In any information system around the world, the most important asset an enterprise has is undoubtedly the database. This repository contains all the vital data and information. Needless to say, a lot of stress is laid on religiously protecting the database. In case of web based systems, this protection becomes extremely vital because of the numerous threats it faces just by being part of a huge network of computers which internet has become. MySQL can be guarded and protected by using both the built-in security features and by using third party tools to protect and restrict access to the MySQL database.
Security in MySQL is based primarily on Access Control List (ACL); which is actually a list of permissions granted to various users for the various database objects. Keeping this in mind, first of all a database administrator should not give access to the users table, which contains details of all the authorized users to the MySQL database, to anybody and everybody. One, who is entrusted with managing the information system, should be well versed with the MySQL Privilege system. By using key commands associated with this privilege system like REVOKE and GRANT, you can easily award or restrict access to the various objects at various levels.
A common mistake a novice information manager make is, storing passwords in the plain text format, which makes it easier for anybody who managed to sneak into your system to steal all the crucial user credentials associated with the system and ultimately acquire complete access to your database. It is always wise to use some sort of encryption algorithm like SHA1() and MD5() to store the data in an encrypted manner, which makes decoding of the actual password extremely difficult if not impossible.
Regarding passwords, one should be careful not to use commonly recognized words from the dictionary because today special software exists which can easily crack such easy sounding passwords. Instead one should formulate an intelligent assortment of letters and digits, which could make it very tough for an individual or system to even come closer to breaking your lock.
All the information systems, around the world are equipped with data entry screens, which make it easier and convenient for a non technical user to enter data into the database without caring about the internal and vital details of the database. So care should be taken to devise a programming logic, which prevents entry of invalid and wrong data.
Last but not the least, use of an effective firewall could turn to be a smart decision, as it not only protects your MySQL database but also your entire server.