database security

Question

database security

naveed ahmad

SSC Veteran

Points: 299
More actions
March 7, 2006 at 7:32 am

#111431

i want to prevent system administrator (window,running sql server 2k) from taking 'mdf' or backup file of my db, to another system (might be his personal) where he can restore or re-attach my db and steal all the model & logic.
i want to enable such security in my db so that he do so, the db cant' be restored or re-atteched on any other sql-server with out proper authentication.

look forward
naveed

Viewing 8 posts - 1 through 7 (of 7 total)

You must be logged in to reply to this topic. Login to reply

Steve Jones - SSC Editor SSC Guru Points: 735942 More actions · Answer 1

You can backup the files with a password, although it is not very strong. There are third party backups (Quest, RedGate, etc) that will encrypt the backup.

for the MDF, I'd guess you need to encrypt the file system, which will cause a performance hit, and limit access to the DBAs.

Lowell SSC Guru Points: 323518 More actions · Answer 2

if you can't trust your system admin, you've got a flaw in your business;

if he's making copies, tell him to stop and destroy and copies he has made. Sysadmins are used to following procedure; if he's a rogue, then maybe you'd have to consider uglier options, like removing him from the administrators group and demoting him from his position., or from the company altogether.

tell him what your concern is first. don't run around behind his back and try to remove rights.

Lowell

--help us help you! If you post a question, make sure you include a CREATE TABLE... statement and INSERT INTO... statement into that table to give the volunteers here representative data. with your description of the problem, we can provide a tested, verifiable solution to your question! asking the question the right way gets you a tested answer the fastest way possible!

naveed ahmad SSC Veteran Points: 299 More actions · Answer 3

but what about if we deploy a solution to a third party, and that company do so. ( copy the db and sold on next)

Lowell SSC Guru Points: 323518 More actions · Answer 4

who owns the data? doesn't the company you deploy to own the data in the database?

We have a very similar situation...we provide a blank database with default values, and then the agency uses it for the applicaiton; the app inserts and updates the data.

In that situation, if they want to copy it, back it up, create an additional test instance, they can; it's just our company only supports problems arising from the default production instance.

in our case, if certain default values are changed, the application reports an error that the database has to be activiated, so that the the database and application can't just be given to another company and start using it, but other than that, it's really hard to tell a company they can't copy their own data.

so you can set the application to stop working normally if values like the company name changed, or a whole myraid of other items in your data.

Lowell

--help us help you! If you post a question, make sure you include a CREATE TABLE... statement and INSERT INTO... statement into that table to give the volunteers here representative data. with your description of the problem, we can provide a tested, verifiable solution to your question! asking the question the right way gets you a tested answer the fastest way possible!

naveed ahmad SSC Veteran Points: 299 More actions · Answer 5

thank Lowell , u r right.

but i m afraid of, that the might be picked up by a developer or software house, so they copy my data model and logic from tables and procedures.

so, there should be some mechanism to stop that........

ok

regard

naveed

SQLBill SSC Guru Points: 51440 More actions · Answer 6

There is a solution. It's called COPYWRITE. If your database, etc. is unique, then you should be able to copywrite it. You could also have the company sign a non-disclosure contract forbidding them to copy and resell the database design. But, this is really going to be hard to do...it's rare that a database design is THAT unique.

-SQLBill

DLathrop SSCrazy Points: 2018 More actions · Answer 7

You can also try the technique of "obfuscating" names. Common in certain programming languages, a process runs that renames all objects so they are meaningless.

However, if you allow users to query your database, they need to know your data model anyway and this just makes it inconvenient for them when trying to formulate queries.

You can also have SQL Server encrypt your stored procedures, in order to protect your logic. This allows them to be executed, but you cannot retrieve the source (easily).

David Lathrop
DBA
WA Dept of Health