Data & Database Security
Database privileges, data classification, encryption at rest versus in transit, and the copies of your data you forgot about: backups, replicas, logs.
Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.
Database security is authentication, network reachability, least privilege, encryption, audit, tenant enforcement and secure copies—not one checkbox.
An application connected as superuser turns every injection or process compromise into total database compromise.
Classify data as public, internal, confidential or highly sensitive so handling rules follow the value and consequence of exposure.
Transport encryption protects links; storage encryption protects media and some infrastructure paths. Neither decides who is allowed to read the plaintext.
A backup carries the confidentiality, retention and deletion obligations of production—and adds restore integrity and availability concerns.