Locking Down Databases: The Basics You Need to Know
It's clear that attackers are going where the money is and that means to the databases. Credit card numbers, names, addresses, bank accounts, you name it, if it's useful to identity thieves, it's in a database. When the databases are accessible from the Internet, they can become the target of attacks. Techniques range from SQL injection attacks, to exploiting database listener vulnerabilities (that's the program that takes request for database services and returns results), to hacking application specific vulnerabilities. Here is a short list of resources that can help quickly lock down the most vulnerable aspects of database systems.
Locking Down Oracle
http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_db_database.pdf
http://www.sans.org/score/checklists/Oracle_Database_Checklist.pdf
Locking Down MySQL
http://dev.mysql.com/doc/refman/5.0/en/security-guidelines.html
http://dev.mysql.com/doc/refman/5.0/en/security-against-attack.html
Locking Down MS SQL
http://www.windowsecurity.com/articles/Secure_SQL_Server.html
https://www.microsoft.com/sql/prodinfo/previousversions/securingsqlserver.mspx
http://vyaskn.tripod.com/sql_server_security_best_practices.htm
When you have time for a longer read, see the military's recommendations for database security at http://iase.disa.mil/stigs/stig/database-stig-v7r2.pdf.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
