# How Is a Corporate Database Security Policy Built? ISO 27001, KVKK and Regulations **URL:** https://securesys.com.tr/en/learning/database-security/enterprise-database-security-policy ![How Is a Corporate Database Security Policy Built? ISO 27001, KVKK and Regulations](/images/bilgi-merkezi/covers/cover-veritabani-12.webp) Database security is not only the concern of technical teams. In an organization, database security is the shared responsibility of; information security, IT operations, software development, legal, risk management, internal audit, business continuity and senior management. Because inside a database there are not only technical records. The organization's; customer information, personnel data, financial records, trade secrets, identity information, transaction histories, critical operational data are stored in the databases. For this reason database security cannot be limited to only: **“Is the firewall on?”** or **“Is the DBA password strong?”** these questions. The corporate approach must answer these questions: How many databases are there? Which of them are critical? Which data is sensitive? Who can reach it? Which accounts are privileged? Is there encryption? Is audit active? Can a backup be taken? Has the restore been tested? Is the patch level current? Are cloud databases included? Is third-party access controlled? Is it known what will be done when an incident occurs? All of these questions must be made systematic within the: #### Corporate Database Security Policy as its framework. ### What Is a Database Security Policy? A Database Security Policy is the policy document determining with which security principles, technical controls and governance rules the organization will protect its databases. This policy must not be aimed only at the DBA team. It must at the same time define the responsibilities of the; application owner, security team, system administrator, developer, internal audit, business owner roles. ### Why Is a Database Security Policy Necessary? Where there is no policy, security can turn into personal preference. One DBA turns TLS on. Another does not. One team uses audit. Another team turns it off. One database takes a daily backup. Another takes a weekly one. As a result an inconsistent security level forms across the organization. ### What Is the Core Purpose of the Policy? The purpose is to establish a minimum database security standard. For example: **“All critical production databases must be brought into the scope of encryption, audit, backup, access control and patch management.”** rules such as this can be defined. ### What Is the Difference Between a Database Security Policy and a Procedure? Policy: #### what will be done and which principles apply is what it defines. Procedure: #### how it will be done is what it defines. ### Example Policy: Privileged database access must be performed with personal accounts. Procedure: An access request is opened through PAM, manager approval is obtained and JIT access is provided. ### What Is a Standard? They are the mandatory requirements detailing the policy technically. For example: The database must use TLS. A minimum audit event list must be defined. The production database must not be exposed to the public internet. ### What Is a Guideline? They are the non-mandatory but recommended practices. ### What Is Database Security Governance? It is the management of database security with roles, processes, controls and reporting mechanisms. ### Why Is Database Security Governance Important? Because a technical control can be set up once. However, without governance, over time; new users are added, privileges grow, patches are delayed, audit is turned off, backups fail. For this reason security must be managed continuously. ### The First Step: Database Inventory The biggest risk is not the system you do not trust but the system you do not know about. For this reason the first step is: **creating a database inventory** as the foundation. ### What Should the Database Inventory Include? For example: Database Name Platform Version Server Environment Owner Business Service Criticality Data Classification Backup Status Encryption Status Audit Status ### Why Must a Database Owner Be Defined? The technical and business owner of every database must be known. On ownerless databases, access review and risk decisions become difficult. ### Who Is the Technical Owner? It is the team or person responsible for the database operations. ### Who Is the Business Owner? It is the person carrying business responsibility for the data inside the database. ### What Is a Data Owner? It is the business role able to decide for what purpose the data is used and who should reach it. ### Are the Database Owner and the Data Owner the Same? Not always. The DBA can manage the