Security between program and database.

[brandonb]

Hi all,

I'd like to bring up security between application programming and the database. With all the Hackers out there and it being more high profile, I'm starting to ponder writing more secure software. I believe I've been somewhat successful, but like always, what people don't know is usually what gets them. So let's discuss security. I want to start off my discussing what I've done, and I hope people can poke holes into my logic and tell me where I fail. Other people are welcome to join in and post their questions and hopefully get an answer as well.

1) With my latest software, it's being designed entirely on Windows and Active Directory logins/passwords are my authentication. I've designed the DB to not have any service accounts, and to use ONLY windows authentication.

2) Fields in the database that are sensative, such as SSN#, and Credit card information are encrypted using AES-256 encryption using MS SQL's certificates and symmetrical keys.

3) All access to the SQL database is done through only stored procedures, for reading and writing.

4) I've created a user table that stores the active directory GUID for the user, and the current MSSQL SPID (if logged in), again, in AES-256 encryption.

5) In order to get into the system, the application passes the active directory GUID into a "login" stored procedure. It then opens the security certificate/key, decrypts the field from the user table in the stored procedure, and then matches it up to the passed in GUID. If the user is not logged in already, the current SPID is encrypted and written into the user table.

6) All reading stored procedures take the active directory GUID, and SPID and then decrypt the user table to verify those calling the stored procedure is actually an active directory user, and that the spid was indeed from the person who logged in. If it doesn't map up, then the stored procedure returns nothing.

That's about it.

Problems I see:

1) If someone gets into the domain by hacking an admin account, and steals the database file, all sensative fields are encrypted. They can load it onto their system, but they'd have to setup a domain on their end and mimic the active directory GUID, have the database master key, then call the Login script, before they can query. Too easy to bust? I know there are scripts out there that can transmit master keys between servers, so I'm sure they can if they know enough, get the data somehow, if they managed to get into the domain. But what if they don't have my database symmetrical key, I'm not sure if the master key and symmetrical key will work unless they know the symmetrical key. Most of the scripts I've seen to get the master key assume you h ave the symmetrical key handy. Something like that.

Is there any other issues people see in the logic?

 

[Krioni]

Sounds pretty solid. Seems like your network is the only real point of concern. Assuming the network itself is secure, then you should be good. Though I'm certainly no security expert.

If you're truly concerned, then you may want to hire a security consultant group to come do an audit.

What language are you writing the code in?
Just make sure you're not overlooking something silly like having a key in your code and not obfuscating and/or encrypting the code.

Good Luck!

 

[brandonb]

Hi Krioni,

The language is a mix between vb.net and C#, but it's entirely .net based.

No keys are stored in the code, so it should be good to go. I have not looked into obfuscating the code, but I'm sure that is a quick google search. As I know .net has one that comes bundled.

Thank you.

 

[Krioni]

Well.. if you're really this concerned about security then you may want to look into a commercial obfuscation program.

The short of it is that any .net assembly can essentially be de-compiled quite easily with free tools (such as reflector, etc). This can expose your code and logic to anyone who has access to the assemblies and a little bit of knowledge.

The first time you point one of these tools to your assemblies and look through the results, it's kind of shocking/scary.

 

[Krioni]

Oh... and let me add to this...

This is not a knock on .NET. I use .NET daily and love it. This is by design for other very useful things (like reflection). It's just something you must be aware of if you're concerned about security or intellectual property.

 

[degibson]

Where's JackMDS? He's usually the first one to recommend how to lock things down properly on Windows machines.

If I can remember what he might say: Investigate/remove programs running as administrator on the same hosts. There's nothing like a privilege escalation to ruin your day.

 

[JackMDS]

Sounds pretty solid. Seems like your network is the only real point of concern. Assuming the network itself is secure, then you should be good. Though I'm certainly no security expert.

If you're truly concerned, then you may want to hire a security consultant group to come do an audit.

+1.

A this hard to have a general discussion about such in issue, the security concerns are rather precise and are comprised of the nature of the Network, its local topology, Internet access and the level of the sensitive material.

You have to put more into the general Network security.

Network security (as oppose to static file security) is in part based on temporal changes and thus time is a variable that prevent most of intrusions to begin with.

If someone obtains the stored files and can store them on his computers then he/she have all the time in the world to experiment with braking your code.

Given knowledge, time, and strong computing power, they might stumble upon something and get parts or whole of the raw data.

That said all of this depend on what who you are protecting from.

If the OP relates to Home network protected from parents and siblings then you did more then enough to provide good protection.

If (As an example) it is a medical office you need to know the HIPPA rules and put the emphasis on their needs.

If it is for a Financial institution it a totally different ballgame.

Each industry has its specific needs and there are consultants that are specializing in those needs.