Database Configuration Hardening

What this finding is

Database configuration departs from CIS Benchmark or vendor hardening guidance — sample schemas retained, verbose error messages returned to clients, audit logging disabled, unnecessary extensions or stored procedures enabled, or default ports retained where the benchmark advises otherwise.

Why it is Tier 3

These settings determine how much an attacker gains from a partial compromise. Verbose errors accelerate injection exploitation; disabled audit logging removes the record of what was accessed; unnecessary extensions provide privilege-escalation paths. None is exploitable alone, all reduce the effort required once another finding is exploited.

How to detect it

1. 1Run a CIS Benchmark assessment for the specific database engine and version.
2. 2Confirm error verbosity is suppressed for client-facing responses.
3. 3Check whether database audit logging is enabled and forwarded to central storage.
4. 4Inventory enabled extensions and stored procedures against actual application requirements.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1. 1Apply the benchmark to a non-production instance first to identify application breakage before touching production.
2. 2Suppress detailed errors to clients while retaining full detail in server-side logs.
3. 3Enable audit logging for administrative actions and regulated-data access, forwarding to the central store.
4. 4Remove sample schemas, unused extensions, and unnecessary stored procedures.
5. 5Encode the hardened configuration in the provisioning template so new instances inherit it.

How to verify the fix

Mappings

Other Tier 3 findings in Data Protection