🗄️ Sherlocked Security – Database Security Assessment
Safeguard Your Most Critical Asset – The Data – Through Deep Technical & Configuration Review of Your Databases
📄 1. Statement of Work (SOW)
Service Name: Database Security Assessment
Target Systems: MySQL, PostgreSQL, MSSQL, Oracle DB, MongoDB, Redis, Cassandra
Client Type: Fintech, E-commerce, SaaS, Healthcare, Government
Service Model: Remote + On-Prem Support
Compliance Coverage: PCI-DSS, HIPAA, ISO 27001, NIST 800-53, CIS Benchmarks
Scope Includes:
- Authentication & Access Control Review
- DB User Roles and Privileges Audit
- Encryption in Transit & at Rest Validation
- Stored Procedures / Function Analysis
- Audit Logs & Logging Configuration
- SQL Injection Testing (Apps + Direct)
- Backup Storage and Integrity Review
- Default Accounts and Misconfigurations
🧠 2. Our Approach
🔹 Identify configuration weaknesses that allow privilege escalation
🔹 Test resilience against SQL injection and internal misuse
🔹 Ensure encryption, logging, and data retention are compliant
[DB Discovery] → [User Role Review] → [Config + Encryption Audit] → [Injection & Abuse Testing] → [Backup + Audit Log Check] → [Compliance Mapping] → [Report + Fix Advisory]
🧪 3. Methodology
[Enumerate Database Instances] → [Access Control & User Permissions Audit] → [Configuration & Encryption Settings Review] → [Abuse Simulation & SQL Injection Tests] → [Stored Procedure/Trigger Inspection] → [Logging & Audit Trail Evaluation] → [Backup Configuration Assessment] → [Reporting & Fixes]
📦 4. Deliverables to the Client
- 📜 Database Security Audit Report:
- Default/misconfigured access control
- Insecure stored procedures, triggers
- Encryption validation
- SQL Injection/abuse vectors (manual + automated)
- Logging & audit gaps
- CVE/CVSS ratings for DB engine vulnerabilities
- 🔐 Access Control Map (Users vs Privileges)
- 📦 Backup and Disaster Recovery Findings
- 📊 Risk Matrix with Exploitable Paths
- ✅ Compliance Readiness Mapping (e.g., PCI, HIPAA)
- 🛠️ Actionable Hardening Recommendations
🤝 5. What We Need from You (Client Requirements)
- ✅ DB type and version info
- ✅ Admin or read-only credentials (testing scope)
- ✅ Sample applications or queries to simulate access
- ✅ Backup and log storage policy documents
- ✅ Schema access for stored procedures/triggers
- ✅ Access windows for testing in production or staging
🧰 6. Tools & Technology Stack
- 🔍 DB Review Tools: SQLMap, Nmap NSE, Metasploit Modules
- 🧠 Static Analysis: Manual query/code review for SQL injection
- 🛡️ Configuration Checklists: CIS Benchmarks, db-audit-scripts
- 💾 Backup & DR: Bacula, custom script audits
- 🔓 Custom scripts for privilege escalation checks
- 🔄 Supported Engines: MySQL, MSSQL, PostgreSQL, Oracle DB, MongoDB, Redis, CouchDB, etc.
🚀 7. Engagement Lifecycle (Lead → Closure)
1. DB Inventory Gathering → 2. Scope + Access Finalization → 3. Config + Role Audit → 4. Injection & Abuse Tests → 5. Logging + Backup Review → 6. Compliance Mapping → 7. Reporting & Remediation Plan → 8. Optional Retest & Closure
🌟 8. Why Sherlocked Security? (Our USP)
| Feature | Sherlocked Advantage |
|---|---|
| 🔐 Deep Privilege Escalation Testing | Map user roles and detect over-permissioned accounts |
| 🧠 Query/Procedure Abuse Discovery | Find risky triggers, views, dynamic queries |
| 📜 SQL Injection Simulation | Application-layer and DB-level SQLi testing |
| 📦 Backup & Disaster Audit | Validate DB copies and access restrictions |
| 🛡️ Encryption + Config Review | Check TDE, TLS, secrets storage, configs |
| 🎓 PCI-DSS / HIPAA Mapping | Reporting that supports audits and fixes |
📚 9. Real-World Case Studies
🗃️ Stored Procedure Used for Data Extraction
Client: Fintech App
Issue: Stored procedure exposed customer PII to low-privilege role
Impact: Lateral data exfiltration via API chaining
Fix: Role restriction, input validation, audit logging enabled
🔐 Unencrypted Backups in Public Cloud Storage
Client: Healthcare SaaS
Issue: Weekly DB backups not encrypted at rest
Impact: Regulatory violation (HIPAA)
Fix: Enabled server-side encryption, rotated access keys
🛡️ 10. SOP – Standard Operating Procedure
- DB Inventory and Type Identification
- ACL and Role Review
- Config Review Against CIS Benchmarks
- Manual and Automated SQL Injection Testing
- Stored Procedure and Trigger Audit
- Backup Encryption and Integrity Check
- Logging and Audit Trail Verification
- Report and Risk Matrix Delivery
- Patch/Remediation Advisory
- Retesting & Compliance Support
📋 11. Database Security Checklist (Preview)
- Identify and enumerate databases and versions.
- Check for weak or default credentials.
- Test for SQL injection vulnerabilities.
- Evaluate access controls and privileges.
- Assess database audit logs and triggers.
- Review stored procedures and functions.
- Check data encryption at rest and in transit.
- Analyze backup storage and accessibility.
- Evaluate authentication and session handling.
- Test for misconfigurations and outdated patches.
📬 Contact Us or 📅 Book a Consultation