Securing an ASP Database

[bobbyd]

I am using asp to write details to an access database. If I enter

http://www.mydomain.com/database.mdb

then it allows me to download the database to my client machine. The permissions on the db are set to write only.

Anyone got any ideas how to stop this happening, and any other good security tips??

Thanks

Darren

 

[chiph]

Put the database on a different drive, or put it in a different directory outside of inetpub.

And, I've found it's a good idea to have your website on a different drive from the OS. Examining my logs last weekend I noticed someone trying to run ..\..\winnt\system32\cmd.exe. If it's on a different drive, it makes it tougher for them.

Chip H.

 

[bobbyd]

Chip,

Thanks for the reply, and I will keep it in mind for the future, but for what we are doing, we have an externally hosted web site, so all that is available to us is the inetpub directory.

Any other suggestions?

Darren