Top Database Hardening Best Practices

What is Database Hardening?

Database hardening is the process of securing a database from potential security threats. The process includes taking a variety of measures to protect the database from unauthorized access, data corruption, malicious attacks, such as SQL injection, and other potential threats. Database hardening also helps to ensure that the database is running efficiently and is able to meet the demands of the users. Database hardening techniques may include changing passwords, using encryption, limiting access to certain areas of the database, and more. However, the specific steps you should take to harden your database will depend on the platform you’re using. Since database security is a very broad and complex topic, a complete breakdown of how to harden your database is beyond the scope of this article. Instead, below are some simple tips to help point you in the right direction.

Best Practices for Database Hardening

1 – Adhere to standards

It is a good idea to start by adhering to established benchmarks. The following organizations provide guidance relating to security configuration standards, auditing techniques, remediation steps, and more.

• The Center for Internet Security (CIS)
• The NIST Security framework
• International Standards Organization (ISO)
• SysAdmin Audit Network Security (SANs)

2 – Read the documentation

As tedious as it might be, it is a good idea to read the security guides associated with the specific database platform you are using. Below are some links to the documentation for the most commonly used database platforms.

• Oracle: Oracle’s Database Security Guide.
• Microsoft SQL Server 2014: The Security Center for SQL Server Database Engine and Azure SQL Database.
• IBM DB2: IBM DB2 security documentation
• MySQL’s 5.6: MySQL 8.0 Reference Manual (the security section).

3 – Enforce “least privilege” access

Users should be given the least privileges they need to perform their role. This is especially important for databases since they typically contain sensitive or confidential information, and limiting access helps to protect the data from being accessed or manipulated by an unauthorized user.

4 – Secure your physical environment and media

Make sure that the physical machine hosting your database is stored in a secure environment with the necessary locks, alarms, CCTV cameras, etc. You should ensure that the database server is not hosting anything other than the database.

5 – Secure your perimeters

The database server should be located behind a firewall with default rules to deny all traffic. You will need to have firewall rule change procedures in place and receive real-time notifications when they change. Each database server should have its own firewall enabled for additional protection.

6 – Use database encryption

Sensitive data must always be encrypted when stored in a database. Generally speaking, the best way to encrypt data stored in a database is to use either an encryption algorithm like AES or a hashing algorithm like SHA-256. These algorithms provide strong encryption that will protect the data from unauthorized access and tampering. Furthermore, it is important to use secure protocols like SSL/TLS to ensure that the data remains secure while in transit. Below are some of the most popular database encryption tools:

• Oracle Advanced Security
• Microsoft Transparent Data Encryption (TDE)
• IBM Guardium Data Encryption
• Redgate SQL Encryption
• Imperva SecureSphere Database Encryption

7 – Monitor everything!

All database activity must be logged and monitored, and logs should be retained for at least a year. You will also need to audit all logins to your operating system and database servers, regardless of whether they are successful or unsuccessful. It is important to remember that security settings can be changed at any time by users with the relevant privileges. As such, you must continuously monitor your database configuration files and receive real-time alerts when they change.

Other factors you should also consider include:

• Removing default accounts.
• Implementing a strong password policy.
• Using a data classification solution.
• Auditing all access connections by users.
• Disabling unnecessary services and components.
• Building an effective schema for your database tables.

If you’d like to see how the Lepide Data Security Platform can help to monitor your critical assets, schedule a demo with one of our engineers.