Database Security Hardening: 15 Essential Steps

Databases are the crown jewels of any organization — they store customer data, financial records, intellectual property, and more. Yet database security is often an afterthought, with teams relying solely on network firewalls while leaving databases wide open from the inside.

Here are 15 essential security hardening steps that every database administrator should implement.

Access Control

1. Implement the Principle of Least Privilege

Every user and application should have only the minimum permissions needed to perform their function. Never grant DBA/admin privileges to application accounts.

-- Oracle: Create a restricted application account
CREATE USER app_user IDENTIFIED BY "StrongP@ss123!";
GRANT CREATE SESSION TO app_user;
GRANT SELECT, INSERT, UPDATE ON schema.orders TO app_user;
-- No DELETE, no DDL, no DBA role

2. Remove Default Accounts and Passwords

Every database ships with default accounts (SCOTT/TIGER in Oracle, root with no password in MySQL). Lock or remove them immediately after installation.

3. Enforce Strong Password Policies

-- Oracle: Create a password verification function
CREATE PROFILE secure_profile LIMIT
  PASSWORD_LIFE_TIME 90
  PASSWORD_REUSE_TIME 365
  PASSWORD_REUSE_MAX 12
  FAILED_LOGIN_ATTEMPTS 5
  PASSWORD_LOCK_TIME 1/24
  PASSWORD_VERIFY_FUNCTION ora12c_strong_verify_function;

4. Use Role-Based Access Control (RBAC)

Create roles for different access patterns (read-only, read-write, admin) and assign users to roles rather than granting individual privileges.

Encryption

5. Enable Encryption at Rest

• Oracle TDE — Transparent Data Encryption for tablespaces and columns
• MySQL — InnoDB tablespace encryption with keyring plugin
• PostgreSQL — pgcrypto for column-level, full-disk encryption at OS level

6. Enforce Encryption in Transit (TLS/SSL)

All database connections should use TLS encryption. Never allow plaintext connections over the network.

# MySQL - Require TLS for all connections
[mysqld]
require_secure_transport = ON
ssl_ca = /etc/mysql/ssl/ca.pem
ssl_cert = /etc/mysql/ssl/server-cert.pem
ssl_key = /etc/mysql/ssl/server-key.pem

7. Encrypt Backups

Unencrypted backup files are a major security risk. Always encrypt backups at rest:

-- RMAN encrypted backup
RMAN> SET ENCRYPTION ON IDENTIFIED BY 'backup_password' ONLY;
RMAN> BACKUP DATABASE;

Auditing & Monitoring

8. Enable Unified Auditing

Track who accessed what data and when. Focus on auditing:

• Failed login attempts
• Schema changes (DDL)
• Privilege grants and revocations
• Access to sensitive tables (PII, financial data)

9. Monitor for Anomalous Activity

Set up alerts for unusual patterns:

• Large data exports during off-hours
• Queries accessing unusually large result sets
• New connections from unknown IP addresses
• Privilege escalation attempts

10. Log and Retain Audit Data

Forward database audit logs to a centralized SIEM (Splunk, ELK, Azure Sentinel) and retain for at least 1 year (or as required by compliance).

Network Security

11. Restrict Network Access

Databases should never be directly accessible from the internet. Use:

• Firewall rules — Only allow connections from known application servers
• VPN/Private networks — Place databases in private subnets
• IP whitelisting — Restrict listener access to specific IP ranges

12. Separate Database Traffic

Use dedicated network interfaces for database traffic, backup traffic, and management access. This prevents database traffic from competing with other network traffic and provides better isolation.

Patching & Maintenance

13. Apply Security Patches Promptly

Oracle releases Critical Patch Updates (CPUs) quarterly. MySQL and PostgreSQL release security updates regularly. Have a patch management process that applies critical patches within 30 days.

14. Remove Unused Features and Components

Disable or remove database features you don't use — each feature is a potential attack surface. In Oracle, check DBA_REGISTRY for installed components and remove unnecessary ones.

15. Implement Database Activity Monitoring (DAM)

Consider enterprise DAM solutions like Oracle Audit Vault, Imperva, or IBM Guardium for comprehensive monitoring, alerting, and compliance reporting across your entire database fleet.

Conclusion

Database security is a continuous process, not a one-time setup. Regularly audit your security configurations, stay current on patches, and test your defenses. The cost of prevention is always less than the cost of a breach.

Want a professional security assessment of your databases? Request a free database security audit from our team.