Securityintermediate

Network Isolation

Keeping database ports unreachable, and configuring TLS so encryption actually prevents interception.

2 min readIntermediateUpdated 31 Jul 2026Edit this page

The most effective database security control is that unauthorised parties cannot reach the port. Everything else is defence in depth behind it.

Layers

Network placement. Private subnets, no public IP address, no internet gateway route.
Security groups and firewall rules. Allow the application's security group on the database port; deny everything else. Not a CIDR that happens to include the application — the group itself, so the rule stays correct as instances change.
Engine-level host rules. pg_hba.conf, MySQL host-scoped grants, Redis bind and protected-mode, MongoDB bindIp. A second, independent layer.
Bastion or identity-aware proxy for human access, with session logging.

# PostgreSQL
listen_addresses = '10.20.1.5'      # not '*'
 
# Redis
bind 10.20.1.5
protected-mode yes
 
# MongoDB
net:
  bindIp: 10.20.1.5

Verify from outside, rather than assuming the configuration is correct:

nmap -Pn -p 5432,3306,6379,27017,9200 <public-address>

TLS

Encryption in transit protects credentials and data from anyone positioned on the network — which, in a shared cloud environment, is a larger set than it appears.

# PostgreSQL
ssl = on
ssl_cert_file = '/etc/ssl/certs/server.crt'
ssl_key_file  = '/etc/ssl/private/server.key'
ssl_ca_file   = '/etc/ssl/certs/ca.crt'
ssl_min_protocol_version = 'TLSv1.2'

# pg_hba.conf: hostssl, not host, so a plaintext connection is refused.
hostssl shop app_service 10.20.0.0/24 scram-sha-256

Encryption without verification does not prevent interception

A client connecting with sslmode=require encrypts the connection and does not check who it is talking to, so a machine-in-the-middle can present its own certificate and read everything. Use sslmode=verify-full, which validates the certificate chain and the hostname.

postgresql://app@db.internal/shop?sslmode=verify-full&sslrootcert=/etc/ssl/certs/ca.crt

The equivalents: --ssl-mode=VERIFY_IDENTITY for MySQL, tls=true&tlsCAFile=… with hostname verification for MongoDB.

Encrypt replication too

Replication traffic carries the same data as client traffic and is frequently left unencrypted because it runs on an internal network. Enable TLS for replication and inter-node traffic — hostssl replication in PostgreSQL, REQUIRE SSL on the replication user in MySQL, transport TLS in Elasticsearch, node-to-node encryption in Cassandra.

Certificate lifecycle

Egress matters too

A compromised database that can reach the internet can exfiltrate data or fetch tooling. Restrict outbound traffic from database hosts to what they genuinely need: package repositories, the backup destination, and the monitoring endpoint.