Security (V2000)

Topic

New Reply

We have an access database that is password protected. I’ve heard of the MS Access password vulnerabilities but wasn’t certain how true the stories were. Our IT Department is now discouraging us forcing us to either revise or abandon a database we built because of security concerns as someone on their team was able to hack into the database. Here is their position:

-Threat
The Allstate Reporting.mdb file contains report information as well as a users table for the reporting application. To protect the information in the file, Microsoft Access Password Protection is used.

-Impact
Using a free application from the Internet it is possible to decode the MS Access password and gain access to the users table in the mdb file. Using this information an Attacker can then leverage all data in the tables.

-Solution
MS Access password protection is extremely insecure and easy to crack and should never be used to protect information that is considered confidential. Stronger encryption should be used for sensitive information.

***What options do I have?
Thanks!

Reply | Quote

Replies

My opinion:
First, if not done already, split the db into a front-end (queries, forms, reports, modules) and back-end (data tables). Then, if possible, move the back-end to an instance of sql server by importing them into a database. If that is not quite possible move it to sql server 2005 express. On either server you can access your data (via odbc’s or using ActiveX Data Objects [ADO]). This way you can use sql server’s security (as well as Windows) to answer and defeat all 3 of IT’s concerns.

A very good starting point on Access security and very highly recommended is:
WendellB’s The Secrets of security.

Reply | Quote

1) Split the database. Each use gets a copy of the frontend, the backend goes on the server. Mount it in a share on the server where the network permissions only allow the authorized people to see the file.

2) Apply full User-Level Security to the backend — the simple password that you used is insufficient. See the website in my signature for links to several articles.

1 & 2 are mandatory if you stay within the Access environment. If you find them to be insufficient (and they can be for some situations) and if you want “bulletproof” security, move the backend to an SQL server as already suggested.

Reply | Quote