Database Security

[ Thanks to JJS for this link. ]

"I don't disagree with Taufiq's assessment. However, I do disagree with his acceptance of the status quo. I wrote a rant on this blog responding to a complaint that security professionals are not taken seriously. In it, I pointed out that the security industry should promote improving the security climate, not just react to it with solutions 'for a price'. The example I gave was *DBC libraries.

"The JDBC package, java.sql, does not supply any security parsing. This is not the real workhorse, but it should at least provide a method for this. Each database supplies a jar that java.sql classes call to access the specific database. This is where security parsing must be handled."

Complete Story

Related Stories:

• Microsoft: Hole Exploit Endangers All IE Versions(Dec 13, 2008)
• Punishment vs. Prevention(Dec 05, 2008)
• How To Block Spammers/Hackers With Apache2's mod_spamhaus (Debian Etch)(Sep 14, 2008)
• Kernel Space: No Shortage of Tracing Options(Jul 30, 2008)
• Fedora Struggles with Harm Reduction via Codec Buddy(Nov 01, 2007)
• Fortify Finds Trojan Devs in Open Source(Oct 12, 2007)
• DevX: Detect Your Web Application's Vulnerabilities Early with Ruby(Jan 31, 2007)