's lots more.
    Doug G
    =====
    "If you ain't the lead dog, the view is always the same - Anon


Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •