Chapter 12: Securing Databases
|
Overview
Key concepts in this chapter are:
-
Understanding authentication and authorization for Microsoft Access databases
-
Understanding authentication and authorization for Microsoft SQL Server databases
-
Locking down Access databases
-
Locking down SQL Server databases
For many companies, a database doesn’t just run the business, it is the business. For example, suppose you run a Web site that sells miniature plastic dinosaurs over the Internet. You probably use a database to store your product catalogs, keep a list of registered users, and track order fulfillment. If someone orders a pint-sized Tyrannosaurus Rex to be sent special delivery to a trailer park in Monteagle, Tennessee, your database plays a critical role. It records the order, keeps track of credit card and address information, and stores the status of the order as the Tyrannosaurus Rex moves from the warehouse, through picking and packaging, and finally shipping to the eager recipient. Because the database keeps track of this vital information, it makes a tempting target for intruders.
The challenge of securing a database is that it must provide high performance and availability to your application or Web site. In addition, because databases often act as the central storage site for a business, they must aggregate and share information with other systems. For example, a warehousing system that stores the inventory of miniature plastic dinosaurs might log on silently to the central database, not requiring a user to enter a logon name and a password. Along with maintaining high availability and performance, a database also should prevent unauthorized users from reading or changing information. This is a challenge for you, the up-and-coming security expert. This chapter looks specifically at securing Microsoft Access 2002 and Microsoft SQL Server 2000 databases, although like everything else, the core concepts apply equally to earlier versions of these databases, plus DB2, Oracle, and the myriad other database systems. Let’s start by discussing core database security concepts.
|
