Security concerns of web applications with database access By Oscar Rivera Fall 2008

SSL/TSL Secure layer over the internet Use Digital Certificates Trust in the companies Man in the middle attacks

3 Tier architecture Protect DBMS from outside users Code division Scalability

Logging in Brute force attacks Images Additional personal information

Database users Level of access Groups of users Security for the database Guest user

SQL Injection Search = query Intruders get access to the database Check the validity of the values on the web site Regular expressions .*\.txt$. \b[A-Z0-9._%-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b

Triggers Specification for execution of a function when the database is accessed Execution authorization Re-check the validity of values

Uses Various levels of logs Logs on Databases Find responsible people after an attack Recover from disaster Various levels of logs

Cookies Text files Store preferences and user’s information Plain text Broadcast every request

Sending data from web forms GET/POST http://server/page.php?name=Al&hidden=2 http://server/page.php When use POST? When use GET?

Sessions Table per user Dynamic size Time of duration

Status Bar When in frames When with JavaScript When GET-type links Using Document Object Model