Re: Which hardware upgrades are more important

Lyle Fairfield wrote:
> I don't pretend to know much about security.
>
> But I do ask:
>
> To get into a website I need (I think) a UserName and Password.
> To get into an Internet enabled MS-SQL Server I need a Username and
> Password.
>
> After I get in, I suppose the UserName is likely to determine how much
> damage I can do. I suppose the Server and Website are somewhat
> similar; it's quite likely that my UserName may not let me do
> unlimited damage.
>
> Companies like Interland rent these web-enabled MS-SQL Server DBs by
> the thousands. I've had several over the years and have never lost
> anything (then again I've never had much there worth stealing!). I've
> never heard of these being broken into, although it's clear upon
> examining the other (not my) dbs on the server that many of their
> owners are very lax about security. I've never heard of any big
> intrusion. Maybe they happen. I'm tempted to ask if someone can break
> into one of mine which I'm not using at present, but maybe that's not
> such a smart idea.
>
> I've worked with MS-SQL servers in multi-million dollar corporations.
> The security is ...well there isn't any. Generally anyone using any db
> on any server has access to EVERYTHING if he/she knows where to look.
> The logins are the Wndows logins so when someone goes to lunch ....
> Of course, they pay their dbo's 60 grand a year ... maybe that's why.
>
> Just rambling on...

I had all of these same questions when they told me that I needed to
re-write my external apps. "SQL Server is supposed to use 'REAL' security
so what's the problem with leaving the port open to the internet?"

I asked around a bit on the SS forums and mostly the responses I got agreed
that leaving the server accessible via the internet was a security risk.
Adding fuel to the fire was all of the MS security bulletins that were
coming around almost daily back then. Until I changed my apps one of our
systems guys made sure to CC me on every one of these that he recieved.

Of course most of those bulletins described exploits that could happen only
if you had no password on the default sa account (well duh!).

All in all I can't complain as I was forced to learn a bunch of new
technologies to make the switch and that's always a good thing.

--
I don't check the Email account attached
to this message. Send instead to...
RBrandt at Hunter dot com


.

Relevant Pages

  • RE: [Owasp-dotnet] Re: (Asp.Net Full Trust Vulnerabilities) RE: Apache VS IIS Security model questio
    ... > b) Each client of the server (say, each department of a company, or each ... > c) Each website is placed into its own custom application pool ... password attack to all accounts. ... download the ANBS (Asp.Net Baseline Security) Open Source tool (that I ...
    (Pen-Test)
  • Re: Cant open websites from Front Page
    ... For the files found which are in your website folder structure, ... Restart the server if possible to ensure files are unlocked. ... But they gave me no option to 'delete' the lock file. ... how FP security and NTFS security combine to give the effective rights. ...
    (microsoft.public.frontpage.extensions.windowsnt)
  • Re: Limit some users?
    ... Then the simple way would be to find a Web Hoster and have them host your ... can still visit the website, and you have control of its content. ... Reality is, as soon as you put a server up, the entire world will visit it, ... When you talk about Computers and Security, it is like talking about Cars ...
    (microsoft.public.inetserver.iis.security)
  • [Full-Disclosure] RE: [Owasp-dotnet] Re: (Asp.Net Full Trust Vulnerabilities) RE: Apache VS IIS Secu
    ... > b) Each client of the server (say, each department of a company, or each ... > c) Each website is placed into its own custom application pool ... ALL website's Metabase entries, then the malicious script could (after ... download the ANBS (Asp.Net Baseline Security) Open Source tool (that I ...
    (Full-Disclosure)
  • security-basics Digest of: get.123_145
    ... VPN to ASP a security risk? ... Re: Multiple IPSec tunnels? ... Subject: Security NT Server ... VPN to ASP a security risk? ...
    (Security-Basics)