system. However, the business unit must decide who should see the customer data. ### What Is a Shadow Database? It is a database system running outside the official inventory. ### Why Is a Shadow Database Risky? This system; backup, patch, audit, security monitoring can remain outside the scope of these. ### Should Database Discovery Be Done Continuously? Yes. New database instances in the network and cloud environment can be detected periodically. ### What Is Database Criticality Classification? It is the classification of databases according to business impact. ### Sample Criticality Levels Tier 1 – Critical Tier 2 – High Tier 3 – Medium Tier 4 – Low ### What Is Criticality For? It determines the priority of security and recovery controls. ### What Is Expected for a Tier 1 Database? For example; high availability, a low RPO, audit, encryption, DAM, immutable backup can be mandatory. ### What Is Data Classification? It is the classification of the data inside the database according to its sensitivity. ### Sample Data Classification Public Internal Confidential Restricted ### What Is Restricted Data? It is the data class with the highest sensitivity. For example; identity, finance, health, credential data can be brought into this scope. ### How Does Data Classification Affect Database Security? The more sensitive the data; encryption, audit, access control, monitoring the level of these can be raised. ### Access Control in the Database Security Policy Access control is one of the most critical sections of the policy. ### What Is the Core Access Control Principle? #### Need-to-Know + Least Privilege ### What Is Need-to-Know? It is the user reaching only the data they genuinely need for their job. ### What Is Least Privilege? It is the user holding only the necessary minimum privilege. ### Role-Based Access Control – RBAC It is database permissions being managed by business role rather than granted to people one by one. ### How Should RBAC Be Defined in the Policy? For example: Developer → Development database Support → Limited production read DBA → Administrative access Auditor → Audit read ### What Is a Privileged Access Policy? It determines how highly privileged accounts such as DBA, SYS, sysadmin or superuser will be managed. ### What Can Be Mandatory for Privileged Accounts? MFA PAM JIT Session Recording Personal Account Approval ### Should Shared DBA Accounts Be Banned? In critical production environments personal accounts must be preferred. ### What Is a Break-Glass Account Policy? They are the rules of use for the highly privileged account to be used in an emergency. ### How Should the Break-Glass Account Be Managed? It must be strongly protected. It must not normally be used. Its use must generate an alert. A review must be carried out afterwards. ### Should the Joiner-Mover-Leaver Process Be Applied to Databases? Yes. A new employee arrives. The role changes. They leave the organization. Database permissions must be updated accordingly. ### How Often Should an Access Review Be Performed? It must be done periodically according to criticality. For example, privileged accounts can be reviewed more frequently. ### What Is Access Recertification? It is the data owner or manager re-approving the existing privileges. ### What Is a Dormant Account Policy? It is accounts unused for a long time being disabled or reviewed. ### What Is a Service Account Policy? It determines how application and service accounts will be created and managed. ### Mandatory Controls for Service Accounts Dedicated account Minimum permission Secret vault Credential rotation No interactive login Owner assignment ### Should a Service Account Have an Owner? Yes. An ownerless service account turns into an orphan account over time. ### What Is an Orphan Account? It is an account for which it is no longer known which application or team uses it. ### Why Is an Orphan Account Risky? Because nobody dares to disable it, it can stay active for years. ### Database Authentication Policy The authentication method must be standardized too. ### Should Password Authentication Be Used Everywhere? No. In appropriate environments a central identity, certificate or federated authentication can be used. ### How Is MFA Applied to Databases? It can be applied directly on the database engine or through the PAM/SSO layer. ### What Should the Password Policy Include? For example: Minimum strength No sharing Rotation where appropriate Secure storage Compromise response ### Is Password Rotation Enough on Its Own? No. Strong authentication and access monitoring are also required. ### Should Hard-Coded Database Passwords Be Banned? Yes. Database credentials must not be kept inside source code. ### Secret Management Policy It must be defined that credentials and secrets are kept in secure systems