Re: security question

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Mark Allison (marka_at_no.tinned.meat.mvps.org)
Date: 08/11/04 

Date: Wed, 11 Aug 2004 12:50:16 +0100

stan,

Put the SQL Server in its own DMZ. Then only allow communication from
the web server to the SQL Server through a single port. Do not allow SQL
Server direct access to the web or the lan.

Allow access from the lan to the SQL Server (so you can manage it). You
will need to think about backups - possibly have a tape drive directly
attached to SQL Server, or perhaps another server in the DMZ. 

--
Mark Allison, SQL Server MVP
http://www.markallison.co.uk
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
stan wrote:
> Hello:
> 
> Just a general question. What is the best way to protect data gathered from
> a website that is written to a sql database. My decision was to place the
> web server in dmz and backend sql with database behind firewall. Our web guy
> contends that because we have to open ports from WEB (dmz) to LAN
> (sqlserver) to allow the communications between web server and DB, that the
> SQL server is just as vulnerable to attack through the open ports dmz to
> lan.
> 
> Anyone shed any light on this.
> 
>

Relevant Pages

  • Re: SQL2000 based website: DMZ or LAN placement
    ... It will be IIS on one box (in the ... DMZ) and SQL2000 on the other. ... be to put the SQL server in the DMZ, and allow no direct access to it ... since it is fully exposed to the compromised web server. ...
    (comp.security.firewalls)
  • RE: Problems with WebParts
    ... to a database called aspnetdb. ... > The connection string specifies a local SQL Server Express instance using a ... > server account must have read and write access to the applications directory. ... > This is necessary because the web server account will automatically create ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Remote development advice
    ... We are using IIS as the web server. ... The IIS and SQL Server is setup in his ... I want to be able to access the pages that my friend has done remotely ... Then whichever web site he has configured as the default site on IIS should appear, assuming the web server was configured correctly. ...
    (microsoft.public.dotnet.general)
  • ODBC Help - Desperate! Help me please!
    ... I have a SQL Server 2000 setup in our DMZ with ports open from the LAN into ...
    (microsoft.public.sqlserver.odbc)
  • Re: SQL2K WIN2K3 CONNECTION SECURITY
    ... My own benchmarking indicates that TCP/IP is faster than named pipes. ... the benchmark stats as the starting point... ... Perfmon and SQL Server Profiler along with SQL Server Query Analyser. ... encrypted on the web server. ...
    (microsoft.public.security)