Spllited Database risk over LAN Network challenge ,please how to Secure? (1 Viewer)

kokowawa

Member
Local time
Today, 10:38
Joined
May 11, 2020
Messages
51
@isladogs

dear @isladogs , i have red your article http://www.mendipdatasystems.co.uk/improve-security-2/4594571073 very carefully and it helped me very much improving security of my app .

in this thread and in my case i would like to focus on point number( 8. Split your database ) , i have done my app with the same idea long time , i have made a Frontend app for the users and Backend database and placed it in a separate PC on the network and shared the folder (read/ Write) then linked tables to this backend database .

now the issue here is that this shared database folder is at risk by all means because of the below:
- Anyone can access the shared folder network easily by the people who have Curiosity and like to surf the LAN looking for shared folders and see what is in it.
- The shared folder is read and write , so any one can copy or delete the database itself
- Modifying the tables in shared database (in my case i leave the backend database unlocked as accdb or mdb coz i keep updating tables with new fields or adding new tables based on the business requirements) , which risk the database to be stolen or modified by unauthorized persons .

the big questions is:
-how to secure the network folder that contain my backend database?
- is there is a way to hide the shared network folder from being seen by unauthorized employees and keeping it accessible to the linked front end ?
-can we protect the shared folder by password and programing the frontend by vba to enter the password LAN automatically when we run the frontend without giving the password to the user to acces t he shared folder?
- is there is any other ideas to secure the database over LAN other than hiding it? i was thinking about SQL server but it is something i need to study well before i go on with it.

maybe the solution is easier than i think but my mind cant reach it , hope the community here help

thank you
 
Last edited:

Isaac

Lifelong Learner
Local time
Today, 01:38
Joined
Mar 14, 2017
Messages
8,738
The server (file server) admins can probably come up with a way to Hide the folder$ from navigation. This way nobody even knows what or where the folder is--and they won't accidentally stumble across it. Going this route would be applying the Access mantra, Security by Obscurity. Just one option.
 

Sun_Force

Active member
Local time
Today, 17:38
Joined
Aug 29, 2020
Messages
396
Hide the folder$ from navigation.
Even if he hide the shared folders, it's very easy to see a list of all shared folders. One way is using cmd

net view \\test-server /all


If he is concerned about BE's security, I think sql server is the solution.
 

Isaac

Lifelong Learner
Local time
Today, 01:38
Joined
Mar 14, 2017
Messages
8,738
If he has users that are so determined to find the back end folder that they are using cmd prompt and net view, that's probably not the category of user that Access "security" is really targeted for anyway. I think isladogs has some recommendations on actually password protecting the database too that might help but have not studied them at length (yet).

Out of curiosity, what features on SQL Server setup do you believe would make it more secure?
 

kokowawa

Member
Local time
Today, 10:38
Joined
May 11, 2020
Messages
51
Even if he hide the shared folders, it's very easy to see a list of all shared folders. One way is using cmd

net view \\test-server /all


If he is concerned about BE's security, I think sql server is the solution.
as you mentioned , it is easy to access the folder by typing the path unless it is password protected and hidden and only FE can access this shared folder by using the password by VBA in the same time .
in this case the user will not know to which folder the FE is connected to and even he knows it will be protected by password .

the doubt here when msaccess vba can access the password protected shared folder this means the there is a open granted access session to this folder so by this way the user can use the server folder bath and open it easly as he already have permission that the access gave to his PC.
 
Last edited:

CJ_London

Super Moderator
Staff member
Local time
Today, 08:38
Joined
Feb 19, 2013
Messages
16,553
something that can protect the folder from casual browsers is to put it in a subfolder to a folder to which only admin have access. They can then make the subfolder available to everyone or a specific group of users - but the only way a user can get to it is is by knowing the full path - which you as developer would have hidden deep within your front end and obfuscated in some way.
 

kokowawa

Member
Local time
Today, 10:38
Joined
May 11, 2020
Messages
51
If he has users that are so determined to find the back end folder that they are using cmd prompt and net view, that's probably not the category of user that Access "security" is really targeted for anyway. I think isladogs has some recommendations on actually password protecting the database too that might help but have not studied them at length (yet).

Out of curiosity, what features on SQL Server setup do you believe would make it more secure?

regarding the SQL server setup , i am still studying the benefits from using it , but as far as i know , the sql is not accessible by users , it could have password protected database , it make the connection more faster for multiple users use in the same time
 

Isaac

Lifelong Learner
Local time
Today, 01:38
Joined
Mar 14, 2017
Messages
8,738
the doubt her if msaccess vba can access the password protected shared folder
I'm not necessarily suggesting you do this, but just wanted to answer this directly.

