How to ensure database security

What is database security?

If your company collects data about staff, clients, or suppliers, you can bet it’s stored on a database, either within your premises or on a server elsewhere. A database is a collection of information, stored on a server within a database management system (DBMS). To keep a database secure, each of these three separate elements – the information itself, the DBMS, and the server - must be protected. If the database is linked to any other applications then these must be kept secure too.

Database security involves protecting a database (and the data stored within it) from being compromised. That might involve being accessed, copied, or used by anyone unauthorised to do so. Databases also require protection from damage, both through cyberattacks and from physical events such as fire and floods.

Why is database security so vital?

The information stored on companies’ databases can be anything from confidential contact details to banking information, passwords, and other private data. The Data Protection Act 2018 and the General Data Protection Regulation (GDPR) both place obligations on companies to prevent this data from being compromised.

So there’s a legal imperative to protect your data security, but if you want your company to succeed, there are other motivations, too. Data breaches can have catastrophic consequences for business – as Internet giant Yahoo! discovered in 2013, when it suffered a large-scale attack that apparently affected all 3 billion of its users. Personal information, including email addresses, passwords, back-up email addresses and the answers to security questions, was compromised. The company, in negotiations to be sold at the time, was devalued to the tune of $350 million and later agreed to pay $50 million in damages to around 200 million people affected by the breach.

What makes a database vulnerable to breaches or cyber-attacks?

Because there are a number of different elements to a database, it has vulnerabilities in a number of different areas. Here are some of the most common types of database security breach:

• Bad passwords
  If the passwords you use aren’t secure enough, or they are stored somewhere easily accessible, the data they protect is vulnerable to hackers.

• Lack of encryption
  When sensitive information is transmitted from one place to another, it could be accessed by a third party. By encrypting the data, you render it unreadable until it reaches its destination.

• Missed security updates
  Software is regularly updated with security patches and other measures to keep it safe from data breaches. If you don’t keep your software fully up-to-date with the latest patches, it could be vulnerable to infection with malware. And if this happens, the virus could also spread from your database to the rest of your IT systems.

• Poor backups
  Backing up your data means that in case of data loss, you can retrieve the lost information from the backup. But if your backups aren’t carried out frequently enough, or if they are not done properly, you risk losing that information for good.

• Human error
  We often think of database security as something inherently technical, but most data breaches happen due to human error. For this reason, it’s essential to ensure that staff are fully trained in database security measures.

How can a database be secured?

Because databases are vulnerable to breaches in many different ways, it’s vital to take a multi-pronged approach to database security.

• Physical controls
  Servers must kept in an appropriate secure space and be protected from fire, floods and other physical damage, including vandalism.

• Administrative controls
  Security breaches commonly result from human intervention or error, so restricting access to sensitive content to approved database administrators is a vital aspect of database security.

• Software
  Anti-virus software, firewalls, data encryption and regular backups are all important tools to protect the data in your database.

For expert advice and support to secure your database, or a database health check to review your current database performance, contact us to discuss your individual requirements.