Service · Cyber security

Database security

Your database holds all your information in one place and in the easiest possible form to copy. Even so, it is often less protected than the application above it: the application has roles and permissions, the database has a single admin account whose password several people know.

Send an enquiry See the scope

Personal

accounts for admins

Auditing

without slowdowns

Backups

always encrypted

Test data

anonymised

What the service covers

It all comes down to three questions: who can connect, what are they allowed to do, and is it logged? We work with SQL Server, PostgreSQL, MySQL and MariaDB, on your own servers and in Azure.

Talk it through with us

Accounts

Personal accounts for administrators and separate, restricted accounts for each application.

Isolation

Direct connections from staff PCs to the database are closed, and from the internet they should be impossible.

Auditing

We log access and, above all, large extracts. Exporting the entire customer table must never go unnoticed.

Encryption

Transparent data encryption for the database itself and encryption of every backup file.

Test environments

Pseudonymised copies for development and testing. A developer does not need real names and CPR numbers.

Patching

A fixed routine for database server security updates, tested before they touch production.

How we deliver it

The work happens without stopping the live database. A maintenance window is needed only for updates and for enabling encryption.

Review

Who connects, from where and with which rights. A couple of forgotten access paths nearly always turn up.

Access

Unneeded network connections are shut, each administrator gets their own account and shared passwords disappear.

Audit and encryption

Auditing is switched on and both data and archives are encrypted.

Proof

We check that a large extract is recorded and that a restore from an encrypted backup actually works.

Direct database access from a desktop is a back door round every role in the application. With an ordinary database client, a user can bypass the whole permission model: the application restricts, the database does not. It can be closed at network level in an afternoon.

Common questions

Database administrators, each with their own account. Developers do not need production access, they need an anonymised copy. A shared admin account is the single most common finding in our reviews.

Not on the same server or network as the database. At least one copy must be immutable, so ransomware cannot encrypt it along with the original.

Pseudonymise them. Tools exist that swap names, addresses and numbers for believable fake values while keeping structure and volume intact. That is plenty for development and testing and fits the GDPR principle of data minimisation.

Not if it is set up properly. We record selected events such as logins, permission changes and large extracts, not every single query. The overhead is normally unnoticeable.

Related services

View the whole area

Service GDPR and personal data security Access, logging and encryption for personal data Service Security policies and documentation Policies and procedures people can actually follow Service Security solution deployment Selecting, piloting and rolling out security tools Service Infrastructure protection Perimeter, network zones and secure remote access

Have your databases reviewed

Tell us which databases you run and who connects to them. We will review access, logging and backups.

Email
office@apply.dk

Coverage
All of Denmark, delivered remotely

I agree that Apply may handle my details as set out in the privacy policy