# Database Authorisation: RBAC, Least Privilege and Privileged Accounts **URL:** https://securesys.com.tr/en/learning/database-security/database-authorisation-rbac-least-privilege ![Database Authorisation: RBAC, Least Privilege and Privileged Accounts](/images/bilgi-merkezi/covers/cover-veritabani-04.webp) One of the most critical questions in database security is this: **“Who can reach which data?”** However, this question alone is not sufficient either. These must be known at the same time: Why can this user reach it? Which privilege do they hold? Since when has this privilege been open? Is it really still necessary? Is this access being recorded? On corporate database systems, authorization does not mean merely creating a user and giving a password. A correctly designed access model; **Identity, Authentication, Authorization, RBAC, Least Privilege, Segregation of Duties, PAM, JIT Access, Access Review and Audit** addresses many security layers such as these together. Because in many data breaches the attacker does not even need to develop a special exploit. A compromised or over-privileged user account can be enough to reach critical data directly. For this reason the core principle in database security is this: **Every user must be able to reach only the data they need, only for as long as they need it, and only with the privilege they need.** ### What Is Database Authorization? Database Authorization is the authorization mechanism determining which operations an authenticated user can perform. For example, one user may hold the; SELECT privilege. Another user; INSERT and UPDATE can perform these. A DBA, meanwhile; CREATE, ALTER, DROP, GRANT can hold higher privileges such as these. Authorization determines not who the user is but what they can do. ### What Is the Difference Between Authentication and Authorization? Authentication: **“Who are you?”** answers this question. Authorization, meanwhile: **“What can you do?”** answers this question. For example, the user connects to the database with the correct password. This is authentication. If they can read only certain tables, that is authorization. ### Why Is Identity and Access Management – IAM Important for Databases? IAM enables identities and access rights to be managed centrally. On the database side it covers processes such as; user lifecycle, role assignment, privilege review, account disable, access approval as its scope. ### What Is a Database User? A Database User is the identity that can connect to the database or that is granted privileges inside it. This identity; a human user, an application, a service account, an integration account, a backup account can be any of these. ### Are a Human User and a Service Account the Same Thing? No. A human user represents a specific person. A service account, meanwhile, is used by an application or a service. This distinction is very important from an audit perspective. ### What Is a Shared Database Account? It is more than one person using the same database account. For example: dba admin reportuser dozens of people using such an account together is an example of a shared account. ### Why Is a Shared Account Risky? The biggest problem is the loss of accountability. When a user deletes critical data: **“Who performed this operation?”** this question may not be answerable. At the same time, when an employee leaves the organization the password may have to be changed. ### Why Should Personal DBA Accounts Be Used? Every DBA having a separate privileged account increases audit capability. For example: ali.dbadmin ayse.dbadmin accounts such as these can be used. This way operations can be tied to a person. ### What Is Least Privilege? Least Privilege is the principle of granting the user the minimum privilege necessary to carry out their task. It is one of the most fundamental principles of database security. For example, if a user preparing reports needs only the SELECT privilege; DELETE, UPDATE, DROP they must not hold these privileges. ### Why Must Minimum Privilege Be Used? Because if the account is compromised, the attacker can go only as far as that account's privileges. This limits the impact of the attack. ### Why Are Excessive Privileges Dangerous? Let us imagine DBA privileges have been granted to an application account. If SQL Injection arises in the application, the attacker can hold very broad privileges on the database. For this reason the application account must reach only the objects it needs. ### What Is Permission Creep? It is the situation where a user continuously receives new privileges over time because of different roles, but the old privileges are not removed. For example, the employee may have worked in the: Finance → Sales → Management roles. However, if the privileges of the previous roles are still there, privilege accumulation arises. ### What Is Privilege Accumulation? It is the build-up of unnecessary privileges over time. This situation increases the impact of insider threat and account compromise. ### What Is RBAC? RBAC means: #### Role-Based Access Control that is: #### access control managed through roles in full. Privileges are granted not directly to users but to roles. The user is then assigned to the relevant role. ### Why Is RBAC Better? Instead of granting permissions one by one to 100 users; Finance_Read Finance_Write DB_Operator DB_Admin roles can be created. This makes both management and audit easier. ### How Should Role Design Be Done? Roles