Re: Modifying SQL query for security?? What is your opinion?

Sandor Laza <slaza_at_worldonline.nl> wrote:

>I company prepared a security study for us in which they
>advised not to use trusted RDBMS systems (like trusted Oracle
>or Trusted Ingres), but develop an application which capture all the
>SQL querys sent to the server modify them according several security
>rules (for example extend the where clouse somehow) and pass the
>modified query to the RDBMS engine.

>Have you ever seen or heard about this kind of solution implemented?
>What do you think, it is feasible?
 

>My personal opinion is, that it can be implemented, but the
>implementation means at least the reimplementation of the SQL
>interpreter of the given RDBMS. Or not?

I see some problems:

1. Your application structure will be corrupted by having to send every query through a "security process". The standard call-libraries will have to be changed, you won't be able to use the normal 4GL's, etc.
2. Whenever anything goes wrong, your vendor will say: "You're doing _what_????"
3. The consultant is suggesting that a "home-grown" solution will be better than one offered, _and supported_, by the DBMS vendor. This is not likely to be true.

You'd have to re-implement the SQL _parser_, not the whole interpreter -- that is, you wouldn't have to _execute_ any of the queries, just understand and modify them.

Is your application worth this much worry about security? Did the consultant find specific problems with the Ingres or Oracle security systems? Does his proposal _really_ avoid those problems?   Received on Tue Nov 19 1996 - 00:00:00 CET