Database hardening and security audit practice
You audit four engines against a security benchmark, collect findings automatically with scripts, set up key rotation and audit trails, and test the defences with attack simulations in your own environment.
Level 501 · 15 lessons · 12 practice labs
Lessons
Benchmarks and audits
- How to read security benchmarks
- Writing audit scripts
- Tracking configuration drift
- Privilege reviews and unused accounts
- Short task: benchmark a PostgreSQL server
Defence in depth
- Network segmentation and app-only access
- Rotating secrets and passwords
- Rotating encryption keys
- Integrity of audit trails
- Disabling dangerous features: file access and command execution
- Short task: bring a MySQL server up to the benchmark
Testing
- Attack simulation in your own environment
- Verifying that alerts really fire
- Responding to a database incident
- Capstone: a full hardening report for a four-engine environment
Practice labs
- Verify one item from a security benchmark: Check the password and logging items of a security benchmark on a server by hand and record the result.
- Write an audit script: Write a script that checks ten benchmark items automatically and produces a pass-fail report.
- Catch configuration drift: Take the approved configuration as a baseline and set up daily detection of later changes on the servers.
- Find unused accounts: List database accounts with no login in 90 days and prepare a proposal to disable them.
- Rotate an app password without downtime: Change the database password without stopping the app by using an overlap period with two passwords.
- Make audit records tamper-evident: Ship audit records to a separate server with chained hashes and detect a record being altered.
- Allow database access only from the app: Use network rules so only the app server can reach the database and show others are blocked.
- Disable file access and command execution: Find and disable features that let the database read files or run operating system commands.
- Bring a MySQL server up to the benchmark: Fix the items the audit script failed, rescan the server and justify any remaining risks.
- Verify that an alert really fires: Trigger the failed-login alert with controlled attempts and prove the notification arrives.
- Simulate a password attack in your own environment: Run weak-password attempts on the lab database, measure lockout and logging and report the gaps.
- Respond to a database incident: In an incident where a suspicious account pulled data, cut access, preserve evidence, scope impact and write a report.
About this course
You audit four engines against a security benchmark, collect findings automatically with scripts, set up key rotation and audit trails, and test the defences with attack simulations in your own environment.
What you will learn
- Benchmarks and audits
- Defence in depth
- Testing
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.