Security techniques for cross database access

on YouTube ↗53m

" summary

Compares four concrete ways to allow cross-database queries and shows demos that work or fail: naive approach grants users in every target DB (works but scales terribly); ownership chaining (DB chaining) works without extra object permissions but requires identical database owners and per-database enabling; set TRUSTWORTHY off is recommended because turning it on lets module code escape the database (execute as owner becomes server‑privileged); certificate-signed stored procedures let a proc access remote objects without granting user rights, but the proc must be re‑signed after changes.

AI-written summary · about

" chapters (8)

1. 0:00Introduction
2. 1:01Security challenges
3. 2:03Scenario setup
4. 6:04Basic permission granting
5. 11:47Ownership chaining
6. 17:31Cross-database chaining
7. 31:55Trustworthy property risks
8. 48:52Signed procedures

" related talks

• 22mComplete database security in 4 simple stepsRuss Lowenthal · Oracle DatabaseWorld 2022
• 25mEnsuring Authorized Updates in Multi-user Database-Backed ApplicationsKevin Eykholt, Atul Prakash, Barzan Mozafari · 26th USENIX Security Symposium (USENIX Security '17)
• 54m10 Deadly Sins of SQL Server ConfigurationScott Sutherland · AppSec California 2015
• 21mWhat you can do to protect your SQL Server and why it mattersGethyn Ellis, David Postlethwaite · SQLBits 2019
• 21mWhat you can do to protect your SQL Server and why it mattersGethyn Ellis, David Postlethwaite · SQLBits 2022
• 40mPostgreSQL Security for Application DevelopersSehrope Sarkuni · PostgresOpen Silicon Valley 2017
• 01h 00mSecuring Multitenant Databases with Entity Framework CoreZoran Horvat · NDC London 2021
• 48mTackling the Recent Rise of Cross-Tenant VulnerabilitiesShir Tamari, Sagi Tzadik · RSA Conference 2023