Service · Information security

Database protection

A database is the place where your information sits in its entirety and in a form convenient for carrying away. Yet access to it is usually protected worse than access to the application itself: the application has roles, while the database has one administrator password shared by everyone.

Submit a request What is included

Auditing

of queries and exports

Encryption

of data and backups

Masking

in test environments

Control

of bulk exports

What is included

Protection rests on three things: who can connect, what they can do and whether it is visible in the logs.

Discuss the scope

Access separation

Personal accounts for administrators, separate application accounts with minimal rights.

Network isolation

The database must not be reachable directly from workplaces, let alone from the internet.

Auditing

Recording access and especially bulk selects. Exporting the whole client database has to be noticeable.

Encryption

Of the data on disk and of the backups. An unencrypted copy of the database is a leak waiting to happen.

Masking

Anonymising the data in test and training copies. Developers do not need real surnames.

Updates

A procedure for installing database security fixes with verification on a test environment.

How the work runs

The work is carried out without stopping the production database, and windows are only needed for updates and for switching encryption on.

Survey

Who connects, from where, under which accounts and with which rights. Several forgotten access routes usually turn up.

Isolation and access

We close network access, split the accounts and remove shared passwords.

Auditing and encryption

We switch on event recording and configure encryption of the data and the backups.

Verification

We check that a bulk export is recorded and that restoring from an encrypted copy works.

A database backup is the most underestimated point of leakage. The production database is protected while the copy sits unencrypted on a file server that half the department can reach. Encrypting the copies closes this in a single step.

Frequently asked questions

Will auditing slow the database down?

Recording every query, yes, noticeably. That is why selective auditing is configured: administrative actions, rights changes, bulk selects. In that mode the effect on performance is negligible.

What do we do about the copies developers hold?

Mask them. Anonymisation mechanisms exist that replace real surnames, phone numbers and addresses with plausible fictional ones while preserving the structure and the volume. For development and testing that is enough.

We use 1C, does this apply to us?

Yes. A file based 1C database is a file that can be copied whole, and the client server version runs on a database system with all the same questions. For a file based setup with 50 users we generally recommend moving to client server, security being one of the reasons.

Other services in this area

The whole area

We will review your database protection

Tell us which database systems you use and who connects to them. We will look at access, auditing and the protection of the copies.

Phone
+7 (495) 978-63-36

Email
office@apply.ru

Office
Moscow, 108 Profsoyuznaya St.

I consent to the processing of personal data