Database Service Assessment

This guide treats PostgreSQL, MySQL, SQL Server, Oracle, and comparable database services as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Identify engine, version, listener, owner, environment, and data classification.

2. 02

   Map application identities, administrator paths, replicas, and backup systems.

3. 03

   Record transport-encryption and certificate expectations.

4. 04

   Define a disposable test schema and least-privilege test roles.

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Confirm listeners are restricted to required networks.

2. 02

   Use test roles to verify database, schema, table, function, and administrative boundaries.

3. 03

   Review dangerous extensions or operating-system integration administratively.

4. 04

   Validate backups and exports follow the same access and encryption controls.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Audit authentication failures, privilege changes, administrative commands, exports, and unusual query volume.
• Protect query text and parameters when they contain sensitive data.
• Alert on new listeners, trust rules, extensions, and high-risk roles.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Restrict network exposure and require encrypted connections.
• Separate application, migration, backup, and administrator roles.
• Remove default accounts and unused dangerous features.
• Apply supported releases, encrypted backups, and tested restoration procedures.