Solved

Thick client application security (C# <-> SQL Server 2008 Express) .NET 4. Looking for good advice here

Posted on 2010-09-07
8
1,063 Views
Last Modified: 2012-06-21
"Standard" thick client application.
Existing application, this means that major refactoring will take a lot of time. Application is moving from inhouse solution to product. Making it a 3-tier application is not an option at the moment.
I am not intending to overdo the security bit but I do not want to make really basic mistakes. This software will be located at customer locations and I need a good security architecture that we can stand behind.

SQL statements are currently written in the client code. All statements follows "Prepared Statement" format (named parameters), no string concatenations are made. That should prevent SQL injection.

Encrypted connection between client and database
Passwords will be hashed in the client and validated at the database
Sensitive information in SQL Server tables will be encrypted using SQL Server's encryption features
Client will check that the user belongs to a certain Active Directory user group
C# assemblies will be obsfucated, encrypted using some software intended for this use. I was looking at Remotesoft's Salamander but that is not an option anymore. Perhaps {smartassembly}

Here you can get some info on security issued concerning thick clients.
Client/Server Security Assessment and Awareness
Thick Client Application Security

Application has it's own login for the users and uses only one account with the database. Any ideas on this? How do I store database login at the client location? In the resource file?
Other considerations?
0
Comment
Question by:jerra
  • 5
  • 3
8 Comments
 
LVL 20

Accepted Solution

by:
Marten Rune earned 500 total points
Comment Utility
You don't

If you want security, deploy your thick application using AD, grant this AD group the necessary rights to the database. If you want to do this correctly, rewrite all sql statements in the thick application to use stored procs instead, with parameters ofcourse. Now grant execute to this AD group on the stored procedures.

You now hava a security solution that relies on kerberos authentication, should a user want to do anything unauthorized, he can't since all he can do is execute the stored procedures designed by you, the underlying tables are of limits for the users in this AD group.

Regards Marten
0
 

Author Comment

by:jerra
Comment Utility
Thanks!
Ok, with your recommended changes made do you see other obvious security problems?

Just one thought that came to mind. What if the customer doesn't use AD? Just a single computer or two. (argh so much to consider)

0
 

Author Comment

by:jerra
Comment Utility
Nevermind, we'll think of some way to bundle SQL Server with our software in these cases where the customer doesn't use AD.
0
 

Author Comment

by:jerra
Comment Utility
I am assuming you mean that this type of architecture then uses SSPI connection type?
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 20

Expert Comment

by:Marten Rune
Comment Utility
Quote: 'I am assuming you mean that this type of architecture then uses SSPI connection type?'

SSPI = integrated = kerberos = Yes! Ofcourse
:-)

Good luck. If you have any more questions, fire away.
//Marten
0
 

Author Comment

by:jerra
Comment Utility
OK thanks.
When you wrote "deploy your thick application using AD" does it have to be deployed through Group Policy? Can't it be installed normally?
0
 
LVL 20

Expert Comment

by:Marten Rune
Comment Utility
yea it can, but you are missing the point. the ad group both deployes the app and grants the rights to execute the stored procs. it makes a neat package

\\Maryen
0
 

Author Comment

by:jerra
Comment Utility
Personally I am not too familiar with AD and how to deploy software using policies but I will pass the information on! Thanks a lot!
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
SQL Query Syntax Error 9 29
How to use xmlReader and idatareader  ? 4 44
fomat Json objects 6 15
COnsume rest client 6 8
Password hashing is better than message digests or encryption, and you should be using it instead of message digests or encryption.  Find out why and how in this article, which supplements the original article on PHP Client Registration, Login, Logo…
It’s a strangely common occurrence that when you send someone their login details for a system, they can’t get in. This article will help you understand why it happens, and what you can do about it.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now