Best Security Practices for Database: Techniques & Practices that Will Keep Your Database Secure and Optimal

The database management system serves as a warehouse for organizational/business information, for example, customer data, employee information, financial data, health/medical information, public records, etc. The database system provides a structured approach to storing and retrieval of business data. To ensure confidentiality, integrity and availability of business data stored in the database, rules are defined in the database to control how data are accessed, processed and archived for future use and retention. The rules configured in the database are for the security of organizational data and to ensure optimal usage and availability.

There are different types of architecture that can be used to deploy a database for optimal usage, which largely depends on business requirements, security considerations and availability requirements of concerned business data. Applications that run is a distributed network environment are basically designed to function in a 3-tier architecture consisting of the client-side (web or mobile client), the server-side (backend application) and the database (datastore). Application users that consume application services through the client-side (web or mobile interface) in most cases do not interact directly with the application database but do so through the server-side of the application (a.k.a. application server). This architecture ensures security of the database and information stored on it. However, for smaller applications where the client and server application sit within the same container, direct connection could be made to the database, which may not be recommended given the heightened risk of security breach. Although this architecture is dependent on the specifics of the systems being used and business requirements and are prevalent in desktop and workgroup applications.

Database configurations are what drive the functionality of the database. Every database management system has inbuilt configuration settings that is used to control data availability, accessibility, confidentiality, integrity, retainability and security of the database. These configurations can be categorized into the following functionalities.

Security
Availability
Performance
Scalability
Retainability

The database management infrastructure when acquired come inbuilt with these configurations. However, their usage depends on the business and security requirements of the organization in question. Thus, it is not a good practice to install a database with all inbuilt configurations put to production at once. This could spell doom for the organization given its security implication. As such, it is best security practice to adopt configurations that best suit the organization’s needs and requirements. To do this, organizations must define and adopt a security baseline for its database, which is an operational guideline that outline minimum configurations that will be turned on in production and those that will be turned off. As the name implies “baseline”, it is only the minimum standard and not the maximum, as such, there is room to put in place additional parameters that best secures the database and ensure optimal performance of the database. Configurations should not be enabled arbitrarily. Only configurations that are required should be turned on while unused ones should be turned off until when required.

In determine the baseline for the database, organizations most consider the OEM’s security documentations for the database system, the requirement of the application to run on the database as well as performance. In most case, the application running on top of the database determine or drive what the configurations of the database will be in terms of security and performance. As such, it is important to engage robustly with the application vendor to provide upfront all information and requirement for the database as well as other underlining infrastructures such as operation system platform the application and database will run on. These considerations are essential in building a functional and feasible security architecture for applications and their databases.

Here are detailed guide and program on how to perform security audit of your enterprise databases (e.g. Oracle and Microsoft SQL Server)

Nwabueze Ohia

(Cybersecurity consultant, Tech Blogger & Author)

Will appreciate your questions and contributions on to post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at info@oxleyconsults.com.ng.