Access Security - Secure Logins

[Sedrick]

From what I have been reading, user level security is not available on Access 2007 and newer unless you have converted the database from an earlier version that does have it.

How good is the security if this step is taken (to convert from an older versoin)? In that case, would the username and password be automatically encrypted across the network if a 2007 or 2010 database was set up on a server with local user clients on individual machines?

If not, I'm thinking the best approach would be to use ODBC and SSL with Microsoft SQL Server or some other database server in order to achieve an encrypted data stream across the network.

Another approach I'm wondering about is to set up a password/username table (hidden table) on the shared database server file and use it for logins. How secure would that be?

Does anyone really use Access where stringent security measures are needed?

Thanks!

[Rabbit]

If you need real security, forget Access and go with an Enterprise solution like SQL Server. I'm sure there are people who use Access where stringent security measures are needed but they are asking for a whole heap of trouble because Access is not secure at all and there's very little you can do to change that.

[Sedrick]

Thanks Rabbit,

You know, I was just thinking of something. If a 2007 or 2010 database is encrypted and split then you have the following. An encrypted .accdb file and an encypted front-end (I see from the Microsoft site that both the front-end and the back-end databases should be encrypted) http://office.microsoft.com/en-us/ac...010096299.aspx

When you have an encrypted .accdb file just setting there then I would assume that it is like any other data file - it stores things and lets the program do the processing.

So unless it is different than most data files, and just setting there being read from and written to, then it would seem like anything that goes across the network would go across encrypted, just as it was read or written.

When you set a database password on it, for example, which end does the processsing occur on to see if the password is correct or not? Seems like it would be on the front-end.

Does anyone know for sure?

[NeoPa]

Sedrick:
Does anyone really use Access where stringent security measures are needed?

Not that I know of. Frankly it was always pretty useless or, if used properly, pretty complicated and quite messy to use (It involved horrible manipulation of the setting of where to find the MDW file etc). It was probably a bad move to get rid of it the way they did, but never something I'd recommend people work with.