Policy-Discussion

[Jac Kersing <j.kersing AT the-box.com>]

On Sat, 23 Jul 2005, Russell Smith wrote:

> Would the SQL server be secured on a third machine, with only network 
> connections allowed on the relevant port? I assume the only way to 
> protect data is to ensure that only certain queries can be run.  As if 
> you comprimise the web server, you have all the passwords to connect to 
> the SQL server. I'm not sure how exactly the SQL server could be 
> secured, it needs more flexible access than the root key server.

Some protection would be to use stored procedures for the queries and 
limit access from the webserver to the stored procedures (hmmm, does MySQL 
do stored procedure these days?) That way only predefined queries can be 
executed...


Regards,

Jac

---
 Jac Kersing            Technical Consultant   The-Box Development
 
j.kersing AT the-box.com
         CISSP           http://www.the-box.com