Security Published January 5, 2026 Databases hold an organization's most valuable and most regulated information. This checklist summarizes the controls we review first in SQL Server, PostgreSQL and MySQL environments. Use it as a starting point for your own assessment. 1. Patching and supported versions Run a supported version. SQL Server 2016 reached the end of extended support in July 2026 and no longer receives security updates. Apply cumulative or security updates on a regular, tested schedule. Keep operating systems, drivers and client libraries current as well. 2. Identity and access Prefer centralized identity (Active Directory or Microsoft Entra ID) over local SQL logins. Grant least privilege through roles; avoid sysadmin and db_owner for applications. Disable or rename default administrative accounts and remove orphaned users. Review access at least quarterly and whenever staff change roles. 3. Encryption Encrypt data at rest with Transparent Data Encryption (TDE) or storage encryption. Require TLS for all client connections. Encrypt backups and store certificates and keys separately from the data. Use Always Encrypted or column-level encryption for highly sensitive fields. 4. Application security Use parameterized queries or stored procedures - never build SQL by concatenating user input. Keep connection strings and passwords out of source code and version control. Return generic error messages to users and log details securely. 5. Auditing and monitoring Audit logins, permission changes and access to sensitive tables. Send audit logs to a central, tamper-resistant location. Alert on unusual activity such as failed login spikes or large exports. 6. Backup and recovery Keep at least one immutable or offline backup copy to recover from ransomware. Test restores regularly and measure recovery time against your RTO. 7. Compliance evidence Regulations such as HIPAA, PCI DSS, SOX and GDPR expect you to show that controls exist and work. Document configurations, keep audit reports, and record access reviews and restore tests. Experts Infotech provides database security assessments, remediation and managed secure operations. A focused assessment is often the quickest way to find and fix the highest risks.
