My scenario:
I have been given an antiquated, VB.NET (.NET 2.0 Framework) Smart Client that does direct communication to a SQL Server 2005 database. This application has been directly communicating to the database via stored procedures and direct SQL queries. This has been within the company internally, so it hasn’t really been a concern…until:
Now, however, this application will be communicating remotely and will not be just an internal application.
Therefore, what do you think is the best way to approach this from a security standpoint, because I know that communicating directly to a database via port 1433 is just asking for trouble. I do not want these external clients that are using this application to have direct access to a central database.
So, before I get my feet muddy, what do you think is the best approach or solution as far as migrating these numerous SQL queries and stored procedure calls within the application to a more secure way of accessing the database? I have some ideas, but I wanted to know if there was anyone out there that has perhaps been in a similar situation and what they might recommend.
Thank you.
At the very least, use a web service to interface between your application and the database. For additional security, make sure the web service communicates to the database using an account that is very well locked down to only the functionality it needs. And you can ensure that only your application knows how to communicate with the web service by using credentials that are secretly hidden within your application.