One of the main issues with connecting databases to the Internet is that if a hacker finds a way to get access to the database with credentials, perhaps using a well known account (*cough* sa *cough*) and a weak password, they can get a lots of data. However, even if your database is not on a DMZ or addressable from the Internet, chances are some application that accesses your database is connected to the Internet. Websites are a perfect example of this.

That means our data security is controlled by the security of the web application, and the security coding practices of our developers. That's a scary in many cases, primarily because we, as an industry, don't do a good job of actually sharing secure coding practices and habits widely. As much as people talk about and publish information about writing secure code, this doesn't get spread around to many developers, who have years and years of bad habits. Even here at SQLServerCentral, we don't have nearly enough information on SQL Injection, which is something I need to work on.

However, even if you aren't exposing your database server and aren't vulnerable to SQL Injection, is your data secure? I read a rather sad article from Troy Hunt that looks at how personal data can be leaked. Far too many applications don't follow secure information handling practices and unintentionally allow information to leak. Perhaps the most common item is verifying whether an account or email address actually exists or not in a login or password reset box. There are other examples, including not properly securing an entire page with SSL, allowing a simple thing like an order number to return user details, or even allowing someone to reset a password by guessing the answer to a security question.

These seemingly benign issues often expose real vulnerabilities. I'm sure many managers and even developers would say that a hacker wouldn't sit at a web page and try lots of email addresses. That's probably true. However, does your web application have limits for how often someone can submit code? Extremely powerful scripting tools like Perl, Python, and PowerShell mean that a user could make submissions to your website in an automated fashion, retrieving the code and parsing it to find details.

Most attacks on a system aren't of the Hollywood movie variety. A hacker doesn't find some hole and miraculously gain access to data in a few minutes or hours. Instead, a malicious user (outside or inside your organization), might make a series of attacks across days or weeks. They might try millions of emails or order numbers, gathering details and planning their future attacks that will actually reveal sensitive information. All those tools that make your job easier as a developer, or allow complex data analysis, can work just as well against your database as they do with your data.