Yes, it would be possible to use VBA to map a drive letter on the fly (using service account credentials) to access a network share to which none of the common users have access. And then disconnect from the mapping at some point thereafter.
 

kokowawa

Member
Local time
Today, 10:38
Joined
May 11, 2020
Messages
51
something that can protect the folder from casual browsers is to put it in a subfolder to a folder to which only admin have access. They can then make the subfolder available to everyone or a specific group of users - but the only way a user can get to it is is by knowing the full path - which you as developer would have hidden deep within your front end and obfuscated in some way.

i have just red a thread talking about subfolder in this post https://www.access-programmers.co.u...with-traverse-permissions.312264/post-1702051 .

i am trying to understand it as i am not really good with networking and permissions .

in regard of hiding the bath , this is easy part to do as i can lock and protect the database in several methods as per the article of @isladogs i have mentioned in the first post.
 

kokowawa

Member
Local time
Today, 10:38
Joined
May 11, 2020
Messages
51
I'm not necessarily suggesting you do this, but just wanted to answer this directly.

Yes, it would be possible to use VBA to map a drive letter on the fly (using service account credentials) to access a network share to which none of the common users have access. And then disconnect from the mapping at some point thereafter.

the doubt is not about that VBA can do access the shared folder or not , what i mean is whenver the VBA can do so this means that there is risk of ability of accessing the hidden shared folder through the granted access done earlier by the VBA .

if you can help post a link to method of VBA to access a hidden password protected shared folder .
 

Isaac

Lifelong Learner
Local time
Today, 01:38
Joined
Mar 14, 2017
Messages
8,738
the doubt is not about that VBA can do access the shared folder or not
Hmm. In that case I misunderstood when you stated that that was your question. "the doubt her if msaccess vba can access the password protected shared folder".

what i mean is whenver the VBA can do so this means that there is risk of ability of accessing the hidden shared folder through the granted access done earlier by the VBA
Yes, that would be a risk. In between the time that the code mapped the drive letter to the protected folder, and the time that it disconnected it, users might discover such a thing in My Computer, or This PC, and do something with it. If, that time is any meaningful length.
 

CJ_London

Super Moderator
Staff member
Local time
Today, 08:38
Joined
Feb 19, 2013
Messages
16,553
it make the connection more faster for multiple users use in the same time
Not necessarily true - depends on a) how well the tables/relationships/indexing have been designed (which applies to any database) b) what else sql server is being used for and c) where the server is based v the access backend location. Other applications may have higher priority applications in sql server. One client moved back to access because performance was about 50% slower on sql server.

slightly off topic but you might find this link helpful https://www.access-programmers.co.uk/forums/threads/addressing-performance-issues.291269/
 

kokowawa

Member
Local time
Today, 10:38
Joined
May 11, 2020
Messages
51
Hmm. In that case I misunderstood when you stated that that was your question. "the doubt her if msaccess vba can access the password protected shared folder".
yes you are correct , i mistyped the sentence , i have replaced IF by WHEN ,

Yes, that would be a risk. In between the time that the code mapped the drive letter to the protected folder, and the time that it disconnected it, users might discover such a thing in My Computer, or This PC, and do something with it. If, that time is any meaningful length.

what i was thinking , NOT mapping a drive in the local PC , i was think that VBA access the protected shared folder silently without displaying any msgs or popup windows or so , just create a connection , input the user name and password and establish the connection without even the user notice all this happen.
 

kokowawa

Member
Local time
Today, 10:38
Joined
May 11, 2020
Messages
51
Not necessarily true - depends on a) how well the tables/relationships/indexing have been designed (which applies to any database) b) what else sql server is being used for and c) where the server is based v the access backend location. Other applications may have higher priority applications in sql server. One client moved back to access because performance was about 50% slower on sql server.

slightly off topic but you might find this link helpful https://www.access-programmers.co.uk/forums/threads/addressing-performance-issues.291269/

thank you , that post helped me understand more about MsAccess and SQL , it will help me more when i try the sql .
 

Isaac

Lifelong Learner
Local time
Today, 01:38
Joined
Mar 14, 2017
Messages
8,738
what i was thinking , NOT mapping a drive in the local PC , i was think that VBA access the protected shared folder silently without displaying any msgs or popup windows or so , just create a connection , input the user name and password and establish the connection without even the user notice all this happen.
You might be able to do this depending on what it is exactly that you wish to do in, or get from, this special folder.
 

isladogs

MVP / VIP
Local time
Today, 08:38
Joined
Jan 14, 2017
Messages
18,186
I've only just seen this thread. Having done a quick skim, I suggest following the advice of @CJ_London e.g. that in post #6.

However, there is absolutely no reason why users need to know the location of the BE folder or indeed the BE password.
If you follow the instructions in my article, the connection strings will be completely hidden to end users.
Whilst a highly skilled and determined hacker with sufficient time on their hands will know ways to get around that, is your data really likely to be so important that it would be worth anyone doing so.

