# PostgreSQL, MSSQL and Oracle Security: Critical Configurations and Differences **URL:** https://securesys.com.tr/en/learning/database-security/postgresql-mssql-and-oracle-security ![PostgreSQL, MSSQL and Oracle Security: Critical Configurations and Differences](/images/bilgi-merkezi/covers/cover-veritabani-09.webp) Using a single database technology in corporate environments is a steadily rarer situation. An organization can use, at the same time; **PostgreSQL,** **Microsoft SQL Server – MSSQL,** #### Oracle Database and different open source or cloud database platforms together. For this reason the database security approach cannot be completed merely by saying: **“Let us make the database secure.”** as the objective. Every platform's; authentication structure, privileged account model, network configuration, audit mechanisms, encryption capabilities, patching approach and operating model differ. Even so, the core principles of security do not change. Whichever DBMS is used; **Least Privilege,** **Secure Configuration,** **Network Segmentation,** **Encryption,** **Audit,** **Patch Management,** #### Backup Security and **Continuous Monitoring** must be applied. For this reason the right database security approach must consist of two layers: #### Vendor-Neutral Security Baseline #### Platform-Specific Hardening The first layer determines the organization-wide minimum security level. The second layer addresses PostgreSQL's, MSSQL's or Oracle's own particular risks and security features. ### Are PostgreSQL, MSSQL and Oracle Security the Same? The core security principles are the same. However, the technical implementation differs. For example: In PostgreSQL; roles, pg_hba.conf, listen_addresses, extensions are critical. In MSSQL; Windows Authentication, SQL Logins, sa, sysadmin, SQL Server Audit, the service account come to the fore. In Oracle, meanwhile; SYS, SYSTEM, the listener, profiles, roles, Unified Auditing, TDE subjects such as these are particularly important. ### What Is Vendor-Neutral Database Security? They are the core security principles that must be applied independently of the platform. For example: - Public database exposure must be minimal - Users must be personal - A shared administrator account must not be used - Least Privilege must be applied - TLS must be used - Critical activity must be audited - The patch level must be current - The backup must be encrypted - Privileged users must be monitored - A configuration baseline must be created These items hold for all three database platforms. ### Why Is Platform-Specific Hardening Necessary? Every DBMS has its own; default configuration, authentication mechanism, network behaviour, extension architecture, administrative privilege model as its characteristics. For this reason a generic checklist alone may not be sufficient. ### What Is PostgreSQL Security? PostgreSQL security covers the; authentication, role management, network restriction, TLS, logging, extension governance, operating system security layers. PostgreSQL is a flexible and powerful database system. However, in the case of a wrong configuration this flexibility can create a security risk. ### The Role Concept in PostgreSQL In PostgreSQL the user and role concepts are quite close to each other. If a role is granted the login capability it can behave like a user able to connect to the database. ### What Is a PostgreSQL Superuser? A superuser is the highly privileged role able to bypass many security controls on PostgreSQL. For this reason its use must be kept minimal. ### Should the Application Be a PostgreSQL Superuser? If it is definitely unnecessary, no. The application must be privileged only on the schema, table or procedure it needs. ### Should the PostgreSQL Superuser Be Personal? Highly privileged access needs to be as personal and auditable as possible. Shared administrator accounts lead to an accountability problem. ### What Is PostgreSQL pg_hba.conf? It is one of the most critical configuration files of PostgreSQL security. **pg_hba.conf determines which client;** to which database, with which user, from which network, with which authentication method can connect. ### Why Is pg_hba.conf So Important? A wrong or overly broad rule can permit access to the database from unexpected networks. For this reason the rules must be designed as specifically as possible. ### The Basic Security Approach for pg_hba.conf The logic must be this: Only the necessary network. Only the necessary user. Only the necessary database. Strong authentication. ### What Is listen_addresses in PostgreSQL? It determines on which network interfaces the database server will accept connections. ### Should PostgreSQL Listen on All Interfaces? If there is no business need, no. The database must be reachable only on the necessary network interfaces. ### Should PostgreSQL Be Exposed to the Public Internet? A production PostgreSQL database being directly exposed to the internet creates unnecessary risk in most corporate architectures. Controlled access over the application or management network must be preferred. ### Should PostgreSQL Use TLS? Yes. Using TLS on client-database traffic helps protect sensitive data over the network. ### How Is PostgreSQL Authentication Strengthened? Strong password authentication, certificate-based methods or appropriate centralized identity integrations can be used. Modern password authentication methods must be preferred. ### What Is PostgreSQL SCRAM? SCRAM-based password authentication is a more modern authentication approach compared with older password methods. ### How Is Password Policy Managed in PostgreSQL? Alongside the DBMS level, using a central identity or organizational policy can be evaluated. ### Why Must the PostgreSQL Public Schema Be Checked? Default privilege behaviour may not match the organization's security baseline. For this reason; schema ownership, CREATE permission, default privileges must be reviewed. ### What Are Default Privileges? They determine which privileges will be granted by default to newly created database objects. ### Is Role Inheritance Risky in PostgreSQL? In complex role structures a user can gain more privileges than expected. An effective permission analysis must be performed. ### What Is a PostgreSQL Extension? They are the modules providing additional capability to the database. ### Why Can Extensions Be a Security Risk? An unnecessary or unsafe extension; attack surface, dependencies, code execution capability can add these. ### Should Every Extension Be Installed in PostgreSQL? No. Only the extensions there is a business need for must be used. ### Why Is PostgreSQL Logging Important? Connection, authentication, query, role activity events such as these can be used for security monitoring. ### Should PostgreSQL log_statement Be Turned On for Every System? No. On busy production systems it can create a high log volume. A risk-based logging policy must be used. ### How Is PostgreSQL Audit Done? Alongside native logging capabilities, appropriate audit mechanisms can be used. The aim is to monitor, in particular; privileged activity, role changes, critical table access events such as these. ### Why Is PostgreSQL OS Security Important? PostgreSQL mostly runs on operating systems such as Linux. For this reason database security also depends on; service account, file permission, OS patching, SSH access security. ### Why Are PostgreSQL Data Directory Permissions Critical? An unauthorized OS user being able to reach the database files creates serious risk. ### PostgreSQL Backup Security pg_dump or physical backup files can contain production data. For this reason the backup; encryption, restricted access, secure storage must be protected with these. ### PostgreSQL Replication Security Replication connections must be protected with a separate user, minimum permissions and network restriction. ### Should the PostgreSQL Replication Account Be a Normal User? Only the privileges necessary for the replication task must be granted. ### PostgreSQL Patch Management The PostgreSQL major and minor version lifecycle must be tracked. Updates containing security fixes must be applied in a controlled way. ### Is Using an Unsupported PostgreSQL Version Risky? Yes. Versions no longer receiving security updates create high risk over time. ### What Is Microsoft SQL Server Security? MSSQL security includes layers such as; Windows/AD integration, SQL Login, server role, database role, service account, encryption, audit as its scope. ### What Is Windows Authentication? It is the user reaching SQL Server with their Windows or Active Directory identity. ### Why Can Windows Authentication Be Preferred? It provides central identity management. User lifecycle, MFA and security policy can be managed with the central identity infrastructure. ### What Is SQL Authentication? It is the authentication method with a username/password defined inside SQL Server. ### Is Windows Authentication Always Safer? Not automatically for every environment. If Active Directory security is weak, the database risk can increase too. ### What Is Mixed Mode Authentication? It is SQL Server accepting both Windows Authentication and SQL Authentication. ### Should Mixed Mode Be On If It Is Unnecessary? The security baseline must disable unnecessary authentication methods according to business need. ### What Is the MSSQL sa Account? **sa is SQL Server's highly privileged built-in administrator account.** ### Why Is the sa Account Critical? It is a well-known account name and can hold very high privileges. For this reason, if it is not in use, disabling it securely or protecting it very strictly must be evaluated. ### Is Renaming the sa Account Enough? No. The real control must be; disable, strong authentication, limited usage, monitoring as the measures. Merely changing the name does not take the place of the basic security control. ### What Is MSSQL sysadmin? It is one of the highest-privileged server roles on SQL Server. ### How Many Users Should Be sysadmin? The minimum number. sysadmin must not be granted on a “it might come in handy” basis. ### Should the Application Account Be sysadmin? Generally, absolutely not. The application must be granted privileges only on the databases and objects it needs. ### The Difference Between an MSSQL Server Role and a Database Role A server role can provide privileges at the whole SQL Server instance level. A database role, meanwhile, can manage privileges inside a specific database. ### Is Using Windows Groups Useful in MSSQL? Yes. Role assignment through AD groups can make central management easier. ### But Can AD Groups Be Risky? If group membership is not controlled, a user can indirectly obtain high database privileges. ### What Is an MSSQL Service Account? It is the identity under which the SQL Server services run on the operating system. ### Should the MSSQL Service Account Be a Domain Admin? No. The service account must hold minimum OS and network privileges. ### Should a Dedicated Service Account Be Used? For critical services a separate service identity can be preferred. ### How Should MSSQL Network Exposure Be Restricted? Database ports must be reachable only from the necessary application and management networks. ### What Is the SQL Server Browser Service? It is the service assisting SQL Server instance discovery and connection processes. ### Is SQL Server Browser Always Necessary? No. If it is unnecessary, turning it off can reduce the attack surface. ### What Is MSSQL xp_cmdshell? It is a powerful feature that can permit interaction with operating system commands through SQL Server. ### Should xp_cmdshell Be Enabled? If there is no business need, keeping it disabled is the general hardening approach. Because it can carry the impact of a database compromise up to the operating system level. ### Should MSSQL CLR or Other Advanced Features Be Checked? Yes. Unused advanced features must be kept disabled. ### Should MSSQL Use TLS? Yes. Encryption can be made mandatory on client connections. ### What Is Force Encryption? It is the configuration approach on the SQL Server side aimed at forcing client connections to be encrypted. ### Why Is MSSQL Certificate Management Important? A wrong or expired certificate can create an application connectivity problem. ### What Is MSSQL TDE? Transparent Data Encryption enables SQL Server data and log files to be encrypted on disk. ### Does TDE Hide the Data from the DBA? No. An authorized user can read the plaintext data through SQL. ### Why Must MSSQL Backup Encryption Be Checked Separately? The scope and key dependency of database encryption and backup encryption must be verified correctly. ### What Is MSSQL SQL Server Audit? It is the audit mechanism that can be used to record security activity at the server and database levels. ### What Are MSSQL Extended Events? It is the powerful diagnostic and monitoring mechanism used to monitor events on SQL Server in detail. ### Can Extended Events Be Used for Security Monitoring? Yes. However, which events are collected and the storage impact must be designed correctly. ### MSSQL Login Audit Successful and failed login events must be monitored, particularly for privileged accounts. ### Should MSSQL Agent Jobs Be Audited? Yes. Jobs running through SQL Server Agent can perform important operations on the database and the OS. ### What Is a Linked Server? It enables one SQL Server to connect to another database or data source. ### Why Is a Linked Server Risky? When one instance is compromised it can create a path for lateral movement or unauthorized data access to another system. ### How Should Linked Server Credentials Be Protected? Minimum permissions and secure credential management must be applied. ### Should MSSQL Database Mail Be Checked from a Security Perspective? Unnecessary features being active can increase the attack surface. The need for its use must be assessed. ### MSSQL Patch Management SQL Server cumulative update and security update levels must be tracked. ### Is Using an EOL MSSQL Version Risky? Yes. SQL Server versions no longer receiving security updates create serious operational and security risk. ### What Is Oracle Database Security? Oracle security covers areas such as; privileged accounts, the listener, roles, profiles, TDE, audit, patch management as its scope. Because Oracle is frequently used on high-value and critical database systems in corporate structures, privileged access security is particularly important. ### What Is the Oracle SYS Account? It is one of Oracle's highest-privileged administrative accounts. ### Should SYS Be Used for Daily Work? No. It must be used only for genuinely necessary highly privileged management operations. ### What Is the Oracle SYSTEM Account? It is another built-in administrative account holding high management privileges. ### Should SYS and SYSTEM Be Used as Shared Accounts? As far as possible, personal administrator identities and an accountability approach must be preferred. ### What Is Oracle SYSDBA? It is the privileged management authority providing very high database administration privileges. ### Should the SYSDBA Privilege Rest with a Minimum Number of Users? Yes. ### Can the Application User Be SYSDBA? If there is no business requirement, absolutely not. ### What Is the Oracle Listener? It is the core component managing clients' connections to Oracle database services over the network. ### Why Is the Listener Critical from a Security Perspective? It is one of the important entry points of network access to the database. ### Should the Oracle Listener Be Exposed to the Internet? For a critical production database, direct public exposure creates unnecessary risk in most architectures. ### How Should Oracle Network Restriction Be Done? Firewall, network segmentation, allowed hosts, secure protocols it must be restricted with these approaches. ### What Are Oracle Profiles? They are the structures helping define controls such as user password and session policies. ### How Can Oracle Password Policy Be Managed? Through profiles; password lifecycle, failed login, session policies such as these can be applied. ### Why Must Oracle Default Accounts Be Checked? Unused default/sample accounts arriving with the installation or with components can increase the attack surface. ### Should Sample Schemas Exist in Production? If there is no need, removing them or not using them can be safer. ### Oracle Role Management Granting privileges according to business roles rather than by direct grant to users can make management easier. ### Why Must the Oracle PUBLIC Privilege Be Checked? Privileges granted to PUBLIC can provide access to a very broad user population. For this reason it must be reviewed regularly. ### What Is Oracle TDE? Oracle Transparent Data Encryption is one of the important security mechanisms providing at-rest protection of database data. ### Why Is Oracle TDE Key Management Critical? The usability of an encrypted database depends on access to the encryption key or the wallet. ### What Is an Oracle Wallet / Keystore? It is the structure used in the secure management of cryptographic material such as encryption keys and certificates. ### Is a Keystore Backup Necessary? Yes. If the encryption key is lost, database recovery can be seriously affected. ### What Is Oracle Unified Auditing? It is the audit approach enabling audit events on Oracle to be managed in a more central form. ### Which Events Should Oracle Audit Monitor? On a risk basis; privileged login, role changes, user creation, critical table access, configuration changes can be monitored. ### What Is Oracle Fine-Grained Auditing? It is the approach enabling more detailed auditing according to specific objects or conditions. ### What Is Fine-Grained Audit For? For example, more specific activity such as access only to a sensitive salary column can be monitored. ### What Is Oracle Database Vault? It is the security feature that can help limit even highly privileged administrator access on certain data domains. ### Can Oracle Database Vault Protect Data from the DBA? With the right design it can strengthen separation of duties and privileged user access control. ### Why Is Oracle Patch Management Critical? Oracle Critical Patch Update releases and supported version levels need to be tracked. ### Is Using an EOL Oracle Version Risky? Yes. Versions no longer receiving security support can create critical risk. ### PostgreSQL, MSSQL and Oracle Authentication Comparison | Area | PostgreSQL | MSSQL | Oracle | | --- | --- | --- | --- | | Local User/Role | Yes | Yes | Yes | | Central Identity | Integration possible | AD/Windows strong | Integration possible | | Built-in High Privilege | Superuser | sa/sysadmin | SYS/SYSDBA | | Certificate/TLS | Yes | Yes | Yes | | Role-Based Access | Yes | Yes | Yes | Even though the platform differs, the aim is the same: **strong authentication and minimum privilege.** ### Privileged Account Comparison PostgreSQL: #### Superuser MSSQL: **sysadmin / sa** Oracle: #### SYS / SYSDBA The common characteristic of these accounts is very broad privilege. For this reason; MFA, PAM, JIT, Audit they must be protected with additional controls such as these. ### Network Security Comparison PostgreSQL: pg_hba.conf + listen_addresses + firewall MSSQL: instance network config + firewall + encryption Oracle: listener + network restriction + firewall The platforms differ but the security principle is: **Only the necessary systems must connect to the database.** ### Encryption Comparison On all three platforms; TLS, at-rest encryption, backup security must be assessed. Feature names and licensing structures can differ. ### Can Database Encryption Features Depend on the License? Yes. On enterprise database products in particular, some security features can depend on the edition or the licensing model. For this reason the architecture must be verified not only technically but also from a licensing perspective. ### Audit Comparison PostgreSQL: Native logs + appropriate audit mechanisms. MSSQL: SQL Server Audit + Extended Events. Oracle: Unified Auditing + other audit mechanisms. The aim is the same on every platform: **Accountability and visibility.** ### Even If the Platforms Differ, Can a Single Format Be Sent to SIEM? With normalization, yes. SIEM can transform different database events into a common security schema. ### A Sample Normalized Event Database Type: PostgreSQL Event: Privileged Login User: DBA01 Source: 10.x.x.x Severity: High The same event can come from MSSQL or Oracle too. ### Why Is DAM Valuable in a Multi-Database Environment? Collecting PostgreSQL, MSSQL and Oracle activity on a common security dashboard is possible. This provides an important advantage for the SOC. ### Database Administration Tool Security DBAs can use different GUIs and management tools. These tools'; credential storage, version, endpoint security state must be checked too. ### Is Saving a Password Inside a DBA Tool Risky? If the endpoint is compromised, stored credentials can be at risk. For this reason a PAM or secure vault approach can be preferred. ### Is a Developer Database Client Risky? If production credentials are kept on a developer laptop the risk increases. ### Should There Be Access to the Production Database from a Personal Laptop? In critical structures a controlled PAW, bastion or PAM approach can be preferred. ### Common OS Hardening for PostgreSQL, MSSQL and Oracle Independently of the database platform; unnecessary services disabled, OS patched, local admin restricted, EDR deployed, file permissions hardened must be the state. ### Should the Database Server Be Joined to the Domain? It must be assessed according to architecture and platform need. AD integration is used frequently on the MSSQL side in particular. However, the impact of domain compromise risk on the database must be assessed separately. ### Should the Database Server Use EDR? With compatibility and performance testing, endpoint detection can be evaluated on critical servers. ### Can EDR Create a Performance Problem While Scanning Database Files? Yes. Vendor best practice and exclusions must be designed carefully. Security tool tuning must be performed. ### Does an Antivirus Exclusion Create a Security Risk? An overly broad exclusion can create an attack surface. Only verified technical requirements must be applied. ### Database Service Account OS Privileges The database service account must not be a local administrator or root. Only the necessary permissions must be granted. ### Should PostgreSQL Be Run as Root? The database service must run with a dedicated low-privileged OS account. ### Should the MSSQL Service Account Be a Domain Admin? No. ### Should the Oracle OS Account Be Separate? Yes. Oracle services/processes must be managed with a dedicated OS identity. ### Why Are Database File Permissions Critical? Access to the database file at the OS level can bypass the DBMS security layer. ### Why Are Backup File Permissions Critical? A backup file can contain a full copy of the database. ### Database Dump Security PostgreSQL dump, MSSQL backup, Oracle export all of these files must be treated as sensitive. ### Should Export Encryption Be Used? If sensitive data is being exported, encryption and controlled access must be applied. ### What Is the Biggest Risk in Test Environments Regardless of Vendor? It is the uncontrolled copying of production data. ### Can PostgreSQL Production Data Be Copied to Test? If there is a business need, masking must be applied. ### Can an MSSQL Backup Be Restored to the Test Environment? Only in a controlled and authorized way. ### Can an Oracle Data Pump Export Be Used for Testing? Sensitive data must be put through masking or anonymization processes. ### Is Database Masking Important on All Three Platforms? Yes. Particularly in dev/test environments. ### How Should the Configuration Baseline Be Managed? A separate baseline can be created for each platform: PostgreSQL Security Baseline MSSQL Security Baseline Oracle Security Baseline ### What Should a Platform Baseline Include? Authentication Administrator Accounts Network TLS Encryption Audit Patch Backup OS Security ### How Is Configuration Drift Detected? Periodic configuration assessment or automated compliance tools can be used. ### Can Hardening Break After an Upgrade? Yes. After a major version upgrade or migration some settings can return to their defaults. ### Should Security Validation Be Done After a Migration? Absolutely. For example; Oracle → PostgreSQL or MSSQL → cloud managed database carrying the old permission model across unchanged after a migration may not be safe. ### Database Migration Security Checklist During the migration: User/Role Mapping Encryption Network Access Audit Backup Secrets Application Connection must be checked. ### Cloud Managed PostgreSQL Security The cloud provider can manage the database engine. However, the customer; IAM, public access, network rules, user roles, logs, backup is responsible for these subjects. ### Cloud Managed MSSQL Security On managed SQL services the operating system management can rest with the provider. However, access control and database security are still the customer's responsibility. ### Cloud Oracle Security Even if the Oracle database runs on the cloud, the IAM, network, encryption and audit configuration must be done correctly. ### Why Is Shared Responsibility Critical for Database Security? Using a managed database does not mean: **“Security is the provider's responsibility.”** as the conclusion. ### Is Running PostgreSQL Inside a Container Safe? With the right hardening it can be used. However; container image, secret, persistent volume, network policy security matters separately. ### Kubernetes Database Security If a stateful workload is being run; Secrets, RBAC, NetworkPolicy, PersistentVolume encryption, backup must be assessed. ### Is a Kubernetes Secret Enough for a Database Password? The security properties of the default secret storage model must be assessed separately. If necessary an external secret manager can be used. ### Database Secrets Rotation Whatever the platform, application credentials must be rotated in a controlled way. ### Can the Application Be Cut Off After Credential Rotation? If planned wrongly, yes. Methods such as dual-secret or staged rotation can be evaluated. ### Database Connection Pool Security The application connection pool can hold the database credential in memory for a long time. For this reason application host security matters. ### PostgreSQL Connection Pooler Security A pooler can create a separate authentication and network attack surface. For this reason it requires hardening as well. ### MSSQL Connection Pooling Security Application identity and connection string security matter. ### Oracle Connection Pool Security The credential and pool configuration on the application server must be protected. ### What Is the Weakest Link in Database Security? There is no single answer. From organization to organization it; credentials, patching, public exposure, the application account, backup can be any of these. ### Not Vendor Security but Architectural Security Using PostgreSQL is not automatically more secure. Using MSSQL is not automatically more secure. Using Oracle is not an automatic security guarantee either. The real subject is the quality of the configuration and the operations. ### Is the “Which Database Is More Secure?” Question the Right One? Not on its own. The more accurate question is: **“Which platform can be operated more securely with our security architecture, operational capability and business requirements?”** as the framing. ### Security Criteria in Platform Selection For example: Authentication Integration Encryption Capability Audit Features Patching Model High Availability Backup/Recovery Vendor Support Operational Expertise can be assessed. ### PostgreSQL Security Advantages Its open source nature and strong role/network configuration options can provide important advantages. However, management discipline is required. ### MSSQL Security Advantages Active Directory integration and central identity management with the Microsoft ecosystem can provide a strong advantage. ### Oracle Security Advantages It can provide advanced features in the areas of enterprise security, encryption, audit and privileged access. ### Is Human Error Risky on Every Platform? Yes. A wrong GRANT command or a wrong firewall rule can create risk on all platforms. ### Why Is Database Security Automation Important? Manual checking of hundreds of databases is not sustainable. ### What Can Automated Compliance Check? For example: Public Exposure Unsupported Version Audit Disabled Encryption Disabled Excessive Privileges ### What Is Database Security Posture Management? It is the approach aiming to make database systems' security configuration, exposure and risks centrally visible. ### What Can a Security Posture Dashboard Show? Database Count Critical Findings Unsupported Versions Privileged Users Encryption Coverage Audit Coverage ### A Common Security Checklist for PostgreSQL, MSSQL and Oracle - Is a supported version in use? - Are the security patches current? - Is public access disabled? - Is there network segmentation? - Are privileged accounts minimal? - Is there a shared administrator account? - Are application accounts least-privileged? - Is TLS active? - Is there at-rest encryption? - Is there backup encryption? - Is audit active? - Is there a SIEM integration? - Is sensitive data access monitored? - Are backup/restore tested? - Has OS hardening been applied? - Is configuration drift monitored? ### PostgreSQL Security Checklist - Is pg_hba.conf controlled? - Is listen_addresses restricted? - Is the superuser count minimal? - Has role inheritance been checked? - Have public schema privileges been reviewed? - Have unnecessary extensions been removed? - Is TLS active? - Is the logging/audit appropriate? - Are data directory permissions secure? - Is the backup encrypted? ### MSSQL Security Checklist - Has sa usage been restricted? - Is the sysadmin count minimal? - Has the need for Windows/SQL authentication been assessed? - Is the service account least-privileged? - Are unnecessary SQL Server features disabled? - Is xp_cmdshell disabled if unnecessary? - Is TLS active? - Is TDE active according to need? - Is there SQL Server Audit? - Have the Linked Servers been checked? ### Oracle Security Checklist - Has SYS/SYSTEM usage been restricted? - Are the SYSDBA users minimal? - Has the listener been restricted at the network level? - Have default/sample accounts been checked? - Is a profile/password policy applied? - Have the PUBLIC privileges been reviewed? - Is Unified Auditing enabled? - Are TDE/key management secure? - Is there a keystore recovery plan? - Are the patch levels current? ### Questions Management Should Ask About Database Security Management must know the answers to these questions: How many PostgreSQL databases do we have? How many MSSQL instances are there? How many Oracle databases are there? Which of them are critical? Which of them use an unsupported version? How many privileged accounts are there? How many are publicly reachable? On how many is encryption active? On how many is audit active? Which of them are monitored by SIEM? These questions reveal the security maturity level of a multi-database environment. ### Frequently Asked Questions #### Is PostgreSQL secure? Configured correctly it offers strong security controls. However, the default installation alone does not mean production security. #### Should the sa account be disabled in MSSQL? If it is not in use, disabling it can be evaluated. If it is active it must be protected and monitored very strictly. #### Should the Oracle SYS account be used daily? No. It must be used only for genuinely necessary highly privileged management operations. #### What is PostgreSQL pg_hba.conf? It is the critical configuration file controlling which users can connect to the database, from which network and with which authentication method. #### Why is MSSQL xp_cmdshell risky? It can provide strong interaction between the database and the operating system. If there is no need, keeping it disabled to reduce the attack surface is appropriate. #### Why is the Oracle Listener important? It is the core network component of client database connections and its access must be restricted. #### Which is more secure: PostgreSQL, MSSQL or Oracle? It cannot be decided by the platform name alone. Security depends on the configuration, architecture, patching and quality of operations. #### Should TLS be used on all three platforms? On sensitive database connections, encryption in transit is an important security control. #### Is audit necessary on all three platforms? On critical production databases, auditing privileged and sensitive activity is important. #### If the database platform is in the cloud, is hardening unnecessary? No. Even on managed services, identity, network, logging, encryption and backup configuration matter for the customer. ### Conclusion: It Is Not a Secure Platform but a Securely Operated Database PostgreSQL, Microsoft SQL Server and Oracle Database are technically quite different platforms from each other. However, from a cyber security perspective the core principles do not change. In PostgreSQL: **pg_hba.conf** can be critical. In MSSQL: **sa and sysadmin** can be critical. In Oracle: #### SYS, SYSDBA and the Listener can be critical. However, the common need of all the platforms is the same: #### Minimum Privilege #### Minimum Network Exposure #### Strong Authentication #### Encrypted Communication #### Secure Configuration #### Audit #### Patch Management #### Backup Security #### Continuous Monitoring For this reason the database security approach must be designed not per product but in layers. First, a common organization-wide: #### Database Security Baseline must be created. Then this baseline; PostgreSQL, MSSQL, Oracle must be extended with platform-specific hardening items for these. The most important principle is this: **On no platform does the default configuration automatically mean the ideal security configuration for your organization.** The organization; which users are privileged, which networks can reach it, which data is encrypted, which activity is audited, which versions are supported must know these continuously. For this reason the right question is not: **“Is PostgreSQL more secure, or MSSQL, or Oracle?”** as the framing. The right question is: **“How securely do we configure, how well do we monitor and how disciplined are we in operating the database platform we use?”** as the framing. Real database security comes not from the product name but from the combination of; **Secure Architecture + Secure Configuration + Secure Operations** as its parts.