Database security: Remove superuser role

Question

I've recently heard on some IT-SEC conference, that good idea to secure database (probably against privilege-escalation attack) is to remove superuser role, and leave only user roles.

I imagine that as removing eg. possibility of non-shell logging of database system account and leaving only databases and users where they only have permissions on assigned databases.

Is there any security principle which matches this statement? I'm not convinced, this is right approach.

Answer 1

In your case; the problem which I can have myself understand is related to Access Control. As others have mentioned the principal of least-privilege a similar concept exists called as "separation of duties". This latter concept is mapped with least-privilege concept in a manner where an application is designed to limit access to user based upon his job description.

The main reasoning behind this concept is not to allow single user / admin compromising the whole security.

It works quiet like the same if you have seen the movie hunt for red October, there the submarine captain and key handler both have two pairs of the keys required to activate nuclear missiles.

For e.g in context of database it means closing off the avenues to which a DBA can access the underlying OS - or removing facilities IT administrators' use to access the database - makes it less likely an attacker can compromise it.

The same is better explained in the article taken Segregating DBA And Admin Duties

Don't install the database under the local IT admin account. This means the database is the local admin, and the DBA has admin rights to the local platform. Similarly, if the database is installed as the local IT admin, then the admin can run database commands. You want the database to run as a separate user who is not the domain or local platform administrator. And you want the database files and archives to be readable by only the account the database is installed under.

Answer 2

I'm not sure that Least Privilege is necessarily the correct term for it since least priviledge is more about giving a particular use case no more access than it needs, but it is a fairly established principal that if a feature is not used by any use case, it should be disabled.

Security is about balancing risk vs usability. If a feature has the ability to be abused and is not used, then it is an easy risk to balance. Since there is no benefit and there is risk, you remove it. If there is benefit, then the benefit of the feature must be evaluated compared to the risk of a privilege escalation managing to get a hold of that functionality.