must be designed according to business functions. For example: HR_ReadOnly HR_Operator Finance_Reporting Application_Service Database_Admin Security_Auditor roles such as these can be used. ### Is Creating Too Many Roles a Problem? Yes. Role explosion can make management harder. Too few roles, meanwhile, can lead to excessive privileges being granted. A balanced model is needed. ### What Is a Read-Only Role? It provides data read privileges only. It can be used for reporting or analysis users. ### Is Read-Only Really Risk-Free? No. Even if a user holds only the SELECT privilege, they can read millions of customer records. For this reason even read-only privileges must be restricted according to data classification. ### What Is a Table-Level Permission? It enables the user to reach only certain tables. For example: Employee_Name they can reach this table but: Salary they cannot reach this table. ### What Is a Column-Level Permission? It limits access to certain columns. For example, the user; name, city can see these. However; the national ID number, the IBAN, the salary they cannot see these. ### What Is Row-Level Security? It enables the user to see only certain rows. For example: The Istanbul regional manager can see only Istanbul customers. ### What Is Schema-Based Access Control? It is the user being able to reach only certain schemas. This approach helps keep applications separate from each other. ### What Is a Database Object-Level Permission? It is granting specific privileges on objects inside the database such as; tables, views, procedures, functions, schemas as its scope. ### What Is the EXECUTE Privilege? It is the privilege to run a stored procedure or function. Instead of reaching the table directly, a user can run only certain procedures. This can strengthen access control. ### Is the Stored Procedure Privilege Safe? If designed correctly it is useful. However, the use of over-privileged or dynamic SQL inside the procedure can lead to a privilege escalation risk. ### Are a Database Role and an OS Role the Same? No. Database roles manage privileges inside the DBMS. An OS account, meanwhile, controls access at the operating system level. Both layers have their own security. ### What Is a Privileged Account? It is an account with broader privileges than a normal user. On the database side; DBA, superuser, sysadmin, SYS, SYSTEM accounts such as these can be privileged accounts. ### Why Is a Privileged Account Critical? These accounts; can read data, can create users, can grant privileges, can change audit settings, can drop database objects. For this reason the impact of a compromise is very high. ### Should the DBA See All the Data? This is an important question. Technically the DBA can most often hold broad access. However, from a business need perspective, not every DBA needs to see every piece of sensitive data. Where possible, separation of duties and additional access controls must be applied. ### Should the DBA and the Security Administrator Be Separated? In critical environments, yes. One person can manage database operations while another manages security policy or audit. ### What Is Segregation of Duties? Segregation of Duties means: #### the separation of duties in security terminology. It prevents a single person from controlling all critical privileges. ### Why Is Separation of Duties Important? If a DBA; can change the data and can delete the audit log detecting a malicious operation becomes difficult. ### Can the Four-Eyes Principle Be Used for Databases? Yes. Critical operations can require a second person's approval. For example: A production schema change or a very high privilege grant operation can be tied to a second approval. ### What Is PAM? PAM is: #### Privileged Access Management which enables privileged accounts to be managed securely. ### How Does Database PAM Work? The DBA may not have to know the database password directly. A sample flow: DBA ↓ PAM ↓ Approval ↓ Temporary session ↓ Database can be along these lines. ### What Does PAM Provide? PAM; a credential vault, session recording, password rotation, an approval workflow, JIT access, audit can provide these. ### What Is a Credential Vault? It is the system in which privileged passwords are stored securely. The DBA password may not be shown to the user in the clear. ### What Is Session Recording? It is the recording of the operations performed in a DBA session. This is valuable particularly on critical production systems. ### What Is JIT Access? JIT is: #### Just-In-Time Access which means the privilege is not permanently open. The user receives a time-limited privilege at the moment of need. ### A JIT Database Access Example The DBA will intervene on the production database. They open an access request. The manager approves it. A 30-minute privileged access is opened. At the end of the period it closes automatically. ### Why Is JIT Secure? It reduces the number of permanent privileged accounts. Even if a credential is compromised, permanent administrator privileges may not be present. ### What Is JEA? JEA is: #### Just Enough Administration which aims at granting the user only the necessary management functions. ### The Difference Between JIT and JEA JIT: #### For how long? JEA: #### How much privilege? each answers its own question. Together the two form a strong model. ### What Is a Break-Glass Database Account? It is the account used for emergency access when the normal identity systems cannot be