Database security best practices for 2021: A guide
Aug 22nd, 2021
Today's data-driven organizations must secure data no matter where it resides — whether on-premises or in the cloud. In the absence of adequate protection, data is at risk, both from external threats and from internal attacks. Without adequate security, data can be breached, which is not only embarrassing but also a costly endeavor for the organization.
In a 2021 annual "Cost of a Data Breach" report from IBM, data breach costs rose from USD 3.86 million to USD 4.24 million, the highest average total cost during the report's 17-year existence. Additionally, data breaches can result in business disruptions, recovering costs, intellectual property loss, and heavy fines from authorities, which can significantly impact an organization. Due to this, many organizations have positioned data security as a top organizational priority, urging IT teams to set up and enforce comprehensive database security programs.
This guide is designed to help IT teams better understand the key components of database and security architecture, types of threats and challenges, and lastly, best practices for reducing unauthorized access and other security threats.
What is database security?
Database security consists of the tools, architecture, and business processes that maintain the confidentiality, integrity, and availability of data in a database. These security controls extend to cover several key areas of the database environment including:
- The database management system (DBMS)
- The applications surrounding the database
- The physical server running the database and underlying operating system
- The network infrastructure used to interconnect the servers
- Any person with access to the database
Since database security has a vast surface area, it often requires putting together several layers of security. Incorporating layers of security across all these key areas brings more transparency and accountability to your data security operations.
Typically a security approach that is similar to the AAA model, which was originally developed for network and computer security can be used :
Authentication: to verify the user is who he or she claims to be
Authorization: to verify the user is allowed access
Auditing: to record all database activity, including the username and the time in the log files
Encryption: to encrypt database connections and data stored at rest in the database, including data backups.
Implementing database security is not always a straightforward task. As with all security strategies, balancing security and usability becomes inherently complex. When it comes to database security, maintaining a balance between database size and dependencies can be explained using Anderson's Rule, a computer science rule that states the larger and more accessible the database is, the less secure it will be. This means that the more secure a database, the less accessible its data is to users and applications — this can have a negative impact on customer experience and application performance. For security teams and database administrators, it is important to strike the right balance between security and accessibility in the light of a better user experience.
Common threats and security challenges affecting a database
In large part, database security is typically reactive since data security standards are not enforced when a database is created. This is because, in most cases, a user experience-oriented approach is taken when these databases are deployed, and the testing primarily focuses on functionality. If security controls are not configured right from the very beginning or as part of the testing process, it can be harder to bolt them on later and get them right. In the absence of these built-in security controls and secure defaults, there are likely to be security issues due to misconfigurations, software flaws, or logistical challenges associated with scaling.
Human risks
Human risks not only include protecting data assets from unauthorized external actors due to weakly configured policies, but also internal threats such as a rogue employee who is within the organization.
The shift towards a global remote workforce has made it more challenging to spot insider threats. As more and more apps and employees interact with data outside of the traditional data center parameters, it is becoming increasingly difficult to exactly pinpoint unauthorized access. Remote users, in recent times, have used a plethora of non-traditional shadow IT tools to compensate for the lack of in-person capabilities and enhance their efficiency. As a result, organizations have to implement stronger processes around access in order to minimize the risk of data leaks.
As it relates to securing data, another key challenge is ensuring employees and other authorized users are using strong credentials. Despite security awareness training, IT teams often find this difficult to achieve.
Software exploits
Organizations must also protect databases from software exploits due to both the volume and complexity of database attacks and the ease with which malicious actors can attack databases at an enormous scale with minimal risk. Some of the key threats targeting databases include:
- SQL/NoSQL injection - the insertion of arbitrary code into database queries, often performed against web-facing databases. It is possible to mitigate these types of attacks by adhering to strict coding standards and conducting regular vulnerability testing. SQL injection attacks can also be mitigated by installing web application firewalls that protect databases from malicious queries.
- Denial of service attacks (DoS/DDoS) – These targeted attacks are caused when an attacker hits the database server with more requests than it can handle, causing it to crash. It is critical to have a strong incident response plan and a strong network security posture consisting of intrusion prevention, threat management, load balancing, and other defense-in-depth techniques to prevent these attacks.
