Towards assessing the security of DBMS configurations

Database management systems (DBMS) have a long tradition in high security. Several mechanisms needed to protect data have been proposed/consolidated in the database arena. However, the effectiveness of those mechanisms is very dependent on the actual configuration chosen by the database administrator. Tuning a large database is quite complex and achieving high security is a very difficult task that requires a lot of expertise and continuous and proactive work. In this paper we analyze the security best practices behind the many configuration options available in several well-known DBMS. These security best practices are then generalized in order to be applicable to practically any DBMS available today. Finally, we use these best practices to define a set of configuration tests, which have been successfully used to evaluate four real database installations based in four well-known and widely used DBMS.