such as; a vault, a secret manager, a KMS as the storage. ### Connection String Security If there is a password inside the application connection string it must be kept in a secure configuration mechanism. ### Network Security Policy Database network access must not be open and uncontrolled. ### Should the Production Database Be Exposed to the Public Internet? If there is no business need, no. ### What Is Network Segmentation? It is database systems being separated in a controlled way from the application, user and management networks. ### Can a Database VLAN Be Used? Yes. ### What Should the Firewall Rules Be Like? An allow-list approach must be preferred. ### What Is an Allow-List? It is only the necessary sources being able to reach the database. ### What Should Management Access Be Like? VPN, ZTNA, PAM, bastion controlled access methods such as these can be used. ### Should There Be Direct Database Access from the DBA's Laptop? On critical systems, using a dedicated management environment or PAM can be safer. ### What Does Zero Trust Mean for a Database? Being inside the network does not mean automatic trust. Every connection; identity, device, authorization must be verified with these. ### Database Encryption Policy The database security policy must define which data needs to be encrypted. ### Encryption Layers Encryption at Rest Encryption in Transit TDE Column-Level Encryption Backup Encryption ### Should TLS Be Mandatory? For critical production database connections, secure transport must be used. ### What Should the TDE Policy Be? For sensitive data files, at-rest encryption can be applied on a risk basis. ### Does TDE Replace Access Control? No. ### Sensitive Column Encryption Policy Very sensitive data fields can be kept under additional encryption. ### What Is a Key Management Policy? It defines the encryption key lifecycle. ### What Should the Key Management Policy Include? Key creation Storage Access Rotation Backup Recovery Revocation Destruction ### When Should a KMS/HSM Be Used? It can be used in the central and controlled management of critical cryptographic keys. ### Should the Key Administrator Be Separate from the DBA? On critical systems it can be evaluated in terms of Separation of Duties. ### Database Audit Policy Audit must be one of the mandatory sections of the policy. ### What Can the Minimum Audit Events Be? Login Failed Login User Creation Role Change Privilege Grant DDL Sensitive Data Access Backup/Restore Audit Change ### Should Every Query Be Logged? No. Risk-based logging must be used. ### Should Privileged Activity Be Audited? Yes. ### Where Should the Audit Log Be Kept? Critical logs must be transferred to a central system. ### SIEM Integration Policy Database security events can be sent to SIEM. ### Which Database Events Should Be Sent to SIEM as a Priority? Privileged login Failed login spike Sensitive data bulk read New admin Mass delete Audit disabled ### What Is a DAM Policy? It defines the Database Activity Monitoring scope and the detection use cases. ### On Which Databases Can DAM Be Mandatory? It can be used on databases holding critical or restricted data. ### Should DAM Use Cases Be Defined Within the Policy? Yes. ### A Sample DAM Use Case A privileged user performing a bulk SELECT on a sensitive table. ### Database Backup Policy Backup requirements must be defined for every database. ### What Should the Backup Policy Include? Backup frequency Retention Encryption Immutability Offsite copy Restore test ### Should the RPO Be in the Policy? Yes. The acceptable data loss of critical databases must be defined. ### Should the RTO Be in the Policy? Yes. The recovery time must be determined according to the business requirement. ### Should the Backup Be Immutable? On critical systems it can be evaluated against ransomware risk. ### Should Backup Encryption Be Mandatory? On sensitive database backups, encryption must be applied strongly. ### What Is a Restore Test Policy? It makes it mandatory for backups to be verified with a real restore at defined intervals. ### Is a Successful Backup Log Enough? No. ### PITR Policy On transaction-critical databases the point-in-time recovery capability can be defined. ### PostgreSQL WAL It can be used for PITR. ### MSSQL Transaction Log It can be used for PITR. ### Oracle Archive Log It is the core part of the recovery chain. ### Disaster Recovery Policy It defines how critical databases will be brought up in an alternative environment. ### What Should the DR Policy Include? Primary Site DR Site Replication RPO RTO Failover Failback Testing ### Are HA and DR the Same? No. HA can focus on local or node failure. DR covers larger disaster scenarios. ### Database Patch Management Policy It defines how database version and patch levels will be managed. ### What Should