Question Database Security

[marianne]

1. I am using ms access 2003. I discovered that setting up the database password can still be cracked or recovered. Is there any other way to enhance the database password security.

2. I have seen an mdb example wherein even though the database has no password and the tables are vulnerable for opening, but the user cant still open the tables because there is a message saying no permission. How does that done?

3. The above statements were asked because I made a custom login permissions in a table (add, edit, delete, view)

 

[HiTechCoach]

1: NO

2: That is using the built in User Level Security. See: The Microsoft Access Security Apparatus

Hope this helps ...

 

[Banana]

Well, I've always thought that ULS was more useful as a "permissions manager" to corral honest users into intended sets of actions and preventing them from accidentally doing something that's not expected.

In a pure Access solution, I'd argue that ULS is more secure compared to a DIY custom login (and remember I use the word 'secure' in a relative sense). Furthermore, I'd be content to just use ULS and leave it up to Windows and/or network setting to keep out the non-users and people who aren't associated with the company. Employees usually have an incentive to keep their application working so usually are happy to oblige and I believe that if a company insist that the application be secured from their employees, they actually have bigger problem than they think!

In cases where data are truly sensitive, the best answer to protect them is to move them off into a RDBMS such as Oracle, MySQL, SQL Server, PostgreSQL, or such where security is more robust while keeping Access as a front-end to those servers.

I hope that helps provides some high-level visualization of what we can do with Access security...

 

[marianne]

thanks for your replies. yes though I know that ULS could be the answer.

 

[gemma-the-husky]

marianne

you should be more bothered about code than data

1. use an mde, then your code is secure

2. its not data security as such thats an issue so much, in my opinion - pretty well every system exposes data in some way or other, and there is generally a way of connecting to the back end, to see the data layout for properly authorised users. eg sage in UK is biggest software company - but you can use access to connect to sage tables, and just copy all the data into an unsecured access database - but its one thing
doing this, and quite another working out exactly how it all hangs together.

3. designing a system to allow certain users to be restricted to certain areas is by no means straightforward. Although you have access security, for a big system this can be really awkward to set up precisely.

 

[marianne]

thanks so much gemma ! I didn't know that sage database can be connected thru access. Whew !!!

I agree that code is much more needed to be secured. But just in my case, I just also need to secure my data. It let me feel secured and nothing to worry about.