97 Things Every Application Security Professional Should Know

Chapter 35. Securing Your Databases: The Importance of Proper Access Controls and Audits

Dave Stokes

Databases are the core of every project or product and are a critical piece that every AppSec professional should understand and pay attention to. However, very rarely do you hear of security steps taken to secure that data. Usually, the databases are firewalled away from the general world, which limits vulnerabilities from outside exploitation. This means much of the ability to adversely affect the data will come from insiders.

Like securing applications, securing databases starts with the basic security requirements, especially on access management. Databases, like their underlying operating systems, have usernames and, hopefully, passwords. Most databases no longer support “anonymous” accounts where there is neither a username nor a password. So what is needed are good passwords and restrictions on account access to schemas. It is unsurprising to find an organization with several projects using the same server for multiple separate schemas with the same account name and password. And many times, that will sadly be the root account.

It should be obvious that using the root account for all database access is a potential ticking time bomb waiting for the wrong delete or a data breach. However, this is unfortunately a common occurrence. Restricting root account access is always ...