the Patch Policy Include? Inventory Vendor advisory monitoring Risk assessment Patch SLA Testing Change management Validation ### Can an Unsupported Database Be Used? It must not be used without an exception process. ### What Should Be Done for an EOL Database? An upgrade or migration plan must be created. ### What Is a Patch SLA? It is the patch application period according to the vulnerability severity. ### Should There Be an Emergency Patch Process? Yes. ### Database Vulnerability Management Policy It ensures databases go through a regular security assessment. ### What Does a Vulnerability Assessment Cover? Version Configuration Exposure Weak authentication Excessive privilege Missing patch ### Should a Database Penetration Test Be Performed? In line with scope and risk, application-database interaction and external exposure tests can be performed. ### Are a Database Security Assessment and a Pentest the Same? No. An assessment examines configuration and governance more. A pentest tests exploitability and exposure. ### Secure Configuration Baseline A technical hardening standard must be created for each database technology. ### PostgreSQL Baseline pg_hba.conf roles TLS logging extensions OS permission it can include items such as these. ### MSSQL Baseline sa sysadmin Windows Authentication service account TDE SQL Server Audit advanced features it can include headings such as these. ### Oracle Baseline SYS/SYSDBA listener profiles PUBLIC privileges TDE Unified Auditing it can include controls such as these. ### Can the CIS Benchmark Be Used? On suitable database platforms it can be used as a reference when creating the security baseline. ### Should the Vendor Security Guide Be Used? Yes. The platform vendor's security guidance must be taken into account too. ### Configuration Drift Policy Deviation of the database configuration from the approved baseline must be monitored. ### Why Does Configuration Drift Occur? An emergency change. A manual admin action. An upgrade. A new feature. ### Can Drift Detection Be Automated? Yes. ### Database Change Management Policy Production database changes must be made in a controlled way. ### Which Changes Should Fall Within the Change Scope? Schema changes Patch Role changes Configuration Major maintenance ### What Is an Emergency Change? It is an accelerated change because of an urgent incident or a critical vulnerability. ### Does Change Approval Slow Security Down? If designed correctly, no. It ensures risky changes are made in a controlled way. ### Database Dev/Test/Prod Separation Environment separation is one of the core principles of database security. ### Should Developers Reach the Production Database? Only if there is a business need, controlled and temporary access must be provided. ### Should Production Data Be Copied to the Test Environment? As far as possible, masked or anonymized data must be used. ### Data Masking Policy It defines the hiding of sensitive production data on dev/test systems. ### What Is Static Data Masking? It is production data being permanently masked before being copied. ### What Is Dynamic Data Masking? It is the data the user sees being masked according to their privilege. ### Does Masking Replace Encryption? No. ### Database Secure Development Policy Developers need to use secure database access methods. ### SQL Injection Policy Parameterized Query can be made mandatory. ### Should Prepared Statements Be Used? Yes. ### Dynamic SQL Policy Unnecessary dynamic SQL must be restricted and reviewed. ### ORM Security Using an ORM does not provide automatic security. Raw SQL must be reviewed. ### Application Database Account Policy The application account must run with minimum permissions. ### Can the Application Be a DBA? Without an exceptional requirement, no. ### Third-Party Database Access Policy Vendor and consultant access must be managed in a controlled way. ### What Should There Be for Third-Party Access? Named account Time-limited access Approval PAM Logging ### Can a Vendor Use a Shared Account? As far as possible, no. ### Should Third-Party Access Expire Automatically? Yes. Temporary access can be removed at the end of the period. ### How Should Remote Vendor Access Be Done? Through a controlled VPN/ZTNA/PAM. ### Should Third-Party Session Recording Be Done? In critical environments it can be evaluated. ### Database Outsourcing Risk Using a managed service does not eliminate the security responsibility. ### Cloud Database Security Policy Cloud managed databases must also be brought into the scope of the central policy. ### Is a Cloud Database Inventory Necessary? Yes. ### Should Public Cloud Database Exposure Be Checked? Absolutely. ### What Is a Cloud Security Group? It is the cloud firewall mechanism limiting network access to the database. ### Should a Private Endpoint Be Used? On suitable services, private connectivity can be preferred over public exposure. ### Is Cloud IAM Part of Database Security? Yes. ### Cloud Database Encryption A provider-managed key or a customer-managed key can be used. ### Cloud Backup Policy Automated backups; retention, encryption, cross-region, cross-account must be assessed in these respects. ### What Is the Shared Responsibility Model? The cloud provider is responsible for some parts of the infrastructure. The customer, meanwhile; identity, configuration, data, access can be responsible for areas such as these. ### Database Security Incident Response Policy What will be done when a database security incident occurs must be defined in advance. ### Database Security Incident Examples Unauthorized login Mass data extraction Privilege escalation Database ransomware Data corruption Backup deletion ### The Incident Response Flow Detection ↓ Triage ↓ Containment ↓ Investigation ↓ Eradication ↓ Recovery ↓ Lessons Learned ### What Is the First Thing to Do in a Database Incident? It varies according to the type of event. However, random changes must not be made without preserving the evidence. ### Are Audit Logs Critical in an Incident? Yes. ### Database Forensics Policy It defines the secure preservation of log and transaction information. ### Why Should Time Synchronization Be in the Policy? For the incident timeline the systems need to use a common clock. ### Database Security Event Classification Events can be divided into severity levels. ### Sample Severity Critical High Medium Low ### Critical Database Event Examples Audit Disabled New Superuser Mass Delete Sensitive Data Export Backup Deleted ### Database Security Exception Management Not every system can fully comply with the policy. In that case there must be a formal exception process. ### What Should the Exception Include? Reason Risk Compensating Controls Owner Expiry Date ### Should There Be a Permanent Exception? As far as possible, no. ### What Is a Compensating Control? It is the alternative control reducing the risk when the main control cannot be applied. ### Example A legacy database does not support TLS. Compensating controls: Isolated network IP allow-list VPN Migration plan ### Why Is Exception Expiry Important? It prevents temporary exceptions from becoming permanent. ### Database Security Risk Assessment Every database must be assessed on a risk basis. ### Risk Factors Internet Exposure Data Sensitivity Privilege Level Version Backup Status Audit Coverage ### Can a Database Risk Score Be Created? Yes. ### A Sample Risk Score Critical Data: +30 Public Exposure: +30 Unsupported Version: +20 No Audit: +10 No Encryption: +10 Total: 100/100 high risk. ### What Is a Database Security KPI? They are the indicators measuring the performance of the security programme. ### Sample Database Security KPIs Asset Inventory Coverage Patch Compliance Audit Coverage Encryption Coverage Privileged Access Review Completion Backup Success Restore Test Success DAM Coverage ### What Should the Inventory Coverage Target Be? The ideal target: #### 100% ### What Is the Critical Database Audit Coverage Target? On critical systems, as far as possible: #### 100% ### The Unsupported Database Count? Target: **0** ### The Restore Test Success Rate? On critical databases, as far as possible: #### 100% ### What Is a Database Security KRI? A Key Risk Indicator shows the risk level. ### Sample KRI Public database count EOL database count Unreviewed privileged accounts Failed backups ### What Is the Difference Between a KPI and a KRI? A KPI measures process performance. A KRI shows the risk level. ### Database Security Dashboard A dashboard can be created for senior management. ### What Should the Dashboard Show? Total Databases Critical Databases High-Risk Findings Patch Compliance Encryption Coverage Audit Coverage Backup Health ### Should the Dashboard Show SQL Detail? For senior management, mostly no. Risk and trends must be shown. ### What Is a Database Security RACI? It shows the distribution of responsibility across the roles. ### Sample RACI Roles DBA Security Application Owner Data Owner SOC Internal Audit ### The DBA's Responsibilities Hardening Maintenance Backup operations Performance ### Security Team Responsibilities Security baseline Monitoring Risk assessment Incident response ### Data Owner Responsibilities Determining who should reach the data. ### Application Owner Responsibilities The application account and secure database access. ### SOC Responsibilities Monitoring database security alerts. ### Internal Audit Responsibilities Independently assessing policy and control effectiveness. ### Why Is Separation of Duties Important for Governance? One person holding all the; granting access, using it, auditing it privileges is risky. ### Database Security Training DBAs and developers must receive regular security training. ### DBA Security Training Topics Least Privilege Hardening Encryption Audit Backup Security Incident Response ### Developer Training Topics SQL Injection Parameterized Query Secret Management ORM Security Database Access Control ### SOC Training Topics Database logs DAM Data Exfiltration Privileged Activity ### Database Security Documentation Critical configurations must be documented. ### What Should the Documentation Include? Architecture Owner Backup RPO/RTO Access model DR ### Should Credentials Be Written in the Document? No. A vault reference must be used. ### How Often Should the Database Security Policy Be Reviewed? At least periodically and after significant changes. ### In Which Events Can a Policy Review Be Needed? A major breach A new regulation A new database platform A cloud migration A major architecture change ### ISO/IEC 27001 and Database Security ISO/IEC 27001 is not a product-based technical guide saying directly “the database must be configured this way”. It provides a risk-based information security management system approach. From a database security perspective, a relationship can be established with areas such as; access control, privileged access, cryptography, logging, backup, vulnerability management, incident management, business continuity as its scope. ### How Does a Database Policy Support ISO 27001? It makes the process of database security controls being; defined, applied, measured, reviewed systematic. ### Does an ISO 27001 Certificate Guarantee the Database Is Secure? No. The certificate shows that the management system meets certain requirements. The effectiveness of the technical controls must be assessed separately. ### KVKK and Database Security Because the greater part of personal data is held in database systems, database security carries critical importance from the perspective of the data security approach within KVKK's scope. ### Which Database Controls Matter for KVKK? On a risk basis; Access Control Authorization Encryption Logging Backup Monitoring Data Minimization can be assessed. ### Is Database Encryption Enough for KVKK? No. ### Why Is Audit Important for KVKK? It supports the ability to investigate who reached personal data. ### What Is Data Minimization? It is not keeping personal data that is not necessary for the business purpose. ### How Can Database Data Minimization Be Applied? Not collecting unnecessary columns. Deleting data after retention. Not using real data on test systems. ### Why Is a Retention Policy Important for Databases? Data must not be kept longer than necessary. ### Should Database Retention and Backup Retention Be Consistent? Yes. If data deleted from production stays in the backup for years, the lifecycle must be assessed separately. ### What Is Secure Data Deletion? It is making the data unreachable by an appropriate method when the retention ends. ### Is a Database Row DELETE Always a Physical Deletion? No. Copies can exist in storage and backup systems. For this reason the data lifecycle must be managed holistically. ### Why Is a Database Inventory Important for KVKK Compliance? Without knowing in which systems personal data is held, providing effective data security is difficult. ### PCI DSS and Database Security On databases processing payment card data; strong access control, encryption, logging, monitoring, segmentation controls such as these are particularly important. ### DORA and Database Resilience For financial institutions, within the scope of operational resilience and ICT risk management, databases'; availability, backup, recovery, monitoring capabilities matter. ### If the Regulation Changes, Should the Policy Be Updated? Yes. ### Are Compliance and Security the Same? No. Compliance can meet the minimum requirements. Security must focus on reducing real risks. ### What Is Checkbox Compliance? It is the control being applied only on paper to pass an audit. ### A Checkbox Compliance Example Audit is on. But nobody monitors the logs. Technically the control exists. In reality there is no detection. ### What Is an Effective Control? It is the control genuinely reducing the risk. ### How Should a Database Security Audit Be Performed? Periodically; inventory, configuration, access, audit, backup, patch can be checked. ### Are an Internal Audit and a Technical Assessment the Same? No. An internal audit assesses governance and control effectiveness. A technical assessment goes down to the configuration level. ### What Is a Database Security GAP Analysis? It is the identification of the difference between the current state and the target security standard. ### GAP Analysis Stages Inventory ↓ Assessment ↓ Risk Scoring ↓ Remediation Plan ↓ Validation ### What Is a Remediation Plan? It ensures security findings are closed with an; owner, deadline, priority as their attributes. ### A Database Security Finding Example Finding: The production database is exposed to the public internet. Risk: Unauthorized access. Action: Private network migration. Owner: Infrastructure Team. Due Date: 30 days. ### How Should Finding Closure Be Verified? The owner must not merely say “I closed it”. A technical validation must be performed. ### The Database Security Maturity Model #### Level 1 – Ad Hoc Database security depends on individuals' knowledge. #### Level 2 – Documented Basic policy and procedures exist. #### Level 3 – Standardized A security baseline is applied across all database platforms. #### Level 4 – Monitored There is continuous monitoring with SIEM, DAM and KPIs. #### Level 5 – Risk-Driven & Automated Discovery, compliance, monitoring and response have largely become automated. ### What Does a Level 1 Organization Look Like? The database list is not fully known. There is a shared DBA account. Backup checking is done manually. Patching is irregular. ### What Does a Level 3 Organization Look Like? The inventory is complete. A baseline exists. Access reviews are performed. Backup and patch processes are standard. ### What Does a Level 5 Organization Look Like? A new database is discovered automatically. Policy violations are detected automatically. Privileged activity is monitored in real time. There is response automation. ### How Is a Database Security Roadmap Created? The organization does not have to do everything at once. A risk-based roadmap can be created. ### The First 30 Days Database inventory Criticality Privileged account inventory Public exposure review ### The First 60 Days Security baseline Access review Backup validation Patch review ### The First 90 Days SIEM integration DAM use cases Encryption review Restore testing ### The Next Stage Automation Continuous compliance Behavior analytics SOAR integration ### Sample Main Headings for a Database Security Policy A corporate policy can consist of these headings: - Purpose - Scope - Roles and Responsibilities - Database Inventory - Data Classification - Access Control - Privileged Access - Authentication - Network Security - Encryption - Audit and Logging - DAM - Backup and Recovery - Patch Management - Vulnerability Management - Change Management - Development and Test - Third-Party Access - Cloud Database Security - Incident Response - Compliance - Exception Management - KPIs and Reporting ### Database Security Checklist A corporate checklist: - Are all databases in the inventory? - Is the owner defined? - Is the criticality determined? - Has data classification been done? - Has public exposure been checked? - Is there a shared account? - Is privileged access under PAM? - Is MFA in use? - Is Least Privilege applied? - Is TLS active? - Is there at-rest encryption? - Is the backup encrypted? - Is audit active? - Is there a SIEM integration? - Is DAM active on critical databases? - Is the backup regular? - Has a restore test been performed? - Are the RPO/RTO defined? - Is the patch level current? - Is there an EOL database? - Is a vulnerability assessment performed? - Is third-party access controlled? - Are cloud databases in scope? - Is there an incident response plan? ### 15 Critical Database Security Questions Management Should Ask - How many databases do we have? - Which of them are critical? - Which of them contain personal or sensitive data? - How many are exposed to the internet? - How many privileged accounts are there? - Is there a shared DBA account? - How many databases are encrypted? - On how many is audit active? - How many are under DAM? - On how many is a patch missing? - Is there an unsupported database? - When was our last restore test? - Are we meeting our RPO/RTO targets? - If a DBA reads sensitive data, can we notice it? - In a ransomware attack, can we genuinely bring the database back? If these questions cannot be answered clearly, database security governance must be improved. ### The Most Common Corporate Mistakes in Database Security Mistakes frequently seen in organizations: - Not keeping a database inventory - Assuming security is only the DBA's responsibility - Using a shared administrator account - Not performing access reviews - Granting excessive privileges to application accounts - Exposing the database to the internet - Not using TLS - Neglecting encryption key management - Turning audit on but not monitoring the logs - Seeing DAM merely as a compliance product - Taking backups but not testing the restore - Constantly deferring patches - Using an EOL database - Moving production data to the test environment without control - Leaving third-party access open indefinitely - Assessing cloud databases outside the policy - Not creating an incident response plan - Not producing security KPIs ### How Is a Database Security Programme Measured? A good programme is not measured only by the number of technical findings. Sample indicators: Critical Database Inventory Coverage Privileged Access Review Completion Encryption Coverage Audit Coverage DAM Coverage Patch Compliance Backup Success Rate Restore Test Success Rate Mean Time to Detect Mean Time to Remediate ### If the Security Programme Is Successful, Should the Finding Count Be Zero? No. On realistic systems new findings can emerge. What matters is: **finding them, prioritizing them and closing them on time.