Databases são alvo #1 de hackers. SQL injection, ransomware, data breaches. Checklist completo para proteger dados críticos.
Conceitos Principais
SQL Injection
Input malicioso em queries. Previna: parametrized queries, ORM, validation.
Encryption
At rest: disk encryption. In transit: TLS. Column-level: sensitive fields (SSN, credit cards).
Access Control
Least privilege. App user ≠ admin. RBAC. Network firewall. VPN for remote access.
Auditing
Log todas queries. Track changes. Alert anomalias. Forensics em breaches.
Passo a Passo
- Previna SQL Injection: Parametrized: db.query("SELECT * FROM users WHERE email = $1", [email]). Nunca: db.query(
SELECT * FROM users WHERE email = '${email}'). - Enable Encryption: TLS: postgresql.conf ssl = on. Disk: LUKS (Linux) ou cloud encryption. Column-level: pgcrypto extension.
- Restrict Access: CREATE ROLE app_user. GRANT SELECT, INSERT ON users TO app_user. Revoke superuser. Firewall: allow apenas app IPs.
- Audit Logging: pg_audit extension. Log connections, queries, DDL. Ship logs to SIEM. Alert on DROP, DELETE sem WHERE.
- Backup Encrypted: Encrypt backups. Store off-site. Test restore. Retention policy. Never plain-text.
Boas Praticas
Recomendacoes
• Parametrized queries sempre
• TLS em transit
• Encryption at rest
• Least privilege access
• Network firewall
• Audit logging ativo
• Regular security audits
• Encrypted backups
• Patch DB regularly
• Monitor anomalies
• Incident response plan
• Compliance (GDPR, SOC2)
• Secrets em Vault
• MFA para admin access
• Regular penetration testing
Erros Comuns
Evite estes erros
• String concatenation em queries
• No encryption
• Root access para app
• DB pública na internet
• No audit logs
• Plain-text backups
Checklist
- SQL injection prevenida
- TLS enabled
- Encryption at rest
- Access control configurado
- Audit logging ativo
- Backups encrypted
- Firewall rules definidas
- Security audit realizada