when developing windows applications:
How I secure the user name and password in the connection string?
Organizations like banks, would they give out the user name and password of their DB to application developers? if not typically how those applications developers write the DB Connections?
What is the industry standard to secure user and password in the connection string?
thanks
- How I secure the user name and password in the connection string?
Either use Windows authentication to eliminate the need for a password in the connection string, or use a combination of one or more of:
Encryption, e.g. using Protected Configuration.
Restrict access to the configuration file, e.g. using an ACL.
Note that the above techniques work well for server applications (e.g. ASP.NET), where access to the server can be restricted to authorized administrators. It doesn't work well for client-side applications that directly access a database.
Note also that encryption on its own is not sufficient: it simply replaces the problem of controlling access to a plaintext configuration file by the problem of controlling access to encryption keys. When using Protected Configuration, you need to decide how to restrict access to the encryption keys used to encrypt your configuration file.
2. Organizations like banks, would they give out the user name and password of their DB to application developers? if not typically how those applications developers write the DB Connections?
In general developers will only be given credentials to access databases in a development / test environment. Access to production databases will be restricted.
3. What is the industry standard to secure user and password in the connection string?
There is no "industry standard", but see answer to question 1.
You can encrypt sections in the app.config in the same way as web.config. MS calls it Protected Configuration. Like this
<connectionStrings configProtectionProvider="DataProtectionConfigurationProvider">
<EncryptedData>
<CipherData>
<CipherValue>AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAH2... </CipherValue>
</CipherData>
</EncryptedData>
</connectionStrings>
From MSDN:
ASP.NET 2.0 introduced a new feature, called protected configuration, that enables you to encrypt sensitive information in a configuration file. Although primarily designed for ASP.NET, protected configuration can also be used to encrypt configuration file sections in Windows applications. For a detailed description of the protected configuration capabilities, see Encrypting Configuration Information Using Protected Configuration.
The following configuration file fragment shows the connectionStrings section after it has been encrypted. The configProtectionProvider specifies the protected configuration provider used to encrypt and decrypt the connection strings. The EncryptedData section contains the cipher text.
<connectionStrings configProtectionProvider="DataProtectionConfigurationProvider">
<EncryptedData>
<CipherData>
<CipherValue>AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAH2... </CipherValue>
</CipherData>
</EncryptedData>
</connectionStrings>
When the encrypted connection string is retrieved at run time, the .NET Framework uses the specified provider to decrypt the CipherValue and make it available to your application. You do not need to write any additional code to manage the decryption process. Read the following article on MSDN please for more information:
You should use parameters.
example SqlCommand command = new SqlCommand("select * from Login where Username= @name", conn); command.Parameters.Add(new SqlParameter("@name", uname.txt)); .
