數(shù)據(jù)庫(kù)安全外文翻譯-數(shù)據(jù)庫(kù)-資料下載頁(yè)
2025-01-19 11:55本頁(yè)面
【導(dǎo)讀】事實(shí)上，在防護(hù)一個(gè)組織的信息方面，數(shù)據(jù)庫(kù)的安全是至高無(wú)上的，因?yàn)?。它可能?huì)間接接觸比我們意識(shí)到的更廣泛的用戶。這是兩篇研究數(shù)據(jù)庫(kù)安全文章中的第一篇。據(jù)庫(kù)安全概念和和比較普遍的問(wèn)題。在下篇文章，我們將把焦點(diǎn)放在特定的。MicrosoftSQL和Oracle的安全關(guān)注上。近來(lái)數(shù)據(jù)庫(kù)安全已成為一個(gè)熱門(mén)話題。不再有許多不安全的網(wǎng)絡(luò)存在）。因此，重點(diǎn)是加大對(duì)技術(shù)的考慮力度，譬如以。更細(xì)膩的審查態(tài)度對(duì)待數(shù)據(jù)庫(kù)。是審慎而且必要的。雖然這可能節(jié)省的購(gòu)買(mǎi)一個(gè)單獨(dú)的服務(wù)器費(fèi)用，在互聯(lián)網(wǎng)上提供的，與Oracle數(shù)據(jù)庫(kù)在互聯(lián)網(wǎng)上提供有關(guān)端口1521。認(rèn)設(shè)置的使用以及粗糙的安全措施，使服務(wù)器更加脆弱。墻保護(hù)問(wèn)題，但最終它確是數(shù)據(jù)庫(kù)，這是毫不妥協(xié)的。絡(luò)的各部分來(lái)看而被迫作出的。安全審查過(guò)程進(jìn)展順利，訪問(wèn)控制基于Windows認(rèn)證。要求進(jìn)行處理，拒絕直接進(jìn)入資料庫(kù)的所有嘗試。貫穿安全業(yè)的一個(gè)普遍問(wèn)題是應(yīng)用軟件安全，特別是定制的Web應(yīng)用程序。洞的更大的潛在威脅。
【正文】 . Where this cannot be performed, consideration should be made to try and substitute characters (for example the use of single quotes, which are monly used in SQL mands). Specific securityrelated coding techniques should be added to coding standard in use within your anization. If all developers are using the same baseline standards, with specific security measures, this will reduce the risk of SQL injection promises. Another simple method that can be employed is to remove all procedures within the database that are not required. This restricts the extent that unwanted or superfluous aspects of the database could be maliciously used. This is analogous to removing unwanted services on an operating system, which is mon security practice. ◆ Overall In conclusion, most of the points I have made above are mon sense security concepts, and are not specific to databases. However all of these points DO apply to databases and if these basic security measures are employed, the security of your database will be greatly improved. The next article on database security will focus on specific SQL and Oracle security problems, with detailed examples and advice for DBAs and developers. There are a lot of similarities between database security and general IT security, with generic simple security steps and measures that can be (and should be) easily implemented to dramatically improve security. While these may seem like mon sense, it is surprising how many times we have seen that mon security measures are not implemented and so cause a security exposure. 共 9 頁(yè) 第 8 頁(yè) ◆ User account and password security One of the basic first principals in IT security is “make sure you have a good password”. Within this statement I have assumed that a password is set in the first place, though this is often not the case. I touched on mon sense security in my last article, but I think it is important to highlight this again. As with operating systems, the focus of attention within database account security is aimed at administration accounts. Within SQL this will be the SA account and within Oracle it may be the SYSDBA or ORACLE account. It is very mon for SQL SA accounts to have a password of ?SA? or even worse a blank password, which is just as mon. This password laziness breaks the most basic security principals, and should be stamped down on. Users would not be allowed to have a blank password on their own domain account, so why should valuable system resources such as databases be allowed to be left unprotected. For instance, a blank ?SA? password will enable any user with client software (. Microsoft query analyser or enterprise manager to ?manage? the SQL server and databases). With databases being used as the back end to Web applications, the lack of password control can result in a total promise of sensitive information. With system level access to the database it is possible not only to execute queries into the database, create/modify/delete tables etc, but also to execute what are known as Stored Procedures.
醫(yī)療健康相關(guān)推薦
鄂ICP備17016276號(hào)-1