I run a multiplayer gaming service that provides a server list for clients and servers. At the moment it uses an SQLite database stored locally (which is insecure in itself). I am drawing up plans to convert it to either MySQL or Microsoft SQL Server in order to provide redundancy and also the ability to view real-time server statistics online.

Now, knowing that a single database is a disaster waiting to happen (plus it is a gigantic attack vector, too) I plan to introduce redundancy by:

  • Having two database servers, one for internal and one for web (web will be a slave to internal, but the flow of data will not be bidirectional);
  • Web database will be completely cleared and regenerated when data duplication takes place from the internal database;
  • Web will not have account information stored on it;
  • Non-default ports will be used and the firewall will be restricted to only allow specific hosts to connect;

Am I being over-zealous with my security precautions, or should I be adding more layers of security?

Some statistics that may influence any answers:

  • 44.8% of players are Russian;
  • The service sees around 50 billion requests (admittedly they're small) each month;
  • There are around 50 new users each month, with this number steadily increasing (and will see a spike in a couple of months when I start advertising it);
  • It runs on AWS EC2 servers (I plan to use AWS RDS for the databases)
  • 1
    Why MySQL or M$Sql over Aurora? Jun 16, 2016 at 20:02
  • @RobertMennell MSSQL for me is easier to use (more experience), and Aurora is something I'm considering.
    – AStopher
    Jun 16, 2016 at 20:03
  • 1
    If you can use MySQL Aurora is the way to go. Then you can have triggers all over the place. Jun 16, 2016 at 20:05
  • @RobertMennell M$Sql Jun 16, 2016 at 22:38

1 Answer 1


I suggest a more proactive approach as well by doing your own penetration testing against a non-production server setup specifically for this sort of thing.

We use BurpSuite's scanner feature to test our own products - it has really helped augment our quest to find vulnerabilities. ZAP is a free alternative I've heard good things about, but have not personally used it. Pay particular attention to any SQL injection issues they identify.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .