Database Security

Introduction

Beyond SQL injection: least privilege, encryption, audit, network isolation, secrets management. Real DB security is layered.

Understanding the topic

Core concepts to understand:

• Least privilege: app user has minimal grants.
• TLS in transit; encryption at rest.
• Audit logging for sensitive actions.
• Network ACLs / VPC peering — DB never on public IP.
• Rotate credentials regularly.

Syntax reference

Visual workflow / architecture:

[ App  ]──TLS──▶ [ DB inside VPC ]
   │                       │
   ▼                       ▼
secrets in              encrypted at rest
vault, never           audit log enabled
in env files

Real-world use

PCI-DSS, HIPAA and SOC 2 all mandate these practices. Every serious breach involves missing one of them.

Best practices

• App user has only the grants it needs.
• TLS + encryption at rest by default.
• Audit + alert on sensitive operations.

Hands-on exercise

Interview preparation — practice these questions:

• Q1. Three layers of DB security.
• Q2. Encryption in transit vs at rest.
• Q3. Why least privilege matters.
• Q4. Audit logging — what to log.
• Q5. Secrets management options.