used. ### Why Is a Break-Glass Account Necessary? For example; Active Directory is unreachable, PAM is down, SSO is not working any of these may be the case. In that situation an independent account may be needed for critical database recovery. ### How Should a Break-Glass Account Be Protected? This account; very strong credentials, strict audit, a usage alarm, limited access must be protected with these. ### Should a Break-Glass Account Be Used Daily? No. Its use must be treated as an extraordinary event. ### What Is a Database Service Account? It is the account applications or services use to connect to the database automatically. ### Should a Service Account Hold DBA Privileges? Generally no. It must reach only the objects it needs. ### Where Should the Service Account Password Be Stored? It must not be stored in source code or in a plain-text config file. A secret manager or vault can be preferred. ### Should the Service Account Be Able to Log In Interactively? As far as possible, no. This account must be used only for service purposes. ### Should a Service Account Owner Be Determined? Yes. For every service account; which application it belongs to, the responsible team, its purpose must be known. ### What Is an Orphan Service Account? It is an account whose using application or team is unknown. These accounts create a serious security risk. ### Why Is a Service Account Inventory Important? The organization must know which application uses which database credential. Otherwise a critical application can be cut off during password rotation. ### How Should Database Password Rotation Be Done? A controlled process must be used instead of unplanned rotation. For example: The new secret is created. The application is updated. The connection is verified. The old secret is revoked. ### What Is Automatic Secret Rotation? It is the secret manager changing the credential automatically. This can reduce the risk of static passwords. ### What Happens If the Database Credential Is in the Source Code? People with repository access can see the credential. Moreover, in a repository compromise database access is put at risk. ### Should Developers Reach the Production Database? By default, permanent full access must not be granted. If there is a real need it can be provided in a controlled way. ### How Can Developer Access Be Arranged? For example; read-only, temporary, PAM controlled, audited access can be used. ### Should the Support Team Reach the Database? Only to the extent needed. For support, a masked view or specific queries can most often be sufficient. ### Should the Help Desk Hold DBA Privileges? Generally no. Privileges need to be separated according to the roles' real business needs. ### What Is a Database Access Request? It is the formal process used for a user to request database access. ### What Should an Access Request Include? For example: Who is the user? Which database? Which table/schema? Which privilege? For how long? What is the business justification? ### Is Manager Approval Necessary? On critical databases, access can most often be tied to manager or data owner approval. ### Who Is the Data Owner? It is the role that owns certain data from a business perspective. For example, the owner of HR data can be Human Resources. ### Should the DBA Decide Alone About Granting Access? In every case, no. The DBA applies the access technically. However, from a business perspective the approval can be given by the data owner. ### What Is an Access Review? It is the periodic review of existing user privileges. ### Why Is an Access Review Necessary? Employees'; duties change, departments change, they leave a project. However, database privileges can be forgotten. ### How Often Should an Access Review Be Performed? There is no single universal period. On critical systems it can be more frequent. For example; quarterly, semi-annual reviews can be performed. ### Should Privileged Access Review Be More Frequent? Generally yes. DBA and highly privileged accounts carry higher risk. ### What Is User Access Recertification? It is the re-approval of the access a user holds. The manager or data owner: “This user's access is still necessary.” gives approval in this form. ### What Is the Joiner-Mover-Leaver Process? It manages the user lifecycle. #### Joiner A new employee. #### Mover An employee whose role changes. #### Leaver An employee leaving the organization. ### When Should a Leaver's Database Access Be Closed? It must be removed quickly as part of the departure process, in line with organizational policy and risk level. ### If the User Is Only Deleted from AD, Do Their Database Privileges Go Too? Not always. A local account or separate credentials can exist inside the database. For this reason database access must be checked separately. ### What Is a Dormant Account? It is an account that has not been used for a long time. ### Why Is a Dormant Account Risky? Its owner may have forgotten the account exists. If the credential is compromised, the attacker can use it undetected for a long time. ### Should Last Login Be Tracked? Yes. Accounts unused for a long time can be assessed within the access review. ### Should a Disabled Account Be Deleted? Deleting it immediately can affect audit or recovery needs. A disable, retention and deletion process can be established in line with organizational policy. ### Database Local Account or Central Identity? A central identity; lifecycle, MFA, access review can provide