How to prevent someone access the database without permit

Question

my application ( C#+SQL server) is running on the shared hosting. However, someone is able to access the database without permit. The connection string in the Web.config file, it had also been encrupted. Based on the above the senario, I have the following questions:

1. Is the shared hosting not secure?
2. Is the coding not really secure?

If the problem on the coding, what should I fixed? Many thanks!

------In Web.config, before encrypt------

<connectionStrings>
  <add name="MyLocalSQLServer" connectionString="Initial Catalog=aspnetdb;
Data Source =192.07.32.45; Initial Catalog =myDataBase; User Id =Username; Password =Password;" providerName="System.Data.SqlClient"/>
</connectionStrings>

------In Web.config, After encrypt------*

<connectionStrings configProtectionProvider="MyUserDataProtectionConfigurationProvider">
    <EncryptedData>
      <CipherData>
        <CipherValue>AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAWuizHyLxzk+U4/8NnMRAjQAAAAACAAAAAAADZgAAqAAAABAAAADLFqu00qT0BeGh6wmHHGySAAAAAASAAACgAAAAEAAAAM56z6ezglmufZGcta83RKGgAQAAtvDpExhD6h95lfWBt0FqZYzxupI2IepH/XlhLB5rsuuQDCJUL7XGIIsaVW2oNQxgNCPXxRSuCxHQ7vqgbh4G7xHk0wdyws5Ax4T/RYJbfYEF5KAPzShdmdoZdkY/FOWrVEgAr7LzKFBoDcPJBvgX+lfsJdBNeWRB5BqRX552dUFjtDlp8u3K/dA9twWDU2w/cRLMXJtVZ/y/ICI1fzXjX3u7sY9K1IC+5Hbi7nouCK6Ze5RLBnL0Zfdq0PyGlj2To4ftAYAT0SzkBaxlXRQSzMhX+7c+rgKpMqtG9XjAW26x3IJAp2/uAr2zOZqH+tskamHYSruhTicHJDTtP+r6Rs21y2QkRT9Hb9oPd9B5mDIzGtDkifWBbmwLv4XFuYcna1Zgny7McSxMI62jxayVlZKcS5dXV0shwLoUjbTDcXQmFKsRvo2sCW86wcN8ad02jhKCQMf9SWnZpd849mlqgMFiQQSFlZ6Q+vJLrXqVb8zmVZemQPQcY/DktgjOvjn0iOZ3zhl20fRENOa3ZIWvvK8p9pblz3sEfS19MAW0JtYUAAAAayvNPot3An7LaCTdFYrEip+fTU4=</CipherValue>
      </CipherData>
    </EncryptedData>
  </connectionStrings>

Answer 1

Make sure that

• your database connection string is set in your application's configuration file web.config
• the connection string is encrypted - details here: http://msdn.microsoft.com/en-us/library/ff647398.aspx

It also makes sense to use a password generator create the user credentials, or a use long phrase (such as "correct horse battery staple") as the password.

Answer 2

If you're seeing unauthorized access to your database despite your web.config data being encrypted, then it's entirely possible that your database itself was compromised.

Most shared SQL providers allow remote connections, so someone could have brute-force attacked or otherwise compromised your database.

There are a number of best practices for securing a database, including:

• Disable the SA account and create another user account to manage the database, or
• Rename the SA account.
• Use strong passwords or, as Jeremy McGee mentioned, long-phrase passwords.
• Use separate users with limited, specific access according to role.
  • For example, you could create a user for your web site and grant it access to only the pertinent tables used by the web site.
  • One benefit of using multiple users is you can more easily trace the source of the compromise in the event it happens.