You're troubleshooting database connectivity on public networks during travel. How do you ensure security?

Most public Wi-Fi hotspots won’t be sophisticated enough to block VPNs, some internet service providers can use an IP lookup tool to find the IP address associated with a VPN provider, then use a firewall to block that IP address. If any hacker is sniffing around that network, your details may have just been picked up. When tethered to public Wi-Fi, don’t use the connection to access any accounts that hold sensitive information.

There's always a chance that a public wifi will have a firewall that blocks the ports you need for your VPN / remote desktop to work. And often they're just too slow. If you're planning to work on the go, see if it's at all possible to have hotspot data access via your phone or tablet. This might include buying a data SIM card from a foreign provider ahead of travel.

We can implement MFA for database access to add an extra layer of security. Enable auditing and logging features to track access and modifications to the database. This helps in detecting and responding to any suspicious activities. Regularly update the database software to ensure that any known vulnerabilities are patched. Outdated software is a common entry point for attackers.

Need to start with restricting access to the database by allowing connections only from specific IP addresses or IP ranges. This is known as IP whitelisting. Only trusted and authorized IPs should be allowed to connect. If possible, place the database in a DMZ (Demilitarized Zone), where it is isolated from both the internal network and the public internet, with firewalls on both sides controlling access.

If using a cloud service like AWS, enable IAM database authentication. This allows users to authenticate using their IAM credentials, eliminating the need for storing passwords directly in the database. Require users to connect via a VPN or through a bastion host before accessing the database. This ensures that only authenticated users within the secure network can access the database. Implement Role-Based Access Control (RBAC) to ensure users only have the permissions necessary to perform their jobs. Users should not have administrative or unnecessary access to the database unless absolutely required.

If you're traveling abroad, remember that some of your existing MFA apps will want to be able to send you a text. If you're like me and have dozens of MFA definitions to keep track of, the SMS / text option is often preferable to using authenticator apps because it survives losing or changing your device. And for authenticator apps, make sure you periodically back up the definition restore QR code in a safe location.

When troubleshooting a database on a public network, encrypt data to protect it from interception. Start by enabling SSL/TLS encryption on the database server and use tools that support encrypted connections. Utilize a VPN to create a secure tunnel for all traffic or set up SSH tunneling to encrypt database connections. Encrypt backups and logs with tools like gpg before transferring. Implement strong authentication methods, such as multi-factor authentication (MFA) and strong passwords, and use secure remote access tools like SSH or RDP with Network Level Authentication (NLA) to ensure data safety. Thank you