Best Security Practices for Database: Techniques & Practices that Will Keep Your Database Secure and Optimal

The database management system serves as a warehouse for organizational/business information, for example, customer data, employee information, financial data, health/medical information, public records, etc. The database system provides a structured approach to storing and retrieval of business data. To ensure confidentiality, integrity and availability of business data stored in the database, rules are defined in the database to control how data are accessed, processed and archived for future use and retention. The rules configured in the database are for the security of organizational data and to ensure optimal usage and availability.

  There are different types of architecture that can be used to deploy a database for optimal usage, which largely depends on business requirements, security considerations and availability requirements of concerned business data. Applications that run is a distributed network environment are basically designed to function in a 3-tier architecture consisting of the client-side (web or mobile client), the server-side (backend application) and the database (datastore). Application users that consume application services through the client-side (web or mobile interface) in most cases do not interact directly with the application database but do so through the server-side of the application (a.k.a. application server). This architecture ensures security of the database and information stored on it. However, for smaller applications where the client and server application sit within the same container, direct connection could be made to the database, which may not be recommended given the heightened risk of security breach. Although this architecture is dependent on the specifics of the systems being used and business requirements and are prevalent in desktop and workgroup applications.

Database configurations are what drive the functionality of the database. Every database management system has inbuilt configuration settings that is used to control data availability, accessibility, confidentiality, integrity, retainability and security of the database. These configurations can be categorized into the following functionalities.
  • Security
  • Availability
  • Performance
  • Scalability
  • Retainability
The database management infrastructure when acquired come inbuilt with these configurations. However, their usage depends on the business and security requirements of the organization in question. Thus, it is not a good practice to install a database with all inbuilt configurations put to production at once. This could spell doom for the organization given its security implication. As such, it is best security practice to adopt configurations that best suit the organization’s needs and requirements. To do this, organizations must define and adopt a security baseline for its database, which is an operational guideline that outline minimum configurations that will be turned on in production and those that will be turned off. As the name implies “baseline”, it is only the minimum standard and not the maximum, as such, there is room to put in place additional parameters that best secures the database and ensure optimal performance of the database. Configurations should not be enabled arbitrarily. Only configurations that are required should be turned on while unused ones should be turned off until when required.

In determine the baseline for the database, organizations most consider the OEM’s security documentations for the database system, the requirement of the application to run on the database as well as performance. In most case, the application running on top of the database determine or drive what the configurations of the database will be in terms of security and performance. As such, it is important to engage robustly with the application vendor to provide upfront all information and requirement for the database as well as other underlining infrastructures such as operation system platform the application and database will run on. These considerations are essential in building a functional and feasible security architecture for applications and their databases.

Here are detailed guide and program on how to perform security audit of your enterprise databases (e.g. Oracle and Microsoft SQL Server)

 
 

Nwabueze Ohia

(Cybersecurity consultant, Tech Blogger & Author)

Will appreciate your questions and contributions on to post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at info@oxleyconsults.com.ng.



Back To Information and Cyber Security Jobs

Learn More About Our Valuable IT Audit Programs/Checklists

Learn More About Our Valuable Risk Assessment &Templates & Checklist

Learn More About Leading Practices in Internal Audit Function

Popular Articles

Investing in Information Technology is pivotal to the success of a business and realization of enterprise goals/objectives. To create value for the business using IT.Learn More
Fintech applications such as Online Banking has disrupted the traditional "brick and mortar" banking that we all have been accustomed to over the years. Online Banking application brought about easyLearn More
Protecting Automated Teller Machine (ATM) network end-to-end requires layered approach to security (implementing security at ATM endpoints, physical and logical network)Learn More
Audit management software are used to automate the process of auditing. Most standardized audit management software come handy with good audit process automation....Learn More
The 21st century as the information/digital age has presented numerous challenges and opportunities for humanity. From widespread industrial revolution to notable advances in IT.Learn More
The Central Bank of Nigeria (CBN) recently issued a revised circular on the regulatory framework for Unstructured Supplementary Service Data (USSD) for financialLearn More
The series attempted to answer most of the governance and management questions/concerns and how IT Governance and Management Questions are mapped to COBIT 5 Enterprise GoalsLearn More
Cloud computing is the practice of using network of remote computing infrastructures hosted on the Internet to store, manage, and process data for end users....Learn More
Remote access software are tools used to access or take full control of computing systems from a remote location either to provide support, access files...Learn More
Mobile hacking is an exciting field for cybersecurity enthusiast and at the same time lucrative for hackers. This is given significant rise in the number of mobileLearn More

IT Audit, IT Risk and Cyber Security eBooks By Nwabueze Ohia

Auditing Your Information Systems and IT infrastructure: Practical Audit Programs/Checklists for Internal AuditorsGet Now
IT Infrastructure Risk & Vulnerability Library: A Consolidated Register of Operational & Technology Infrastructure Vulnerabilities for IT Assurance ProfessionalsGet Now
Auditing Your Payment Cards Processes, Systems and Applications: A Step By Step PCIDSS Compliance Audit Program For Brands, Issuers, Acquirers, ProcessorsGet Now
Auditing Your Windows Infrastructure, Intranet And Internet Security: A Practical Audit Program for Assurance ProfessionalsGet Now

 

Let us know your thoughts post. Leave a Comment below.