Cyber Defense eMagazine November 2020 Edition

#3 Delete “default” and sample databases. The word “default” is the playground for cybercriminals.
Those who have suffered cyber breaches will know, it can nearly always be replaced with the phrase
insecure: default passwords are weak passwords; default settings are unsafe settings. If there is a default
anything in your environment – always delete it.
#4 Strong passwords are essential. Again, another seemingly mundane and straightforward action,
but one that is the most overlooked. Default or weak passwords attract cybercriminals like bees to honey.
Change passwords often, use unique passwords for different projects, make sure passwords are strong,
and very importantly, change all default passwords.
#5 Use role-based access control (RBAC) and Active Directory. Control privileges to both
administrative activities and data access with fine-grained access control. Also, protect user credentials
and manage them at a centrally controlled place with Active Directory.
#6 Encrypt your data in-transit, on the wire, and at rest: Make sure that your data is encrypted as it
travels over networks during client-server communications or when it is being replicated within the
database server or being replicated between database servers in different data centers/zones/regions.
Likewise, you should encrypt the data when it is stored for persistence. These measures prevent
unauthorized access to data at all levels.
#7 Use updated TLS Ciphers. Transport Layer Security (TLS) enables secure network communications.
This security can be further enhanced by using updated versions of the ciphers and/or by picking
customized ciphers. On top, a well-thought-out policy for certification expiration/rotation/revocation
should also be implemented.
#8 Limit port access. Allow firewalled access to the minimum set of network ports that are needed for
your database to work.
#9 Report security issues immediately. If your database has been breached or you think there may
be a security flaw, report it. Immediately. There is a community of people out there that can offer you
advice and benefit from this information. Security is always better when we pool resources and work
together as an industry – keeping us one step ahead of cybercriminals.
A problem shared
Hackers and cybercriminals are always going to be part and parcel of our business life. It is a bleak
reality. We need to invest in education and adopt best practices, and we need to acknowledge that
ensuring compliance and adopting good security policies is an industry-wide responsibility.
For those of us deploying, implementing, and developing on databases, this is even more relevant. From
web, mobile, and app developers through to C-suite and technology executives, everyone involved in
databases has responsibility for ensuring they are secure. NoSQL vendors also have a responsibility to
ensure that their systems provide users with the tools to secure themselves better and secure their
services by default.
Cyber Defense eMagazine – November 2020 Edition 66
Copyright © 2020, Cyber Defense Magazine. All rights reserved worldwide.