SQL Security Policy

Physical
1. Disaster Recovery
  1. Ensure the disaster recovery plan is up to date
  2. Off-site back-up + secure
  3. Fireproof / Flood proof / Offline
2. Physical Access
  1. Ensure physical access to server is restricted
  2. Server can't be turned off / disconnected / plug in keyboard or USB stick
Software
1. Anti - Virus
  1. Ensure that anti-virus is running
  2. Has been tuned correctly
  3. Unnecessary directories are excluded to improve performance
  4. Exclusions and test loading have been completed
2. Configure Firewall
  1. Open TCP 3306 for MySQL
  2. Keep as many ports closed as possible
  3. Use SSH tunnel for testing as this does not expose server across web
3. Vendor Updates
  1. Ensue that server packs / hot fixes / patches are applied frequently
  2. Both at server and MySQL level
  3. This fixes security risks and loopholes Results in less risk of intrusion
4. Unwanted Services
  1. These added services could give side-door access, introducing something unexpected
  2. Linux – use “rcconf” removal tool to remove unwanted services
Access Restrictions on Server
1. Restrict remote access - SOCKET
  1. Socket on network layer model
    1. Connects two computers together
  2. Linux – skip-networking
    1. This stops it from opening socket connections
      1. Ties connection down to local host
        Needs to go into .ini file
2. Restrict remote access – LOCALHOST
  1. Bind-address = 127.0.0.1
    1. Forces SQL to listen only to localhost
      1. Can’t accept connections from anywhere else
        Preventing access from TCP3306 from outside source
3. Restrict remote access – GRANT
  1. Defines who and where they will be hosted from
  2. Ties down specific database and specific user
  3. GRANT SELECT, INSERT ON mydb.* TO ‘someuser’@’somehost’;
Database Changes
1. Disable LOCAL INFILE
  1. Prevents access to local files (eg. /etc/passwd) Stops some SQL injection attacks.
2. Change root directory
  1. /chroot/mysql
  2. socket = /chroot/mysql/tmp/mysql.sock
3. Remove test database
  1. Can be test databases installed with MySQL
    1. Allows anonymous access to database
  2. DROP DATABASE test;
    1. Drop the test and any other unwanted databases
4. Remove test accounts
  1. SHOW GRANTS FOR ‘’@’localhost’;
    1. DROP USER “”;
  2. Delete account shipped with MySQL
  3. Make sure created accounts are tied down to relevant tables
5. Change rootname and password
  1. Should upgrade to version 5 as privileges stay on previous versions.
  2. MySQL > RENAME USER root TO new_user;
6. Lower privileges
  1. Version 5 and above has pre-set restrictions
    1. Set ownership to MySQL user:
      1. shell>ls -l /var/lib/mysql
        Only allow MySQL and root access: shell>ls -l /usr/bin/my

Next up

SQL Security Policy

Description

Resource summary

Similar

	Created by seanie_32 over 10 years ago