- Malware - Malicious software written to cause damage or exploit vulnerabilities targeting a database endpoint. Such exploits can take advantage of unpatched software or ransomware that encrypts any network asset, including databases. You can reduce the risk of malware by updating anti-malware tools regularly and limiting users to only those files and folders that they require access to. By implementing principles of "least privilege" you can prevent malware from spreading across your network.
- Buffer overflow - In this type of attack, attackers attempt to write too much data to a fixed-length block of data that can’t handle it. Despite being well known by application coders, they are often exploited by attackers due to the sheer number of legacy unpatched applications and devices. To reduce the risk of such attacks, businesses should ensure that their websites, applications, and databases are scanned for open vulnerabilities and patched.
Logistical challenges
The increasing size and complexity of infrastructure contribute significantly to the difficulty of ensuring that the proper security controls are in place. Growing volumes and distributed architectures can make managing databases difficult, time-consuming, and expensive. The organization should also make sure the databases and infrastructure are designed in a way that meets key regulatory and compliance requirements and the processes can quickly evolve to address new requirements.
As with many areas of security, organizations struggle with ensuring the right skill sets are available internally to meet the wide range of security and database-specific requirements. The organization must ensure that security controls are integrated proactively into processes, that they are maintained, and that they are routinely tested to ensure they conform to cybersecurity benchmarks.
Database security best practices
In order to mitigate the risk of unauthorized access of data or accidental leak due to insider threats or improper configuration of database security policies, it is important to ensure that key security controls are applied to start with the physical security of the database server. You might want to consider some of these key best practices:
Separate out application servers and database servers
To minimize the risk of unauthorized users accessing applications, make sure databases are physically located on a separate instance from applications and web servers. As a result, stronger hardening rules can be applied to the database instance which contains critical data.
Deploy firewalls and database activity monitors (DAM)
It is best to use both web application firewalls and database firewalls to deny all traffic by default, except for explicitly allowed application and web server connections that require access to the database and data. Furthermore, database activity must be monitored to ensure that nothing unusual is happening.
Provision database user accounts with only needed privileges
By using the least-privilege methodology, the practical minimum number of users should have access to the database, and their rights should be restricted to the minimum possible levels.
Patch and update your database software and operating system
Patch the product's database software and operating system to minimize zero-day exploits and upgrade the product to leverage the latest security features.
Test and verify database security and remediation processes
Perform regular penetration testing and vulnerability scanning to ensure your security controls are effective. Perform fire drills in your environment to ensure that analysts are able to identify unusual activity and conduct investigations.
Strongly encrypt your data and backups
Strong encryption should be used to protect both data at rest and data in transit. It is equally important to encrypt backups. Your organization should keep the decryption keys separate from encrypted backups.
Keep your data safe, secure, and protected in the cloud
Securing databases is a hard problem, and using a managed cloud service is one strategy to outsource the “grunt work” of database security to a skilled, enterprise-level provider. When choosing your cloud provider, keep these things in mind:
- The cloud database provider should regularly run third-party penetration tests and vulnerability scans across its infrastructure.
- The cloud database provider must meet stringent compliance requirements such as SOC2 and others
- The cloud database provider must prioritize reports of suspected vulnerabilities from users and the security community at large.
- The cloud database provider must provide features like Attribute-Based Access Control (ABAC) to maintain strict access control
- Most importantly, the cloud database provider must offer a secure service and be developer friendly
If you're looking for a cloud database provider, Fauna meets all of these criteria. Fauna is a flexible, developer-friendly, transactional database delivered as a secure and scalable cloud API with native GraphQL. Read more to learn why you should trust your data with Fauna.
Get started on Fauna instantly with flexible pricing per-use
Sign-up for free
The data API for modern applications is here. Sign-up for free without a credit card and get started instantly.
Sign-up now
Quick start guide Try our quick start guide to get up and running with your first Fauna database, in only 5 minutes! Read more
Quick start guide Try our quick start guide to get up and running with your first Fauna database, in only 5 minutes! Read more
If you enjoyed our blog, and want to work on systems and challenges related to globally distributed systems, serverless databases, GraphQL, and Jamstack, Fauna is hiring!
Subscribe to Fauna's newsletter
Get latest blog posts, development tips & tricks, and latest learning material delivered right to your inbox.