How to restrict table access to a application I would like to know how I would go about restricting access to a table so that only a certain application can access the data within.

Where I work, we have a database application that rather stupidly stores user logon details (including passwords) in plaintext. There is a vulnerability in the way the software works that allows any user to run a SELECT query on the users table, and return all this information. This has been reported to the application developers, and should hopefully be fixed in a future version.

For now however, would I be able to change security settings so that only this application can access that table, and users of the application would be denied access? Users should still be allowed to run UPDATE queries to change their passwords, but SELECT is a big no.
For the security credential/context which the application uses to authenticate to the DB, set an EXPLICIT DENY to it on the table to not allow it to access it at all (e.g. SELECT, UDPATE, DELETE, etc.).

You should really have the application credential locked down in the DB which it uses anyway to ONLY allow it to ONLY have the EXPLICIT level of access it needs to each DB object specifically in the name of security.

So why the user table is a concern now, wonder what other tables, etc. it has access to due to poor security design.