Microsoft has taken a bit of a leap with the integration of .net into SQL Server, and a lot of developers(Myself included) are worrying about what security implications this could have. DevX.com have taken an in-depth look into the guts of it, and spilled them onto a page for us all to look at.
CAS provides a code-based rather than user-based authorization scheme to prevent various kinds of luring and other code attacks. But how does that security scheme coexist with SQL Server 2005′s own, newly enhanced security features? By default your .NET code is reasonably secure, but it’s all too easy for the two security schemes to butt heads and cause you grief. In this article I’ll look briefly at the concept behind CAS and a few new security features in SQL Server 2005, then explore how to make the two systems work for you instead of against you as you take advantage of these advanced programming features in SQL Server.
They seem suitably impressed, but sensibly wary at the same time.
The good news is that Microsoft did a great job bringing together the security systems of SQL Server and the Common Language Runtime, with tools to control code. But there are some interesting features’ both to watch for and to take advantage of!
Recent in Database Hacking:
- 1 Million Accounts Leaked From Banks, Government Agencies & Consultancy Firms
- The Mole v0.3 Released For Download – Automatic SQL Injection Exploitation Tool
- MySQL 1 Liner Hack Gives Root Access Without Password
- Microsoft Warns of Serious MS-SQL 2000 & 2005 Vulnerability
- Microsoft SQL Server Fingerprint Tool – BETA4
- Exploit Next Generation SQL Fingerprint (ESF) – MS-SQL Server Fingerprinting Tool
Most Read in Database Hacking:
- Pangolin – Automatic SQL Injection Tool - 66,937 views
- bsqlbf 1.1 – Blind SQL Injection Tool - 53,556 views
- Absinthe Blind SQL Injection Tool/Software - 38,672 views