Database protocols define how applications communicate with database management systems. Understanding these protocols is essential for implementing effective security controls and protecting sensitive data in transit.
Common Database Protocols
MySQL Protocol (Port 3306)
Features SSL/TLS encryption, multiple authentication plugins, and connection compression. Vulnerabilities include unencrypted connections exposing queries and older authentication methods susceptible to replay attacks.
PostgreSQL Protocol (Port 5432)
Implements SSL/TLS with certificate verification, scram-sha-256 authentication, and channel binding. Best practice: Use scram-sha-256 and require SSL for all connections.
SQL Server TDS Protocol (Port 1433)
Features transport encryption, Windows integrated authentication (Kerberos), and Always Encrypted for column-level encryption.
MongoDB Wire Protocol (Port 27017)
Supports TLS/SSL encryption, SCRAM-SHA-256, X.509 certificates, and LDAP/Kerberos integration.
Security Best Practices
- Encrypt All Connections: Never transmit database traffic unencrypted
- Strong Authentication: Use certificate-based auth where possible
- Network Segmentation: Place databases in isolated segments
- Monitor Protocol Traffic: Use DAM solutions to parse traffic
- Patch Regularly: Monitor security advisories and apply patches
Protocol-Level Attacks
Man-in-the-Middle: Defend with TLS and certificate verification. SQL Injection: Use parameterized queries. Authentication Bypass: Disable legacy authentication methods. Denial of Service: Implement rate limiting.