Collaborate Disseminate
DataSecOps melds an automated mechanism to manage data, along with security, in an effective operations setup Data is the backbone of any organization. It’s what makes the company run. It is also where all the company secrets are kept. But when data a… Continue reading DataSecOps: Protecting Data in the Cloud
Problem
How do I ensure that I cannot access confidential data manually through the database? Practically speaking, this is a firestore database on google cloud, and I have access to the administrator google account. For the purposes of th… Continue reading Keeping data confidential from the system administrator
When data breaches occur, is a database always involved?
In the case of databases being involved, do hackers figure out how the data is stored and read this or do they just figure out how to make queries to the database via the DBMS?
Is ac… Continue reading What’s more vulnerable; the data or the DBMS?
As a developer, when an Incident comes in and reaches Tier 3 support (The development team), how can the developers get access to query the Production Database, while remaining PCI Compliant? I’m admittedly a newbie when it comes to PCI Co… Continue reading PCI Compliance for developers accessing a production database for support
I have a table for single use tokens, and one of the columns is a token_digest which contains a bcrypt hash of the access token. Since the token_digest is a salted and hashed version of the plaintext token, I can’t just run a select agains… Continue reading What can you do to make a hashed token database retrievable at a later date?
I see that many relational database systems offer asymmetric (private/public key) cryptography functions. For example, PostgreSQL offers the pgcrypto module, which supports OpenPGP (RFC 4880) encryption. Given that access to an RDBMS and a… Continue reading What are useful use cases for employing asymmetric cryptography in a database?
I am currently doing a pentesting on a web application and focusing more on SQL Injection. This company I am pentesting have a functionality in which we are allowed to buy things from the vendors/suppliers registered there. When a product … Continue reading SQL Injection Doesn’t Sanitize But Doesn’t Execute Commands
I am creating a desktop application using the Python language. I would like to create a login function. However, I am worried about the security of the database on the server. For example, let’s say I would use MongoDB. How I make the data… Continue reading Security of database and encryption of data [closed]
A small company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what products bought) and some small notes. The data is stored at the computer in the office of the compan… Continue reading Is it safe to store data of small company in MySQL database on webhost?
I was adding logging to my application. And I realized that there are times when I need to debug my sql statements and logging them (at debug logging level of course) would make debugging very easy. I am kind of confused because some times… Continue reading Is it okay to log sql queries for debugging