Database Access

The information stored/managed in the database, such as the list of tables, shall be identified and continuously kept up to date and managed.

• Identify the list of tables used in the database, the information stored, correlations, etc.
• Identify the storage location of important information and personal information (database and table name/column name) and the current status (number of records, whether encrypted, etc.)
• Regularly survey the database status and keep it up to date

The applications, information systems (servers), and users that need access to information within the database shall be clearly identified and controlled in accordance with the access control policy.

• Divide database access privileges into administrator (DBA) and user, and establish/implement an access control policy by duty (access control at the table, view, column, and query level based on the principle of least privilege, etc.)
• Restrict access to tables and columns containing important information so that only those with business authority to process them can access them
• Distinguish accounts granted DBA privileges from accounts granted other privileges such as inquiry
• Restrict shared use of accounts used by applications and user accounts
• Restrict the commands usable per account
• Delete unused accounts, test accounts, default accounts, etc.
• Automatically block connection when no task is performed for a certain period of time
• Restrict database access by unauthorized persons
• Restrict databases storing personal information from being located in publicly exposed networks such as the DMZ
• Block unauthorized access from other network zones and other servers
• Restrict the IP addresses, ports, and applications permitted to access the database
• As a rule, take measures so that general users can access the database only through applications, etc.