數(shù)據(jù)庫安全外文翻譯-數(shù)據(jù)庫-資料下載頁
2025-01-19 11:55本頁面
【導(dǎo)讀】事實上，在防護一個組織的信息方面，數(shù)據(jù)庫的安全是至高無上的，因為。它可能會間接接觸比我們意識到的更廣泛的用戶。這是兩篇研究數(shù)據(jù)庫安全文章中的第一篇。據(jù)庫安全概念和和比較普遍的問題。在下篇文章，我們將把焦點放在特定的。MicrosoftSQL和Oracle的安全關(guān)注上。近來數(shù)據(jù)庫安全已成為一個熱門話題。不再有許多不安全的網(wǎng)絡(luò)存在）。因此，重點是加大對技術(shù)的考慮力度，譬如以。更細膩的審查態(tài)度對待數(shù)據(jù)庫。是審慎而且必要的。雖然這可能節(jié)省的購買一個單獨的服務(wù)器費用，在互聯(lián)網(wǎng)上提供的，與Oracle數(shù)據(jù)庫在互聯(lián)網(wǎng)上提供有關(guān)端口1521。認設(shè)置的使用以及粗糙的安全措施，使服務(wù)器更加脆弱。墻保護問題，但最終它確是數(shù)據(jù)庫，這是毫不妥協(xié)的。絡(luò)的各部分來看而被迫作出的。安全審查過程進展順利，訪問控制基于Windows認證。要求進行處理，拒絕直接進入資料庫的所有嘗試。貫穿安全業(yè)的一個普遍問題是應(yīng)用軟件安全，特別是定制的Web應(yīng)用程序。洞的更大的潛在威脅。
【正文】 . Where this cannot be performed, consideration should be made to try and substitute characters (for example the use of single quotes, which are monly used in SQL mands). Specific securityrelated coding techniques should be added to coding standard in use within your anization. If all developers are using the same baseline standards, with specific security measures, this will reduce the risk of SQL injection promises. Another simple method that can be employed is to remove all procedures within the database that are not required. This restricts the extent that unwanted or superfluous aspects of the database could be maliciously used. This is analogous to removing unwanted services on an operating system, which is mon security practice. ◆ Overall In conclusion, most of the points I have made above are mon sense security concepts, and are not specific to databases. However all of these points DO apply to databases and if these basic security measures are employed, the security of your database will be greatly improved. The next article on database security will focus on specific SQL and Oracle security problems, with detailed examples and advice for DBAs and developers. There are a lot of similarities between database security and general IT security, with generic simple security steps and measures that can be (and should be) easily implemented to dramatically improve security. While these may seem like mon sense, it is surprising how many times we have seen that mon security measures are not implemented and so cause a security exposure. 共 9 頁 第 8 頁 ◆ User account and password security One of the basic first principals in IT security is “make sure you have a good password”. Within this statement I have assumed that a password is set in the first place, though this is often not the case. I touched on mon sense security in my last article, but I think it is important to highlight this again. As with operating systems, the focus of attention within database account security is aimed at administration accounts. Within SQL this will be the SA account and within Oracle it may be the SYSDBA or ORACLE account. It is very mon for SQL SA accounts to have a password of ?SA? or even worse a blank password, which is just as mon. This password laziness breaks the most basic security principals, and should be stamped down on. Users would not be allowed to have a blank password on their own domain account, so why should valuable system resources such as databases be allowed to be left unprotected. For instance, a blank ?SA? password will enable any user with client software (. Microsoft query analyser or enterprise manager to ?manage? the SQL server and databases). With databases being used as the back end to Web applications, the lack of password control can result in a total promise of sensitive information. With system level access to the database it is possible not only to execute queries into the database, create/modify/delete tables etc, but also to execute what are known as Stored Procedures.
醫(yī)療健康相關(guān)推薦
鄂ICP備17016276號-1