advantages in these areas. However, the need for independent recovery must also be taken into account. ### Can Active Directory Be Used for Database Authentication? Yes. On some platforms Windows/AD authentication can be used. This provides centralized identity. ### Does an AD Compromise Affect the Database? Yes. If the database relies entirely on AD identity, a Domain Admin compromise can turn into a database risk. ### Should the Database Admin Be a Domain Admin? Generally no. These two highly privileged roles must be kept apart. ### Should a Domain Admin Automatically Be Privileged on the Database? As far as possible, such broad trust relationships must be restricted. ### Why Might a Local Emergency Database Account Be Kept? If AD or the identity provider is unreachable it can be used for recovery. However, strict protection is required. ### Where Is MFA Used in Database Authorization? MFA can be applied particularly before administrator access. This can be at the DBMS, PAM, bastion or SSO layer. ### What Is Phishing-Resistant MFA? They are stronger authentication methods against phishing attacks. For example, hardware security keys or modern passkey-based methods can be used. ### Is SMS MFA Enough for a DBA? Where possible, stronger phishing-resistant methods can be preferred. ### Does MFA Replace Authorization? No. MFA only strengthens the verification of the user's identity. What the user can do is determined by RBAC and the permission system. ### Should Database Access Also Be Restricted at the Network Level? Yes. Even an authorized user can connect only from a specific management network. ### Should the DBA Connect to the Database Directly from a Home Computer? On critical systems, instead of direct access; VPN, ZTNA, PAW, bastion, PAM controlled mechanisms such as these can be preferred. ### What Is a PAW? A Privileged Access Workstation is a secure device set aside for highly privileged management operations. ### What Should the DBA Not Do on the PAW? E-mail, internet browsing, personal applications risky activities such as these must not be performed. ### How Is a Bastion Host Used in Database Access? The DBA first connects to the secure bastion. The database permits management connections only from the bastion IP. ### What Is Database Privileged Session Monitoring? It is the monitoring of the operations performed by highly privileged users. ### What Can Privileged Session Monitoring Record? Login time, source IP, session duration, executed queries, changed objects information such as this can be recorded. ### Should the DBA's SELECT Queries Be Monitored Too? In environments containing sensitive data, yes. The DBA having technical privileges does not make reading every piece of data outside a business purpose legitimate. ### Should Sensitive Table Access Be Monitored? Yes. For example; Customer_PII, Salary, Payment_Data access to these tables can be classified as a high-risk event. ### What Is a Bulk SELECT? It is a very large number of records being read in a short time. This can be normal reporting or it can be an indicator of data exfiltration. ### Should the Database Export Privilege Be Restricted? Yes. Export, dump or bulk extract privileges are high-risk. ### Who Should Have Access to Database Backups? Backup data can contain a full copy of the production database. For this reason access to the backup repository can be even more sensitive than database access. ### Can the Backup Administrator Read the Database Data? It depends on the architecture. However, the backup role must not be able to read application data unnecessarily. ### Is the Database Restore Privilege Risky? Yes. A user can take the data out by restoring a sensitive database onto a different server. For this reason restore operations must be audited. ### Why Is an Alternate Location Restore Sensitive? The production database may be secure. However, if the same backup is restored onto a test server, the data can become uncontrolled. ### Which Privilege Changes Should Be Monitored in Database Audit Logs? For example: GRANT REVOKE Role Assignment Admin Creation User Creation Permission Change can be logged. ### What Is Privilege Escalation? It is a user reaching a higher privilege than they hold. ### How Is Database Privilege Escalation Prevented? From a defence perspective; minimum permissions, secure role design, patching, stored procedure review, audit must be applied. ### Why Is GRANT OPTION Sensitive? It can enable a user to pass their own privilege to someone else. For this reason it must be controlled. ### What Is Role Inheritance? It is the privileges granted to a role passing automatically to sub-roles or to the user. In complex role hierarchies unexpected privileges can arise. ### What Is an Effective Permission? It is the sum of all the real privileges a user holds coming from different roles and grants. ### Why Must Effective Permission Analysis Be Done? A user may not appear to be a DBA directly. However, they can hold high privileges indirectly through several different roles. ### What Is a Toxic Permission Combination? It is privileges that look normal individually creating high risk when used together. For example; user create role grant these privileges can create privilege escalation potential. ### What Is Permission Analytics? It is the analysis of users' real access rights. In large structures in particular, entitlement management solutions can be used. ### What Is Database Identity