Database systems

search account_circle

policyASD ISM

Guidelines for database systems

13 controls in this part of theACSC ISM. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Database servers

Ensure Databases and Web Servers are Separated

Databases and web servers should be kept separate to enhance security.

Separate Network Segments for Database Servers

Databases should be on a different network than user computers to enhance security.

Restrict Network Access to Database Servers

Database server communications are limited to necessary network resources only.

Segregate Environments for Database Servers

Keep development and production database servers separate to ensure secure operations.

Database Servers

Disable Database Networking for Local Access

If the database is only accessed locally, its network connection must be disabled or set to local on

Encrypt Database and Web Server Communications

Data exchanged between database and web servers must use approved encryption methods.

Databases

Classify Databases Based on Data Sensitivity

Databases should be classified according to how sensitive the data they contain is.

Develop and Verify Database Register

Maintain an up-to-date list of databases and check it regularly to ensure accuracy.

Restrict Database User Access Based on Duties

Users can only access or change database information if it's part of their job.

Implement File-Based Access Controls for Databases

Use file permissions to safeguard database files from unauthorised access.

Enforce Need-to-Know Access in Databases

Only authorised users can access database contents by using specific privileges, roles, and techniqu

Ensure Non-Production Databases Match Production Security

Production data can only be used in non-production areas if they are secured equally as well.

Log Security-Relevant Database Events Centrally

Keep track of important activities in databases, like access, changes, and issues, to ensure securit

Back to the full ASD ISM control list, or browse the complete control library.