Implementing Best Practices

Send administrative-related activity logs to a centralized logging system.

Log all network traffic, both accepted and dropped.

Alert on the following conditions:

1. Failed and successful logins.

2. Changes in roles and assigned privileges.

3. Configuration changes.

4. Software installation and deletion.

5. System or native database errors and alerts.

Only allow connections from trusted sources.

Disable external administrative access.

Disable default network ports.

Users and systems (e.g., applications) should have the least privileges necessary to perform their job functions or tasks.

1. Schemas should be limited to function with a minimum set of information.

Restrict administrative privileges to authorized users (such as DBA’s Systems administrations, Application administrators).

Conduct regular audits of privileges.

Place database servers in a dedicated segment apart from applications and other services.

Patching:

1. Install the latest operating system patches.

2. Install the latest database security and stability updates.

Utilize separate database servers.

1. Do not Install databases on the same system the application runs on.

Utilize encryption.

1. If available, utilize encryption of all data held within the database.

Create regular backups.

1. Back up databases regularly and schedule testing of these backups often.

2. Store backups separately, even physically separated, from the database when possible.

3. Restrict authorization to backup, access, and restore data to a smaller or different set of users than regular database users.

4. Patch the host operating system regularly.

Secure default accounts.

1. Remove default accounts, if possible.

2. Disable any default accounts if removing them is not an option.

3. Set a random, complex password that is not shared among users if removing or disabling default accounts is impossible.

Implement alerts from security controls, local firewall, EDR, and anti-malware.

Log queries, including user identity and size of results. 1.Alert on:

1. First-time access by a user to a database.

2. Large query results.

3. Creation or destruction by users.

Implement application control on database servers preventing unnecessary applications from executing.

Only allow connections over a local socket.

1. Disable TCP access.

Place the database in a separate isolated environment.

1. Ensure databases are not in the same network segment as application servers, ideally in a network segment only for databases.

Separate DEV & UAT environments from production.

1. Do not share accounts between environments.

2. Do not store production data in development & UAT environments.

Do not use built-in database accounts like root, SA, or SYS.

Lock database administration accounts down to local-only access.

Store transaction logs on a separate disk.

Create backups

1. Ensure that backups are encrypted.

2. Ensure backups have appropriate permissions assigned.

Invest in FIM (File Integrity Monitoring)

Implement behavior analytics with alerting for:

1. Successive or simultaneous logins from physically distant geographies.

2. Source IP addresses used to access databases.

3. Source ISPs for remote user access.

4. Queries issued by users.

5. Amount of data returned by queries per user.

For administrative users, use more sensitive alerting for behavior analysis.

Only allow connections from encrypted sources.

Configure the database to bind on localhost.

Implement an application layer firewall allowing the minimal set of operations required for normal use.

Utilize granular access controls for table, column, and row access.

Place each database server in a dedicated segment with filtering capabilities.

Segment data within databases. For example, partitioning data based on user or customer accounts prevents accidental data leakage or cross-pollination.

Ensure change management procedures are well documented and followed.

Utilize encryption key management systems to ensure the regular rotation of encryption keys