List:General Discussion« Previous MessageNext Message »
From:mos Date:May 27 2003 4:49pm
Subject:How to secure a MySQL database from people with physical access
View as plain text  
I have some doubts on how to secure a MySQL database (MyISAM & InnoDb) 
against people who have physical access to the machine. Here are a few 
scenarios.

1) Let's say I want to use MySQL with my vertical market software but I 
don't want the customer to have access to my data outside of my 
application. I also don't want him to have access to my schema or be able 
to unload the data from the database. If the database is running on the 
customer's machine, he has root access and therefore can get the passwords 
and do anything he wants. My competitor could easily buy the software under 
an assumed name or get a copy from a mutual customer, and then be able to 
reverse engineer my database.

2) The database is installed at an ISP and contains valuable data. Someone 
at the ISP could make some easy money if he could unload the data or the 
schema and sell it to my competitor. Heck, my competitor could even open an 
account with the ISP to add some pressure or incentive to the night staff 
to make a few bucks on the side. If the database was on a virtual server, 
he could probably hack into the database without any help from the night 
staff. The problem is I would never know this has happened.

3) Someone breaks into my office and makes off with my database server. If 
the server is running Win2k, it is pretty easy to circumvent the 
administrator passwords in just a few minutes whether it is encrypted by 
the OS or not.

I could encrypt certain table fields, but this will make writing the front 
end a pain because all SQL statements will now need to be changed any time 
a new column is encrypted. I also don't know how encrypting index fields 
and large memo's are going to affect performance.

Is there a transparent solution that will solve these problems? TIA

Mike


Thread
How to secure a MySQL database from people with physical accessmos27 May
  • Re: How to secure a MySQL database from people with physical accessJoel Rees28 May
    • Select name, email where birthday = ??Scott Haneda28 May
      • RE: Select name, email where birthday = ??Adam Clauss28 May
      • Re: Select name, email where birthday = ??Marcel Forget28 May
RE: How to secure a MySQL database from people with physical acce ssDavid Brodbeck27 May
RE: How to secure a MySQL database from people with physical acce ssmos27 May
RE: How to secure a MySQL database from people with physical acce ssmos27 May
  • Re: How to secure a MySQL database from people with physical acce ssMichael T. Babcock28 May
Re: Select name, email where birthday = ??Inandjo Taurel28 May