<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-database-security
description: >-
  Audit database security configurations, permissions, encryption settings,
  and hardening baselines against CIS benchmarks for PostgreSQL, MySQL,
  MSSQL, and Oracle databases.
domain: cybersecurity
subdomain: data-security
tags:
  - database-security
  - cis-benchmark
  - audit
  - hardening
  - postgresql
  - mysql
  - permissions
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1213"]
---

# Auditing Database Security

## Overview

Database security auditing evaluates configuration, access controls,
encryption, patching, and logging against established benchmarks (CIS,
STIG, vendor best practices). Regular audits identify misconfigurations
that expose sensitive data — default credentials, overprivileged accounts,
missing encryption, disabled audit logging, and network exposure. This skill
covers automated configuration scanning, permission analysis, and
compliance reporting.

Mode: `[MODE: BLUE]` — Database hardening and compliance audit.

## Prerequisites

- Database administrative access (read-only sufficient for audit)
- CIS Benchmark documents for target database platform
- Current database configuration files
- Network diagram showing database connectivity

## Key Concepts

### Audit Categories

| Category | Check | CIS Control |
|----------|-------|-------------|
| Authentication | Default credentials removed | CIS 5.2 |
| Authorization | Least privilege enforced | CIS 6.1 |
| Encryption | TLS enabled for connections | CIS 3.1 |
| Audit logging | All DDL/DML logged | CIS 8.2 |
| Network | Bind to internal interface only | CIS 9.2 |
| Patching | Running supported version | CIS 7.1 |
| Backup | Encrypted backups configured | CIS 10.1 |

### PostgreSQL Hardening Checks

```bash
# Check listening addresses
SHOW listen_addresses;  -- Should NOT be '*' or '0.0.0.0'

# Check SSL enforcement
SHOW ssl;  -- Should be 'on'

# Check password encryption
SHOW password_encryption;  -- Should be 'scram-sha-256'

# Check audit logging
SHOW log_statement;  -- Should be 'ddl' or 'all'
SHOW log_connections;  -- Should be 'on'

# List superuser accounts (minimize these)
SELECT rolname FROM pg_roles WHERE rolsuper = true;

# Check for default 'postgres' password
-- Attempt authentication or check pg_shadow
```

### Scanning CLI

```bash
# Audit PostgreSQL configuration
node scripts/agent.js --action audit --dbtype postgresql \
  --config /etc/postgresql/16/main/postgresql.conf \
  --output /tmp/db_audit.json

# Analyze database permissions
node scripts/agent.js --action permissions --input /tmp/pg_roles.json \
  --output /tmp/permission_audit.json

# Generate compliance report
node scripts/agent.js --action report --input /tmp/db_audit.json \
  --framework cis --output /tmp/compliance_report.json
```

## Workflow

### Step 1: Collect Configuration

Export database configuration and permission data.

### Step 2: Run Security Audit

```bash
node scripts/agent.js --action audit --dbtype postgresql \
  --config /etc/postgresql/16/main/postgresql.conf
```

### Step 3: Analyze Permissions

```bash
node scripts/agent.js --action permissions --input /tmp/pg_roles.json
```

### Step 4: Generate Compliance Report

```bash
node scripts/agent.js --action report --input /tmp/db_audit.json --framework cis
```

## Detection

```yaml
title: Auditing Database Security Detection
id: 911fd1bb-149a-44a0-872f-779650bfa57e
status: experimental
description: Detects suspicious activity related to auditing database security techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1213
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```

## Verification

- [ ] Default credentials removed from all database instances
- [ ] TLS enforced for all database connections
- [ ] Superuser accounts minimized and documented
- [ ] Audit logging enabled for DDL and privilege changes
- [ ] Network binding restricted to internal interfaces
- [ ] Database version supported and patched
- [ ] Encrypted backups verified and restoration tested

## References

- [CIS PostgreSQL Benchmark](https://www.cisecurity.org/benchmark/postgresql)
- [CIS MySQL Benchmark](https://www.cisecurity.org/benchmark/oracle_mysql)
- [NIST SP 800-53 AC-6 — Least Privilege](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [OWASP Database Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html)
