14

Could anyone provide a good resource or check-list for a security review of PostgreSQL?

Improve this question

3 Answers 3

Reset to default
19
+100

The IBM wrote an article on hardening PostgreSQL: Total security in a PostgreSQL database. Should work as a check-list if to apply a bit another way of thinking about problem (switch on hacker mind).

From Owasp there are two papers, focusing on this field: OWASP Backend Security Project Testing PostgreSQL, that describes SQL Injection techniques within the scope of PostgreSQL and OWASP Backend Security Project PostgreSQL Hardening, that describes requirements for secure PostgreSQL setup.

There is also a book, called "SQL Injection Attacks and Defense". Well, the title itself describes the contents. (There is possible to see what is included in.)

PS: probably, it might be interesting to read also about Security-Enhanced PostrgreSQL: http://wiki.postgresql.org/wiki/SEPostgreSQL

Improve this answer
5

The US DoD has a general database security checklist and guide:

http://iase.disa.mil/stigs/checklist/

But not PostGres specifically.

Improve this answer
1

These are the only two books I know that have chapters on PostgreSQL security.

  • The Database Hacker's Handbook, ISBN-13: 978-0764578014 (2005)

  • PostgreSQL Administration Cookbook, ISBN 13 : 978-1-84951-028-8 (2010)

Improve this answer
2
  • 3
    Confusion in relation to the term 'resource', I was using that to mean on-line resource (web pages to read etc.) But thank you for the sales pitch.
    – David Stubley
    Mar 12, 2011 at 9:05
  • 2
    Sorry about that, I thought you meant you were looking for people to help you. I've edited my original response accordingly.
    – user1715
    Mar 22, 2011 at 12:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .