Author: Robert Agar
MySQL is the database platform behind many popular websites and applications such as Netflix, YouTube, Facebook, and Twitter. As one of the most popular database solutions, MySQL is also widely used in a broad cross-section of education, scientific, and business settings. There are several reasons for its popularity, including the fact that it is freeware and there are a large number of skilled database professionals who are conversant with MySQL.
Security is a critical concern for DBAs working with any enterprise database. The anxiety over maintaining security is heightened in situations where sensitive or personally identifiable information (PII) is collected and stored. With many MySQL implementations used as the front-end for consumer-facing websites and eCommerce applications, this puts security high on the list of priorities for database teams responsible for the systems.
Hackers or malicious insiders pose a serious problem for MySQL databases that are not adequately protected. Information can be misused by authorized users taking advantage of elevated privileges to access sensitive data. Hacking attempts can result in data breaches or a ransomware infection that can cripple an organization. It’s in everyone’s best interests to make sure that every step is taken to maintain database security.
Tightening MySQL Database Security
There are multiple activities and configuration changes that DBAs can use to improve the security of their databases. Here are some of the areas that can be addressed to ensure a more secure database and a reduced risk of sensitive information being compromised.
Installation
The task of implementing a secure MySQL environment begins with the installation of the database solution. Fortunately, there is an installation command that offers a streamlined process of taking the initial steps toward a secure system. Executing this command is recommended for a more secure MySQL installation.
When you enter the sudo mysql_secure_installation command and supply the MySQL Admin password you will be presented with a series of questions that address database security. Here are the changes that can be made through the execution of this command.
- Update the password plugin
- Choose the desired level of password validation that will be enabled
- Change the root password
- Remove anonymous users
- Disable remote root login
- Remove the default test database
Using this tool gives you a good head start toward creating a secure database. Teams should use it whenever installing a new MySQL instance and make the appropriate choices to harden their databases.
Database Connections
The connections that are used to access the database require special care and handling when security is a priority. Neglecting this critical component of database security can leave your systems exposed to a wide variety of attacks. Here are some of the specific steps you can take to limit the potential for your database connections to degrade security.
- Encrypting database connections is vitally important for data protection. By default, MySQL connections are not encrypted. Database teams should enforce network encryption for all database connections.
- Changing the default port used by MySQL offers increased security. Modifying the port from its default of 3306 will make it less likely that your system will be attacked by hackers randomly searching for easily accessible systems.
- Setting a connection error limit can help limit successful hacker attacks. Repeated unsuccessful authentications often indicate malicious attempts to access a database. Setting the error limit to a reasonable number reduces the chances of a successful brute-force attack.
Tightening database connections will help keep databases and the information they contain safe and secure.
Database Users
User accounts are the vehicles that allow entry into your MySQL systems. Securing and controlling user access is a critical step to implementing secure databases. Some specific things to look at include:
- Ensure that all user accounts have a password. This step protects database access as long as the password is not shared or compromised.
- Do not grant FILE privilege to nonadministrative users. This limits the ability of users to read and write files anywhere in the system.
- Control the privileges assigned to users and groups to those which are necessary to perform their required functions. Elevated privileges are often involved in cases where insider access is used to compromise data resources.
These are some of the steps that can be performed by MySQL DBAs to increase the levels of security enjoyed by their systems.
Monitoring Your MySQL Database Security
Simply following the recommendations for a secure installation and controlling connections and user access is not enough to fully protect your MySQL databases. Teams need to be apprised of suspicious system activity that may indicate attempts at unauthorized access. To accomplish this goal, a reliable monitoring platform is required.
SQL Diagnostic Manager for MySQL is a comprehensive monitoring tool for MySQL and MariaDB implementations hosted in your data center or the cloud. It provides over 600 customizable monitors that address every area of your databases including their security. Access to this information is available through an intuitive web console that allows your team to view the complete MySQL environment from a single source.
The tool offers your team the ability to construct informative alerts that are sent to the correct personnel to address the issues immediately. Your DBAs will have all the information they need to investigate suspicious database activity and protect valuable enterprise data resources. If your organization uses MySQL for important databases, SQL Diagnostic Manager for MySQL will help keep them safe.