Also did you look at the linked article which was mentioned in point 11 of the article linked in post #1?
I'm intending to further update that page & example app sometime in the near future

EDIT:
Also have a look at the first item in the similar threads below:
 

theDBguy

I’m here to help
Staff member
Local time
Today, 01:38
Joined
Oct 29, 2018
Messages
21,357
@kokowawa I'm just curious, who are the people you are trying to protect the BE file from and what do you think they will do to it? Thanks!
 

The_Doc_Man

Immoderate Moderator
Staff member
Local time
Today, 03:38
Joined
Feb 28, 2001
Messages
26,996
My contribution is not a perfect solution but merely another layer of protection.

If you have a decent domain setup, there is such a thing as having a GROUP IDENTIFIER that can then be granted to various users. Your domain admin can make one of these for you. I should note that this method was approved by the U.S. Navy as a way to contribute to the protection of files requiring a certain level of isolation.

In Windows security, there is a thing called an Access Control List that is named according to its function: It is a list of controls (rules) to allow access to something. Windows allows you to put such lists on files. The entries of the list (called an ACL) appear in a given order, which is significant, in that "first match wins." So... the LAST entry in the ACL for the folder containing the files you want to really protect should have an explicit DENY ALL permission assigned to ALL USERS. But the 2nd-to-last ACL entry should be one for a GROUP identifier that will be granted only to those users intended to be users to your DB. The first ACL entry usually grants full access to SYSTEM and you shouldn't play with that. There are also ACLs commonly used to grant operational rights for the purposes of making a backup copy or other file-level maintenance things. Again, don't mess with the backup operator's rights. Or the administrator's rights.

Make a list of people who SHOULD have access to this DB. Make them members of the group implied by the group identifier mentioned earlier. Making someone a member of the group in effect grants them the identifier. It is like adding a specialized key to a key ring. Once you do this, the significant entries are last and 2nd last.

The steps whereby the file system grants a user process access to a file includes "access arbitration." In this case, the test will be like a bunch of IF THEN ELSEIF statements: Are you SYSTEM? If so, grant access rights according to the SYSTEM ACL. After some other tests, ... Are you a member of DB Users Group? If so, grant access rights according to the DB Users Group ACL. Are you a member of the "All Users" group? (Yes, everyone is...) If so, grant access rights according to the All Users ACL. Which happens to be DENY ALL. With a DENY ALL in place, nobody except the group members and system staff will touch those files.

To double the protection, do the same for the files in the folder containing the DB. (I.e. apply those ACLs to the parent directory, but allow the permissions to propagate to child folders and files.) This means that random browsers CANNOT SEE the files. They would know that the parent folder exists but would be unable to know what was in it, because nobody could read the folder.

This SHOULD NOT rule out use of other methods as shown by Colin (Isladogs), theDBguy, Isaac, and CJ_London. Many of these methods can work together. This is just one more way to tighten things up.
 

kokowawa

Member
Local time
Today, 10:38
Joined
May 11, 2020
Messages
51
However, there is absolutely no reason why users need to know the location of the BE folder or indeed the BE password.
If you follow the instructions in my article, the connection strings will be completely hidden to end users.
Whilst a highly skilled and determined hacker with sufficient time on their hands will know ways to get around that, is your data really likely to be so important that it would be worth anyone doing so.

thank you for the reply ,

the users will not know neither password nor bath from the FE , as u mentioned the skilled and determined ones will try do so, as the data is valuable.
Also did you look at the linked article which was mentioned in point 11 of the article linked in post #1?
I'm intending to further update that page & example app sometime in the near future

EDIT:
Also have a look at the first item in the similar threads below:

yes i did , i am studying it and as soon as i understand it i will give it a try to encrypt either the important fields or all fields of the tables , which i am sure it will add a very strong step protecting the data , so for the hacker or whoever after passing all layers of security he will find encrypted data in the fields. especial that the front end will be protect to run only in the authorized PC with a well locked FE taking in consideration your article mentioned in post #1

i will be waiting for the update of that page & example app . it will really help me.

i have also red the post of @The_Doc_Man and even asked him in that thread if he kindly can do a video about it as i am not really good with networking.
 
Last edited:

kokowawa

Member
Local time
Today, 10:38
Joined
May 11, 2020
Messages
51
@kokowawa I'm just curious, who are the people you are trying to protect the BE file from and what do you think they will do to it? Thanks!

it is a travel agency application that will contain data about the clients and their bookings , their full database , i am trying to protect the company that spent alot of money to have these loyal clients to them from anyone might reach this data , that can be easily sold to their competitors for money , it will be valuable for others and this can destroy companies , it is the dirty world dear .
 

Users who are viewing this thread

Top Bottom