Web servers vs application servers, Open source database Security vs Enterprise Database security
Question: I am working on creating a spec for a startup to create a financial broker
check website. It involves storing information about financial advisers and
payment details of the users (so obviously needs a lot of security). What kind
of databases are best suited for the application. Is MySQL or its open source
variations enough or is it better to go with Oracle Enterprise etc. Also any
info about the usefulness of application servers over traditional web servers
(cloud based or normal) in this scenario and the preferred scripting language
(PHP, Ruby, Python) for secure web applications.


Answer: Your choice of language, database, etc. has a relatively small impact on the
security of your application. The developer's understanding of how to write
secure code and the developer's understanding of the features provided by
their tools is far more important. It is entirely possible to write a secure
application on an open source LAMP stack. It is entirely possible to write a
secure application on a completely closed source stack. It is also very easy
to write insecure applications on any stack.

An enterprise database like Oracle will (depending on the edition, the options
that are licensed, and the add-ons that are purchased) provide a host of
security functions that may be useful. You can transparently encrypt the data
at rest, you can encrypt the data when it flows over the network to the app
server, you can prevent the DBA from viewing sensitive data, you can audit the
actions of the DBA and other users, etc. But these sorts of things really only
come into play when you've written a reasonably secure application to begin
with. It does you little good to encrypt all the data if your application is
vulnerable to SQL injection attacks and can be easily hacked to present all
the decrypted data to the attacker, for example.

