Re: Increase Security

In article <46jsgo$rcm@cssun.mathcs.emory.edu> johnl@informix.com (Jonathan Leffler) writes: >From: johnl@informix.com (Jonathan Leffler) >Subject: Re: Increase Security >Date: 24 Oct 1995 19:23:04 -0400 ........ >The fundamental problem with any security system in SQL-based systems is >that if UserA needs UPDATE privilege on TableB when using ProgramC, it is >nearly impossible to prevent that user from updating TableB via DB-Access >or ISQL as well. DBA-privileged stored procedures almost work -- but what >happens if the user crashes the program which arranged for the privileges >to be granted? Answer -- the privileges stay granted. The only possible >exception might be if the database has transactions and the privileges are >granted within an uncomitted transaction, but then do the privileges take >effect for some other process; I doubt it. I don't have a solution for >this problem. This raises an issue which has concerned me for some time. We concern ourselves with authorising users (passwords, etc) and, perhaps client devices. I have never seen any debate about authorising programs and yet with the rise of client/server technology this ought to be a major issue. Given a user running a PC client on anything other than a diskless workstation there seems to be nothing to prevent a user loading Visual Basic or whatever and having a go for him-or-herself. This may not be done with malice aforethought but simply because the user has got fed up with the backlog in the IS department. The obvious response to a question like this is to put more stored procedures into the database to check this. If I remember correctly, however, there is a limit to the number of stored procedures there will be a performance penalty; also if the IS department spend all its time doing this the backlog will simply grow. It seems to me that we need the client/server protocols to enable a client *program* to identify itself in a manner which will be proof against tampering (as far as this is possible) and will let the server check the client against an approved list. As a by-product this would also enable the server lock out incorrect versions of the clients. Whilst it's easy to define the requirement, however, it's less easy to see how it might be met. Anyone got any ideas? By the way, there seems to be something deeply weird about my news feed. I haven't received cherylk's half of this thread and I'm only getting what I do see some days later. I'll try to sort this out with my feed but in the meantime if anyone posts something which calls for a reply from me and I don't respond in a day or two, please Email me - but not with everything! Ian