Security Basics mailing list archives
RE: Storing doc pdfs within an application or database?
From: krymson () gmail com
Date: 21 Jan 2008 19:08:19 -0000
Sounds like your application group may need to try a bit harder.* It sounds like you have this front-end web page that then ties into a server share folder. Do you really need that server share open to anyone beyond the application? The web application should do the managing of permissions and just one account should pass through to the document store. Better yet, as your email title maybe suggests, get all of that data into the database and rely on the database security instead. This is better than having it fly across the wire into some rather wide-open share, and keeps the access needed by the web server process to a minimum. Even if you limit the shares, is this information sensitive enough that even the people who manage server rights should not be seeing it? I would think so. I would want this not only stored away where people can't read it, but also in a way that can't be read easily by less-knowledgable people. Even the lowest technical people can double-click and open a .pdf file if it is sitting in front of them. I'd rather (at least!) have it stored in a database which would take some additional knowledge to pull out. It's a start anyway... * Spoken like a true net/sys admin. :) If I were a developer, I might have an opposite opinion on this... <- snip -> An in house developed application related to Human resources, developed using ASP (not asp.net) using Oracle 9i as backend, serves employees payroll and tracks their development. Part of each of the employees HR homepage (viewable on the web browser) pertains to storing their employment contract, their educational certificates, passport copies of their and their family spouses etc., in either pdf or doc format. These files (pdf and doc) are stored in a shared folder on the same server hosting the application. The problem is, there is 'security by obscurity' only. If I am savvy enough to use an application proxy or even dig through my browser history, I can find the whole URL relating to that document, as an example: Visited: Administrator@http://abcint/Administration/Employment_Contract_HR2006/2313441.pdf where, 'abcint' is the Netbios name of the server and starting 'Administration' onwards is the webshare on the same server. 2313441.pdf is my employment contract number where the series of number is easily identifiable for it's my employee ID too. Now, I can change that serial and *poof*, get to see any other pdf too, relating to another employee. How do you guys take care of such authorisation/aunthentication mechanism when it comes to pdf/doc files that are not residing within a database?
Current thread:
- RE: Storing doc pdfs within an application or database? krymson (Jan 21)