Network exposure
Whether the database is reachable beyond the hosts that legitimately need it — the single most common serious finding.
Technology Security
Protect the database where the data actually lives.
The database is where the thing worth stealing actually sits. Yet databases are routinely left reachable from the internet, running default accounts, with every application connecting as an all-powerful user.
ExposureNetwork reachability
AuthDefault & weak accounts
PrivilegesLeast-privilege review
TransportEncryption in transit
How database breaches actually happen
A surprising number of database compromises need no clever exploit at all: the server is reachable from the internet, an account still has its default or a guessable password, and once inside, the connecting user can read and write everything. Encryption in transit is off, so credentials and data cross the network in clear text.
We assess the database the way it gets attacked — is it reachable, who can authenticate, what can they do once in, is the connection encrypted, and are the dangerous defaults still enabled. The result is a hardening plan ordered by how directly each item leads to data loss.
Coverage
What we secure on a MySQL / MariaDB deployment
The controls that decide whether a database becomes a breach.
Default and weak authentication
Default accounts, blank or guessable passwords, and anonymous access.
Excessive privileges
Application accounts granted far more than they need, so any application flaw becomes full database control.
Unencrypted connections
Traffic and credentials crossing the network without TLS.
Dangerous defaults and features
Local-file access, overly broad host grants and settings that widen the blast radius of any foothold.
Audit and logging gaps
Whether access to sensitive data would be visible after the fact.
Version and patch status
End-of-life or unpatched engine versions with known vulnerabilities.
Approach
How a database assessment runs
Read-only and non-disruptive; credentialed review when access is provided.
-
01 · Reachability
Where the database can be reached from, mapped against where it should be.
-
02 · Authentication and privilege review
Accounts, privileges and defaults reviewed, with credentials where provided.
-
03 · Verify
Findings confirmed, not inferred from a banner.
-
04 · Report and harden
A prioritised hardening plan, ordered by direct data-loss risk.
Deliverables
What you actually receive.
The report is the product. If it cannot be acted on by a developer and understood by a director, we have not finished.
Exposure and access findings
Who can reach and authenticate to the database, and what they can do once in.
Least-privilege plan
The grants to remove so an application flaw can no longer own the database.
Hardening baseline
Transport encryption, safe defaults and account settings.
Re-test on fix
Confirmation that each change closed the finding.
How we work
Six steps, and no surprises.
The same engagement model applies to every piece of work we take on, so you always know what happens next.
01
Scope
A 30-minute call, then a written scope: what is in, what is out, what we need from you and what it costs. Nothing starts before you sign it.
02
Authorise
Rules of engagement, testing windows, escalation contacts and a signed authorisation. Out-of-hours windows where production cannot take the load.
03
Test
Automated coverage first, then manual testing where judgement is required. Critical findings are reported the day we confirm them, not at the end.
04
Report
One report a developer can act on and an executive can read, with evidence, reproduction steps, business impact and a fix for every finding.
05
Remediate
A walkthrough call with your engineers. We answer questions on the fix, not just the finding.
06
Retest
A free retest cycle to confirm the fixes hold, and a clean summary you can hand to a customer, auditor or board.
Questions
MySQL Security — answered.
The questions clients actually ask during scoping. If yours is not here, ask it directly.
Do you run anything destructive against our database?
No. The assessment is read-only and non-disruptive. We never modify or delete data, and any active checks stay within the scope agreed in writing.
Does this cover MariaDB too?
Yes. MariaDB shares MySQL’s heritage and most of its security model, and the assessment covers both, plus the differences that matter between them.
Our database is not exposed to the internet — is there still value?
Yes. Internal exposure, over-privileged application accounts and unencrypted internal traffic are exactly the things that turn a single foothold into a full data breach, and none of them depend on internet exposure.
Can you assess it without full admin credentials?
Yes, though credentialed review is more thorough. Without credentials we assess exposure and authentication from the outside; with them we can review privileges, defaults and audit configuration directly.
Next step
Get a written scope and a fixed price.
A 30-minute call, then a scope document with what is in, what is out and what it costs. No obligation, and no charge for the conversation.