> well them let me ask you this. if i locked down my database > to the point where they can only access the stored procedures > that I want them to, then what do I care if they get ahold > of the password to the DSN. They would only be able to do > anything that I didn't allow them to anyways. > > I'm NOT trying to start a fight here. I just don't understand > why I would care about someone "hacking" or stealing passwords > to a DSN that is totally locked down. Plus I don't get what > you mean when you said "even being able to call those stored > procedures is a serious security issue, as I'm sure you're > aware." If I let them have access to something and they run it, > then it isn't a security risk. Now if they were able to run > something that I didn't give them access to, then we have a > problem. However, since I gave them access to run the stored > procedures, I don't see a security risk.
First, I realize you're not trying to start a fight. Neither am I, of course. I think that, at root, what we've got here is a pronoun problem. You're using "I" and "they" in your above statement differently than I am. That is, you're assuming there's this one group called "they", who legitimately have equal access to the same set of stored procedures. In a shared CF hosting environment, where not only the database server but the CF server is shared, you may have several "theys" [sic] - you may have several developers, each of whom has different legitimate rights to databases on your shared database server. For example, I've got my site on there and Matt has his, and we don't like each other. That Matt bastard has been getting on my nerves with his DevX articles, while I annoy him to no end with nit-picky corrections (of course, he wouldn't acknowledge that I'm right in the first place, the bastard!) So, I'll show him - I'll grab the username and password for his database connection, and I'll add some, uh, embarrassing links to his table listing articles he's written. Maybe, I'll query his table that lists business leads he's received through the web site, and send them all slanderous notes. Now, despite the fact that you, the database administrator, have created a set of stored procedures to allow each of us to access only the things we should, I'll be able to use his stored procedures to do so, once I've figured out his username and password (something that is beyond the control of the database administrator, by the way). For his site to do anything useful in the first place, you'll have to have written the stored procedures that allow his legitimate access. Of course, this is just an example - I'm sure I annoy Matt more than he annoys me, and he'd never share a server with me. The final thing to note here is that, while proper security in your database server is very important, it's also very important to secure other layers of your application and its environment. In the case of a shared CF server, this is very, very difficult to do. I hesitate to say it's impossible - there are some very smart people - but I'm not smart enough to do it to a degree that I'd consider reliable. Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ voice: (202) 797-5496 fax: (202) 797-5444 ______________________________________________________________________ Your ad could be here. Monies from ads go to support these lists and provide more resources for the community. http://www.fusionauthority.com/ads.cfm FAQ: http://www.thenetprofits.co.uk/coldfusion/faq Archives: http://www.mail-archive.com/[email protected]/ Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists
