: If you're seeing unauthorized access to your database despite your web.config data being encrypted, then it's entirely possible that your database itself was compromised. Most shared SQL providers

@Chiappetta492

If you're seeing unauthorized access to your database despite your web.config data being encrypted, then it's entirely possible that your database itself was compromised.

Most shared SQL providers allow remote connections, so someone could have brute-force attacked or otherwise compromised your database.

There are a number of best practices for securing a database, including:


Disable the SA account and create another user account to manage the database, or
Rename the SA account.
Use strong passwords or, as Jeremy McGee mentioned, long-phrase passwords.
Use separate users with limited, specific access according to role.


For example, you could create a user for your web site and grant it access to only the pertinent tables used by the web site.
One benefit of using multiple users is you can more easily trace the source of the compromise in the event it happens.

Vote Up Vote Down

Login to post a comment!