How do I grant access to web servers secure database?

[Liliana]

We are conducting a work, a very old FoxPro system into the company I work for MS SQL / VB system. We are already widely used within the SQL database. It is currently located in our LAN behind a firewall, can only support internal use. But we part of the conversion process has brought a number of online Web applications. Now we are faced with a dilemma, we need to allow Web users and LAN users can simultaneously access the same database to find a good solution. At present, our IIS 6.0 Web server in the DMZ. How to make web server for network applications, database access it?

[Techguru01]

This is a very interesting question, at first glance seems very simple, but when you then consider it in depth, you'll find that it's complication. At any time, when you want to make the database with Internet access capacity, there are many issues to consider. I need to determine how much data can bear the risk. If you cannot take any risks, I would have put a lot of resources and energy to ensure my data as much as possible from being harmed.

[johnson22]

However, if you can take some risks, I would caution, but it will not resort to extreme measures. For example, if the data is a patient's medical history information, I will spare no effort to protect data security, which means not through IIS connection, do not use SQL Server. In my detailed description of the past, I have to declare that I am not biased against Microsoft. I just want to avoid risk. Microsoft's products can be well protected, and in the case of the above-mentioned works well.

[Jackson2]

Moreover, according to data can take the degree of risk, I will decide whether to require between the web server and database encryption, and data in the database where the need for encryption. If we want to achieve maximum security, I would choose to use the built-in or third-party encryption software. If the data for security requirements is not so high, I would choose not to encrypt, or select a number of low-level encryption methods.

[Techno01]

If you ask me then for this purpose I need to decide what kind of connection to access the database. If the encryption is necessary, or / and access is through the client-server software to carry out (as in the question where, as described), then I need to use VPN, and an application-layer proxy. Also, I might have considered on my Web servers and databases, set up an application server.

[Trio]

There is a range of issues need to be considered in order to ensure that your SQL Server database security. These issues can be found online, which include for example to protect your Windows servers, protecting IIS, to protect SQL Server, dealing with Web Server with the SQL server communication problems, which includes the authentication, protocols, etc., issues. Fortunately, Microsoft MBSA (Microsoft Baseline Security Analyzer) provides some help. Finally, your developers and database administrators need to make a series of standards and procedures for integration into the application code and database in order to minimize the security risks.