** ### What Is Continuous Improvement? It is the database security programme being measured and improved continuously. ### Can PDCA Be Used for Database Security? Yes. Plan Do Check Act this approach can be applied. ### Plan The policy and risk targets are determined. ### Do The security controls are applied. ### Check Audit, KPIs and assessment are performed. ### Act Findings are closed and the process is improved. ### Frequently Asked Questions #### What is a Database Security Policy? It is the policy document determining with which technical and managerial security controls the organization will protect its databases. #### Is database security only the DBA's responsibility? No. Many roles including security, application, data owner, SOC, risk and management carry shared responsibility. #### Does ISO 27001 cover database security? Within risk-based information security management it can be related to areas such as access control, logging, cryptography, backup and vulnerability management. #### Is database encryption mandatory for KVKK? A single technical control does not apply to every situation. Risk-based technical and administrative measures must be assessed together. Encryption is one of the important security controls. #### Is a database audit mandatory? On critical and sensitive systems, being able to trace who performed which operations is a strong security need. #### Should DAM be used on every database? It is not mandatory for every database. It must be prioritized according to criticality and data sensitivity. #### Why is a database backup policy necessary? It standardizes backup frequency, retention, encryption, immutability and restore tests. #### Should RPO and RTO be defined within the policy? For critical systems, yes. #### How often should a database security assessment be performed? It must be done periodically according to the risk level and the organizational policy. #### Do cloud databases fall within the policy scope? Absolutely. Being managed does not eliminate the security responsibility. ### Conclusion: Database Security Is Not a Product but a Process The biggest mistake in corporate database security is reducing security to a single product or a single team. A firewall alone is not sufficient. Encryption alone is not sufficient. PAM alone is not sufficient. DAM alone is not sufficient. Backup alone is not sufficient. Real database security emerges when these controls work together and manageably. For this reason the corporate database security model must be addressed in this structure: #### Inventory ↓ #### Classification ↓ #### Access Control ↓ #### Authentication ↓ #### Hardening ↓ #### Encryption ↓ #### Audit ↓ #### DAM ↓ #### Backup & Recovery ↓ #### Patch & Vulnerability Management ↓ #### Monitoring ↓ #### Incident Response ↓ #### Governance When any link of this chain is missing, the risk grows. The organization must know its databases'; where they are, which data they hold, who reaches them, with which controls they are protected, which version they run, up to which point they can be returned as its knowledge. The most critical change, meanwhile, is this mindset: Database security cannot be managed only with the: **“Let the DBA be careful.”** approach. The process; **policy,** **standards,** **monitoring,** **audit,** #### KPIs and **continuous improvement** must be institutionalized with these. The right goal is: **not person-dependent database security** but instead; **creating measurable and auditable database security governance** as the objective. For this reason a strong organization must always be able to answer this question: **“How secure are our critical databases?”** And it must give this answer: **“I think they are secure.”** not in this form; but with measurable evidence: **100% of critical databases are in the inventory.** **100% of privileged access is under audit.** **100% of critical databases are within the backup scope.** **100% of restore tests are verified.** **Critical patch gaps are closed within the SLA.** **High-risk database activity is monitored in real time.** This is what real corporate database security is.