How do I make my database secure?

[COHENMARVIN]

I have a sql server database hosted by an ISP. It has credit card
fields. I want to make the database secure.
My asp.net pages refer to the database as follows:
strConnection =
ConfigurationSe ttings.AppSetti ngs["ConnectionInfo rmation"];
Which means they get the connectionstrin g for the database from a
web.config file.
The web.config file has the following tags:
<appSettings>
<add key="Connection Information"
value="Server=s ql2k5.earthweb. com;Database=me rc_One;uid=usa_ hvtest;password =vinyl"
/>
</appSettings>
Is there some way to encrypt the connection string? Would it be
encrypted in the web.config? Could some hacker get at the web.config?
Are there any other security measures I could take? For instance,
could the creditcard fields be encrypted in the database?
Thanks in advance for any pointers.
-- Marvin

[Bruce Barker]

unless you are on a dedicated server, you are not too secure. other websites
hosted by asp.net have permission to open your web config and read it (as
the asp.net process need access).

asp.net allows encryption by storing the connect string in the registry, but
your isp would have to support this. you could encrypt it yourself, but the
trick is where to store the key (other sites have access to bin, and can
decompile your code to see the decryption code). you should also encrypt in
the database, because you need to secure backups also. when the banks
exposed their cc list, it was thru a lost backup tape.

..net has encryption routines, you shoudl look at using them.

-- bruce (sqlwork.com)


"COHENMARVI N" <co*********@ho tmail.com> wrote in message
news:11******** **************@ g43g2000cwa.goo glegroups.com.. .

I have a sql server database hosted by an ISP. It has credit card
fields. I want to make the database secure.
My asp.net pages refer to the database as follows:
strConnection =
ConfigurationSe ttings.AppSetti ngs["ConnectionInfo rmation"];
Which means they get the connectionstrin g for the database from a
web.config file.
The web.config file has the following tags:
<appSettings>
<add key="Connection Information"
value="Server=s ql2k5.earthweb. com;Database=me rc_One;uid=usa_ hvtest;password =vinyl"
/>
</appSettings>
Is there some way to encrypt the connection string? Would it be
encrypted in the web.config? Could some hacker get at the web.config?
Are there any other security measures I could take? For instance,
could the creditcard fields be encrypted in the database?
Thanks in advance for any pointers.
-- Marvin

[Norman Yuan]

Besides what said in other post, when storing sensitive data, such as credit
card info, you should not store the data in database as clear text. You
should encrypt the data itself before place it into database. And then when
your app reads these data, you decrypt them. So that the data is not
physically readable by anyone other than your app.

"COHENMARVI N" <co*********@ho tmail.com> wrote in message
news:11******** **************@ g43g2000cwa.goo glegroups.com.. .

I have a sql server database hosted by an ISP. It has credit card
fields. I want to make the database secure.
My asp.net pages refer to the database as follows:
strConnection =
ConfigurationSe ttings.AppSetti ngs["ConnectionInfo rmation"];
Which means they get the connectionstrin g for the database from a
web.config file.
The web.config file has the following tags:
<appSettings>
<add key="Connection Information"
value="Server=s ql2k5.earthweb. com;Database=me rc_One;uid=usa_ hvtest;password =vinyl"
/>
</appSettings>
Is there some way to encrypt the connection string? Would it be
encrypted in the web.config? Could some hacker get at the web.config?
Are there any other security measures I could take? For instance,
could the creditcard fields be encrypted in the database?
Thanks in advance for any pointers.
-- Marvin

[John Murray]

Even with encryption, the system has to have a key, and in a shared
hosting environment, it is going to be extremely difficult to come up
with a way to protect that key .... If someone is able to penetrate the
system and get direct access to the SQL Server .... then chances are
they are going to be able to scan your code to find the encryption keys,
or how you are obfuscating them.

Norman Yuan wrote:

Besides what said in other post, when storing sensitive data, such as credit
card info, you should not store the data in database as clear text. You
should encrypt the data itself before place it into database. And then when
your app reads these data, you decrypt them. So that the data is not
physically readable by anyone other than your app.

"COHENMARVI N" <co*********@ho tmail.com> wrote in message
news:11******** **************@ g43g2000cwa.goo glegroups.com.. .

I have a sql server database hosted by an ISP. It has credit card
fields. I want to make the database secure.
My asp.net pages refer to the database as follows:
strConnecti on =
Configuration Settings.AppSet tings["ConnectionInfo rmation"];
Which means they get the connectionstrin g for the database from a
web.config file.
The web.config file has the following tags:
<appSetting s>
<add key="Connection Information"
value="Server =sql2k5.earthwe b.com;Database= merc_One;uid=us a_hvtest;passwo rd=vinyl"
/>
</appSettings>
Is there some way to encrypt the connection string? Would it be
encrypted in the web.config? Could some hacker get at the web.config?
Are there any other security measures I could take? For instance,
could the creditcard fields be encrypted in the database?
Thanks in advance for any pointers.
-- Marvin

[Scott Allen]

On Thu, 17 Nov 2005 11:04:56 -0800, "Bruce Barker"
<br************ ******@safeco.c om> wrote:

unless you are on a dedicated server, you are not too secure. other websites
hosted by asp.net have permission to open your web config and read it (as
the asp.net process need access).

That's where code access security and running under partial trust come
in:
http://odetocode.com/Blogs/scott/arc...0/28/2394.aspx

--
Scott
http://www.OdeToCode.com/blogs/scott/

[kfrost]

You could try to talk your ISP into importing a Key and follow one of the
docs on how to use aspnet_regiis to create a RSA key and export to them.
--
kr**@n-sv.com.<Remove This Before Emailing>

Network & Software Integration
www.n-sv.com

"Helping put the pieces of your IT puzzle together"
"COHENMARVI N" wrote:

I have a sql server database hosted by an ISP. It has credit card
fields. I want to make the database secure.
My asp.net pages refer to the database as follows:
strConnection =
ConfigurationSe ttings.AppSetti ngs["ConnectionInfo rmation"];
Which means they get the connectionstrin g for the database from a
web.config file.
The web.config file has the following tags:
<appSettings>
<add key="Connection Information"
value="Server=s ql2k5.earthweb. com;Database=me rc_One;uid=usa_ hvtest;password =vinyl"
/>
</appSettings>
Is there some way to encrypt the connection string? Would it be
encrypted in the web.config? Could some hacker get at the web.config?
Are there any other security measures I could take? For instance,
could the creditcard fields be encrypted in the database?
Thanks in advance for any pointers.
-- Marvin