Re: How can I have a user select a local MS SQL database using vb.net? TIA SAL

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Richard Myers (fake_at_address.com)
Date: 11/09/04 

Date: Wed, 10 Nov 2004 10:47:44 +1300

Hi Cor,

Its just a general design strategy of reducing the attack surface of an application/security in
depth.

Often times people build these fortresses with really high walls but once your inside your free to
roam about the softest of centers. By encrypting the connection string (if it contains the username
and password of SQL logon account rather than integrated security) you create yet another defense
against attack.i.ebake security into every layer of your application right from the get go. Dont
rely on a single component for all aspects of security.

Just becuase they can hack a server doesn;t mean they access they can access the registry. But if as
in my previous post you are storing to the config file then they wont need too.

With respect to the registry, you might then say that if the server is breached such that the
attacker could access the registry then they might not even need the registry key to get at the SQL
data. You might be right, but given the simplicity of encryption in dotNet framework i see little
penalty for the encryption of a registry value and as a course of habit, to me it makes sense to do
it.

Its only got to prove its merit once.

Oao
Richard

"Cor Ligthert" <notmyfirstname@planet.nl> wrote in message
news:%23yYIyIkxEHA.2192@TK2MSFTNGP14.phx.gbl...
> Richard,
>
> I have seen this on MSDN as well. However I do not understand the last
> sentence, can you tell me why?
>
> >You shouldn't be storing the connection in your code. Store it in the
> >registry. If the data >is sensitive be sure and encrypt the string as
> >well.
>
> This implies for me that the registry of a Microsoft Webserver is insecure,
> even for people who are not able to decrypt a string.
>
> Cor
>
>

Relevant Pages

  • Re: Which is more secure RC2 or RC4 ?
    ... in the registry) they are secure enough for your purposes, ... This will IMHO be the only benefit encryption offers ... RC2 is entirely appropriate for this level of security. ... 64 bit ought to be all right too in order to avoid making encryption ...
    (sci.crypt)
  • Re: Password Protection
    ... which part of "(as plain text)" don't you understand? ... You are broadly correct that any encryption would work, ... bother to have the facility as it is just a potential security hole. ... take into consideration simply deleting the password in the Registry. ...
    (microsoft.public.vb.general.discussion)
  • RE: Extracting NT password hashes from registry export file
    ... Extracting NT password hashes from registry export file ... This list is provided by the SecurityFocus Security Intelligence Alert Service. ...
    (Pen-Test)
  • [NT] Exchange 2000 System Attendant Incorrectly Sets Remote Registry Permissions
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Management Console snap in, the System Attendant makes ... changes to the permissions on the Windows Registry to allow Exchange ... There is a flaw in how the System Attendant makes these Registry ...
    (Securiteam)
  • [NT] NoHTML Built-in Outlook 2002 Feature Protects Against Malicious Code
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... non-encrypted e-mail in plain text format. ... guarantee that problems resulting from the incorrect use of Registry ... For information about how to edit the registry, ...
    (Securiteam)