Databases
Database technology is the foundation of nearly all modern applications, defining how data is structured, stored, and retrieved. In the context of cybersecurity, databases are the ultimate high-value target; their security is paramount as their compromise leads directly to mass data theft or system integrity failure. The cybersecurity posture differs significantly based on the database model employed.
Relational & SQL Databases
Relational databases, such as MySQL and PostgreSQL, organize data into rigid tables with pre-defined schemas, enforcing clear relationships between data elements. They primarily use Structured Query Language (SQL) for management and manipulation.
Cybersecurity Context: The rigidity and maturity of SQL make them well-understood but prime targets for specific attacks:
SQL Injection (SQLi): This is the classic threat. Attackers exploit flaws in an application's input handling to insert malicious SQL commands, tricking the database into dumping all its content, granting unauthorized access, or modifying records.
Access Control: Security relies heavily on proper configuration of user roles and permissions. A misconfigured system allows users with low privileges to escalate their access and compromise sensitive tables.
Data Consistency: The emphasis on atomic, consistent, isolated, and durable (ACID) properties means that unauthorized data modification is particularly damaging, as it affects the verifiable truth of records across an entire application.
NoSQL & Search Stores
NoSQL databases, such as MongoDB and CouchDB, and Search Stores, such as Elasticsearch and Solr, are non-relational, schema-less, and designed for flexibility, rapid scaling, and handling diverse data types (like documents, key-value pairs, or graphs).
Cybersecurity Context: The decentralized, flexible nature of NoSQL introduces different risks, often stemming from misconfiguration:
Default Configuration Exposure: Many NoSQL and search store instances are notoriously vulnerable to being left with default configurations (e.g., no authentication, public-facing ports) when deployed in the cloud, leading to unauthenticated data exposure and data ransom attacks.
Insecure Data Handling: Since NoSQL often handles unstructured data, sensitive fields (like PII) may be inconsistently or insecurely stored across various documents, making them harder to track, sanitize, or secure uniformly compared to the defined columns of a SQL table.
Lateral Movement: If a search store is compromised, it can provide attackers with a map of the entire environment (due to its function in indexing application data), facilitating lateral movement through the network.
In summary, protecting Relational Databases focuses on defending against established code injection techniques and ensuring strict access control, while securing NoSQL & Search Stores primarily focuses on preventing basic, yet catastrophic, configuration errors that leave entire data sets publicly exposed.
ThreatNG provides crucial external visibility and risk management for an organization’s database technology, focusing on the external exposure of both Relational & SQL Databases and NoSQL & Search Stores, which are high-value targets for attackers.
External Discovery
ThreatNG's strength is its ability to perform External Discovery through purely unauthenticated scanning, seeing database infrastructure the same way an attacker does—without needing internal access or connectors.
Technology Stack Investigation Module: This module identifies the specific database technologies in use by scanning exposed ports and services. It identifies the vendor and version of relational databases like MySQL and PostgreSQL, or NoSQL/Search Stores like MongoDB and Elasticsearch.
Domain Intelligence: ThreatNG discovers subdomains that might inadvertently expose a database or an administrative interface, such as
admin-db.company.comorsearch-api.company.com. This is the first step an attacker takes to find exploitable endpoints.
External Assessment and Examples in Great Detail
ThreatNG’s External Assessment capabilities immediately quantify the risk posed by discovered database assets.
Database Exposure Susceptibility (NoSQL & Search Stores): ThreatNG actively probes exposed ports and configurations associated with NoSQL databases and Search Stores. A classic example of an easily exploitable database is a MongoDB instance left publicly accessible on its default port with no authentication enabled. ThreatNG identifies this catastrophic misconfiguration and assigns a high Database Exposure Susceptibility score, informing the organization that this asset is an immediate data dump risk, often targeted by automated ransom attacks.
Vulnerability Exposure (Relational & SQL Databases): The Cyber Risk Exposure assessment flags known vulnerabilities (CVEs) related to the specific version of a relational database engine. For instance, if the Technology Stack module identifies an old version of PostgreSQL that has a publicly known vulnerability, ThreatNG pinpoints this external exposure, allowing teams to prioritize patching the database host before an attacker can exploit the flaw to gain initial access.
Data Leak Susceptibility: The score is immediately raised if ThreatNG's discovery modules find direct evidence of database-related leakage. This includes finding a publicly exposed configuration file (
.env,.config) on a web server that contains the plaintext connection string, username, and password for the MySQL production database. This finding bypasses the need to exploit the database itself, providing the attacker with immediate privileged access, which ThreatNG's assessment flags as critical.
Investigation Modules
Security teams use the Reconnaissance Hub to pivot from discovery to deep investigation.
Overwatch: This cross-entity vulnerability intelligence system provides an instant impact assessment. If a critical zero-day vulnerability (e.g., an unauthenticated remote code execution flaw) is disclosed for a Search Store like Elasticsearch, Overwatch automatically scans the entire external attack surface for exposed instances useing that technology. It prioritizes the risk based on the severity and likelihood of exploitation (integrating DarCache Vulnerability data), replacing multi-day manual effort with a decisive, prioritized list of databases to secure.
Advanced Search: An analyst can use Advanced Search to filter all assets that have both the "PostgreSQL" technology tag and a "Data Leak Susceptibility" score above 90. This instantly isolates all high-risk relational database hosts, allowing the team to focus on securing the administrative interfaces or patching the application code most likely to suffer a SQL injection attack.
Intelligence Repositories
ThreatNG’s Intelligence Repositories (DarCache) are fundamental to contextualizing database risks.
DarCache Rupture (Compromised Credentials): This informs the assessment by providing data on leaked credentials relevant to database administrators or application service accounts. If a password for the "root" Oracle database account is found in a credential dump, ThreatNG uses this intelligence to score the associated external IP space as critically compromised, raising the Data Leak Susceptibility score.
DarCache Vulnerability: It integrates data from DarCache NVD (severity) and DarCache EPSS (exploitation likelihood) to ensure that vulnerabilities in database software (e.g., a buffer overflow in MongoDB) are prioritized based on actual external threat activity, not just static CVSS scores.
Reporting and Continuous Monitoring
ThreatNG provides Continuous Monitoring and clear reporting for database assets.
Continuous Monitoring: The platform constantly checks for configuration drift. If a firewall rule protecting an external-facing NoSQL API is accidentally removed, the change is immediately detected, a high-severity alert is triggered, and the Database Exposure Susceptibility score for that asset is instantly updated.
Reporting: Reports like the Technical and Prioritized reports document all exposed database assets. The External GRC Assessment Mapping report highlights compliance gaps related to data security standards, showing how exposed ports on a PostgreSQL host violate security requirements.
Complementary Solutions
ThreatNG's external data cooperates with complementary security solutions. The high-fidelity external exposure data, such as the confirmed misconfiguration of an Elasticsearch cluster or the version of a vulnerable MySQL server, can be directly fed into a Vulnerability and Risk Management solution. This enriched context allows the complementary solution to automatically elevate the patching priority for those specific database hosts. Furthermore, the Advanced Search intelligence regarding data leakage (e.g., the location of an exposed database configuration file) can be used to create immediate response playbooks within a Security Monitoring (SIEM/XDR) platform, ensuring internal activity is correlated with a confirmed, high-risk external database exposure.
