MS Access protection

[Ably+]

I have MS Access DB protected with password and C# application. This app
deals with DB.

In order to protect my data I am looking for better protection of Access DB
(everybody can open it).



What are you think?

Do you have some ideas about it?



Thanks

 

[Rick Brandt]

I have MS Access DB protected with password and C# application. This
app deals with DB.

In order to protect my data I am looking for better protection of
Access DB (everybody can open it).



What are you think?

Do you have some ideas about it?

Access User Level Security is more robust than the db password, but is still
hackable. What I always say about this...

If you need to protect the data from non-users then put it in an NT secured
folder share. If you need to protect the data from users, then it should not be
stored in an mdb file.

 

[Chris Mills]

User-Level Security is the best available in-built method for MS-Access data
protection.

A range of additional methods are needed too, whatever you can think of
really.

Physical security. That means limited access or Windows-security on the
computer system. (Some firms do not allow internet access, or limited internet
access, for instance. They lock-out the use of Windows Explorer, even)

Obfuscation. As no-one needs to use this mdb directly, rename it other than
mdb and give it a strange name. It could even perhaps have the hidden
attribute set.

Encryption. You could "encrypt" the data if you're really worried.
Encryption/Decryption takes time, and may prevent indexes working, but does
not have to be on all fields. I am not talking about the in-built Access
"encrypted" database.

I forgot what else ;-)

Chris

 

[Ably+]

How I can use obfuscation or encryption in runtime. I preffer c# and .NET?

Is there some example?
Thanks

 

[Chris Mills]

I don't understand the question ;-)

The principles are independent of what programming language you use. Runtime?
I thought you were just using an mdb for the back-end.

You can rename and/or move the file can't you? Trouble is, a data file may be
quite large, which becomes harder to hide. The point is, it's a "back-end"
file, nothing but your program needs to know what or where it is.

For an absolutely pathetic example of encryption, add 1 to the ascii code. For
a better example, use Russian. (apologies to any ruskies listening).

Really, my point was you need to think of additional measures besides relying
solely on MS-Access security. I read here, that you aren't even using
MS-Access but Jet, though someone could use Access to open it.

Requirements vary greatly because the environment, application, and perceived
risk varies greatly. If your environment is just office workers (a CEO is just
an office worker!), I wouldn't be surprised if database passwords and word
passwords work.

Chris

 

[Chris Mills]

I forgot what else ;-)Um, In reviewing this post...

Do you stick your old CD's out in the rubbish? I run them through my bandsaw
first. What is the point of security if you don't do that?

Apart from anything else, it's VERY therapeutic whenever I think of Microsoft
Access security!