Password protect access DB?

[RobinS]

With these types of hassles, would it make more sense to use a database
like SQL Express, MySQL, or even Firebird?

Firebird's embedded DB is pretty good - not sure if it's meant for multi-
user, but it's tiny (250KB for the engine). Otherwise there is a full
fledged firebird DB you can include if you need a full db.

------------------------------

What kind of hassles? That was my point. I had no problems, unless you are
referring to the auto-compacting procedure, which took about an hour to
write and implement, and worked forever after.

My first choice would be SQLServer, but that wasn't an option on this
project. I had to use whatever I could get for free that my department was
okay with; they had a site license for MS Professional, hence Access. (Yes,
I know SQLSE is free, read on.)

I was the only IT person in the department, and they felt more comfortable
with Access than SQLServer because they felt it was more supportable. You
have to admit, anybody can open an Access database and look at the tables.
And they can do it w/o installing SQLServer on their desktop.

All in all, I developed several desktop applications with varying purposes
for different groups, with Access as the back-end, and they are all still
in production today, with no known problems. The first one was implemented
in 2000.

But if I had had free reign, I would have used SQLServer, no question.

Robin S.
Ts'i mahnu uterna ot twan ot geifur hingts uto.
-----------------------------------------------

 

[jeff]

I agree 100% ... that is why ... if you are trying to protect sensitive DATA
(protect a patient's identify), your program should implement some type of
data string encryption ... where by the application takes all the
information that could be used to identify a person - a patients name 'John
Smith'; address; postal code; phone number ... - encrypt it, and store the
encrypted strings in the database. Upon retrieval of this information, the
application decrypts it before presenting it to the user. And like I said,
by encapsulating this logic in a base class, you are able to easily apply
the decryption to any visual object you need ... user entry screen, report
and so on...

Access with an Encrypted password is garbage (and MSSQL probably is to) to
those that are determined to hack you database... And for this reason, if
you are trying to protect sensitive data .... you need to secure it at the
field level and not the database level.

To me, this is the only real way to protect sensitive data. However, there
probably is a crack for this to!

That's all, we both agree, I was just trying to give the OP a little more
knowledge to base his decision on - and if he was after DATA / FEILD LEVEL
security, he needs to think a little bit more about it.

Thats all.

Jeff.

 

[jeff]

thank you michel ... very informative.

This isn`t the first time that this is discussed here , as i mentioned in
my previous post

You have another definition of data security as i do
Ofcourse if we are talking about perfomance wit lots amounts of data , and
about Data integrity SQL wins this from Access ( maybe depending on the
progger but that is a different discussion )

but i mean this scenario

I was once a Automotive catalogue programmer with a user base of 20.000 +
users throughout europe , the money was in the relations from cars to the
correct fitting parts we had 20 automotive specialists ( with mechanics
skills ) who did nothing else on daily basis as finding out if the part
would fit on a specific car make and modell .

So this was the value of our program , a car drives in the car shop for a
maintenance service , the mechanic starts our program , and enters the
license plate number
the program now searched in the database and finds the correct make and
modell of the car , the user confirms this and selects the type of
maintenance he wants to do, the program searches again in the database
and finds the corrrect parts to be fit on the car and the estimated repair
times .

The Car shop can inmediatly tell the cutomer what the repair will cost ,
and can plan in the repair time in his shop

So as you see the value of the program is in the data , we made this data
and it was our property

If we would have used Anny RDBMS ( SQL server , Firebird etc etc etc etc )
our concurent software vendors could just get themselves a copy of our
program
and steall our data by loging on at the system as a administrator .

Believe me when i say that all of these systems the security was easy
breakable this was really a mather of minutes if you had admin rights on
the local system and if you didn`t, you just copied the dB to your own
system and atached it there to your own server and you are granted full
acces

With Access and a custom workgroup file you can really protect the
database from people seeing ( stealing ) the data as how it is stored in
the database
when you say heavy modified ,, well i do not concur this is just a simple
step to acomplish ACCESS has even a builtin wizzard to acomplish this task
, so i call it a pretty standard feature of Access

look here for more info :
http://office.microsoft.com/en-us/access/HA010546941033.aspx

But as i said above and before MS has now a valid alternative with there
embedded SQL product ( i believe that it was called sqlanywhere ) wich
does provide a feature to encrypt the database

For more info Buy the latest e-book of Bill Vaughn , or search on MSDN

And about the multi user thingy , we have once released our product on a
server farm with 600 users ( Citrix ) and it ran without anny problems
untill the day of today ( now 4 years ago ) the product was written in
VB6 so it is just a mather how you write your proggy


regards

Michel

ACCESS isn`t so bad at all and for the people claiming it can be broken
in 2
minutes wel i dare to challenge you , i have a database made in access
and
if you break it in a week i would give you a guru status do you dare to
pick up the glove ??

I'm guessing you mean you have a heavily modified Access database and
aren't using the "out of the box" Access. If so that is a completely
different scenerio. In my post I assumed (albeit possibly incorrectly)
that the OP was looking to use the standard Access database password
protection and was expecting it to protect his data. I'm sure you can
agree that this is not a secure setup (after all if it was what would
the script-kiddies do?), and as far as standard password protections
Sql Server would win.

Like in all situations, the developer needs balance performance, ease
of use, cost, scalability, and who knows how many other factors before
making a decision.

Thanks,

Seth Rowe

I see a lot of responses here from people telling you that MSSQL is far
superior in security as Access

Well maybe they should have first asked what is your goal , cause if it
is
security of data in the context of you that don`t want a user to see the
data in the database
ACCESS isn`t so bad at all and for the people claiming it can be broken
in 2
minutes wel i dare to challenge you , i have a database made in access
and
if you break it in a week i would give you a guru status do you dare to
pick up the glove ??

Well okay i am going to ruin the contest by telling you how ( what if i
did
not give you this info ) but even then i still am confident that you
can`t
open the DB in minutes it will probaly take you a few days and in depth
knowledge of Access plus the fact that lots of data wil remain rubish
for
you ( so 100% retrievel is impossible i believe )

the Buzz is Workgroup file with a custom encryption key with Access you
can
use workgroup files and so delete the standard Admin and user accounts
and
thus add your own in this workgroup file you can optionally include an
encyption scheme ( 256 bits ) so you end up with a secured encrypted
database who nobody besides you ( or your program ) can open

In contradiction SQL server and for a fact anny real RDBMS has it`s
security
on file system level wich means that a system administrator can always
see
the content of the database after mentioning this a few times in the
newsgroups and after manny manny discussions about the usage of data
level
protection here in the newsgroups i remember some nice threads with Bill
Vaughn covering this topick MS has decided to implement data level
security in it`s new SQL anywhere product how this exactly works can be
found on MSDN and in Bill`s Book

However this is the first version that is a true replacement of the
Access
Data level protection scheme

HTH

Michel Posseth [MCP]

<[email protected]> schreef in
bericht
Hi,

I am new to programming with databases and was wanting some help.

Is there any way to password protect an access database and access
sent sql commands to it via vb.net code?

Any help would be much appreciated.

Thanks in advanced.

Tom.