Governance? It expresses database users and privileges being managed in line with policy throughout their lifecycle. ### What Does Identity Governance Cover? Access request, approval, provisioning, access review, recertification, deprovisioning it covers these processes. ### What Is Access Provisioning? It is granting the approved access to the user. ### What Is Deprovisioning? It is removing the privilege when the access need ends. ### Is Manual Provisioning Risky? When there are many databases, human error can occur. Automation and central identity governance can be evaluated. ### Why Should Temporary Access Be Preferred? It prevents project-specific access from remaining open indefinitely. ### What Is Access Expiration? It is access ending automatically on a defined date. ### How Should Database Emergency Access Be Audited? When emergency access is used; an alarm, a ticket, session recording, a post-review can be carried out. ### What Is a Post-Access Review? It is the re-examination of the operations performed after a critical privileged session. ### Should Database Access Logs Be Sent to SIEM? On critical systems, yes. ### Which Database Access Events Can SIEM Monitor? For example: Multiple Failed DBA Login New Privileged User Created Unexpected Role Grant DBA Login Outside Working Hours Bulk Sensitive Data Access Dormant Account Login Break-Glass Account Used ### Can Impossible Travel Be Used for Databases? If it is supported by a central identity, the same privileged user connecting from very different locations in a short time can be assessed as an anomaly. ### Can UEBA Be Used for Database Access? Yes. User and Entity Behavior Analytics can analyse deviations from normal user behaviour. ### What Can Database Anomaly Detection See? For example, if a DBA who normally runs 20 queries a day is exporting millions of records at 03:00, an anomaly can be generated. ### The Relationship Between Database Access and DAM DAM complements the authorization system by monitoring the real activity on the database. ### If There Is RBAC, Is DAM Necessary? In critical structures the two serve different purposes. RBAC: #### What can you do? DAM: #### What did you actually do? each answers its own question. ### Can Database Access and DLP Be Used Together? Yes. Sensitive data leaving the database later leaking through e-mail, endpoints or the cloud can be monitored with DLP. ### What Is Zero Trust Database Access? It is the approach of no user or network being considered trusted by default. ### How Can Zero Trust Be Applied to Databases? For example: Identity Verification ↓ MFA ↓ Device Trust ↓ PAM Approval ↓ JIT Access ↓ Database RBAC ↓ Continuous Monitoring it can be applied along these lines. ### Is the “I Am Inside the Network, Therefore I Am Trusted” Approach Correct? No. A device on the internal network can be compromised too. ### What Is a Database Access Policy? It defines the rules under which database access will be granted. ### What Should a Database Access Policy Include? For example; access request, approval, the role model, privileged access, MFA, review frequency, the termination process, emergency access can be defined. ### Should the Production Database Access Policy Be Stricter? Yes. Development and production do not carry the same risk level. ### Is Non-Production Database Security Unimportant? No. Real data can be present, or it can be used to reach production credentials. ### How Should Production Data Be Protected in the Test Environment? Masking, tokenization, anonymization can be applied. ### Does Data Masking Complement Authorization? Yes. It may be a table the user needs to reach, but they may not need to see the sensitive columns at their real values. ### Database Access and KVKK Access to personal data must be restricted to only the people authorized by their duties. For this reason access control is an important part of database security and of data protection processes. ### Why Is Logging Important from a KVKK Perspective? It supports the ability to investigate who reached personal data. ### Database Authorization from an ISO/IEC 27001 Perspective In the ISO/IEC 27001 approach, identity management, authentication, access rights and privileged access must be managed on a risk basis. Database RBAC, access review and PAM processes support this approach. ### Database Access from a PCI DSS Perspective In a card data environment the need-to-know and least privilege principles carry critical importance. Privileged access must be monitored separately. ### What Is an Access Control Matrix? It is the matrix showing which role holds which privilege on which database or table. Example: | Role | Customer DB | Finance DB | HR DB | Privilege | | --- | --- | --- | --- | --- | | Sales | Yes | No | No | Read | | Finance | Limited | Yes | No | Read/Write | | HR | No | No | Yes | Read/Write | | DBA | Technical | Technical | Technical | Admin | In real organizations the matrix can be far more detailed. ### Database Access Review Checklist In the periodic review these questions can be asked: Is the user still with the organization? Has their role changed? Do they still need this database? Is the role correct? Is privileged access necessary? When was the last login? Is there a shared account? Is there a dormant account? Is the service account owner known? Is MFA active? ### Privileged Database Access Checklist - Personal DBA account - MFA - PAM - JIT access - Session recording - Access approval - Network restriction - PAW/Bastion - Audit logging - SIEM monitoring - Periodic recertification - Break-glass control ### Service Account Security Checklist - A separate account for every application - Minimum permissions - Interactive login disabled - Secret vault - Password rotation - Owner defined - Usage monitored - Unused accounts removed - Network source restricted - Audit enabled ### How Is Database Access Maturity Measured? Sample levels: #### Level 1 – Uncontrolled Shared accounts and broad privileges are used. #### Level 2 – Basic Personal accounts and some roles exist. #### Level 3 – Standard RBAC, approval and access review are applied. #### Level 4 – Controlled PAM, MFA, JIT and central audit are used. #### Level 5 – Dynamic A risk-based, automated and continuously verified Zero Trust access model is applied. ### KPIs in Database Authorization For example: Privileged Account Count Shared Account Count Dormant Account Count MFA Coverage PAM Coverage Access Review Completion Expired Access Count Orphan Service Account Count ### What Is MFA Coverage? It shows on how many of the privileged database accounts MFA is applied. ### What Is PAM Coverage? It shows how many of the privileged accounts are managed through PAM. ### What Is the Access Review Completion Rate? It is the rate at which planned access reviews are completed on time. ### What Should the Shared Account Target Be? In critical environments it must be brought as close to zero as possible. ### The Most Common Mistakes in Database Authorization The mistakes frequently seen in organizations are as follows: - Using a shared DBA account - Giving DBA to the application user - Giving developers permanent production access - Granting broad SELECT privileges to every user - Leaving former employees' accounts open - Granting permissions user by user instead of through roles - Not determining the service account owner - Keeping database passwords in the source code - Not using MFA - Not using PAM - Leaving privileges open indefinitely - Not performing access reviews - Using the break-glass account daily - Not auditing DBA activity - Not controlling backup and restore privileges ### Database Access Questions Management Should Ask Senior management and IT leaders must be able to get answers to these questions: How many DBA accounts do we have? How many of them are personal? Is there a shared account? How many of our application accounts are highly privileged? Is there MFA on the privileged accounts? Is PAM in use? When was the last access review performed? Within what time is the database access of a departing person closed? If a DBA reads sensitive customer data, can we detect it? These questions reveal the real access control maturity level. ### Frequently Asked Questions #### What is database RBAC? It is managing user privileges through roles. #### What is Least Privilege? It is granting the user only the minimum privilege needed to do their job. #### Should the DBA account be shared? No. Personal privileged accounts are far safer from an audit perspective. #### Can the application user be a DBA? In most cases it must not be. The application must reach only the objects it needs. #### Is PAM necessary for databases? In critical and highly privileged environments PAM provides a serious security advantage. #### What is JIT database access? It is granting the user temporary database access only for the period they need. #### Should developers reach the production database? By default, permanent broad access must not be granted. Where needed, controlled, temporary and audited access can be provided. #### How should a service account be protected? Minimum privilege, a secret vault, rotation, network restriction and monitoring must be used. #### What is an access review? It is the periodic check of whether users' existing database privileges are still necessary. #### Should database admin activity be monitored? Yes. Privileged operations must be audited and, on critical systems, monitored centrally. ### Conclusion: The Most Critical Control in Database Security Is the Right Privilege Database security is most often discussed through; firewalls, encryption, backup, patching as the topics. However, one of the most critical security layers of a strong database system is: **access control.** Because even a fully encrypted, up-to-date database behind the most secure network is at risk if the wrong privilege has been given to the wrong user. For this reason organizations need to adopt these principles: **Every user must be personal.** **Every access must have a business justification.** **Every user must hold minimum privilege.** **Privileged accounts must be protected additionally.** **Privileges must not be left open forever.** **All critical operations must be audited.** The modern database access model must be thought of as follows: #### Identity ↓ #### Strong Authentication ↓ #### Approval ↓ #### PAM / JIT ↓ #### RBAC ↓ #### Least Privilege ↓ #### Continuous Monitoring This approach provides strong protection not only against external attackers but also against; insider threat, credential compromise, human error and privilege abuse these risks. The most critical security question is not: **“Can this user reach the database?”** but instead; **“Exactly which data, for what reason, with which privilege and for how long can this user reach?”** this question. Real database access security is being able to answer this question clearly for every user.