![]() ![]() The Microsoft operating system does a good job keeping MS Office documents, and MS Access database files in the My Documents directory. When deploying any new application or reviewing existing ones, I'd like to propose a process for investigating the data storage capabilities of the application. Unlike widely adopted RDBMS solutions which provide built-in auditing, event notification, encryption and granular access controls, applications that utilize flat files may rely on the application developer(s) to provide these services. However, flat files are only as secure as the permissions, operating system, and application services that protect the files. And if you consider that any file contained on a host could be sensitive with regards to the information contained within, flat file databases are more secure because of local permissions and the operating system itself. To some this may seem reasonable, as standard database solutions may have more visibility as an attack vector. It's a valid argument to suggest that database application servers are not as secure as flat files. Very little information is present on best practices for securing flat file based databases and how to mitigate the risks of data contained within them. Just a few weeks ago Dark Reading featured an interesting article highlighting the risks and sensitivity of data in flat file database formats.Ī lot of focus has been placed on database scanning, however users tend to ignore flat file databases used for applications and local data files that are produced as subsets.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |