A hardening assessment per database
45+ built-in checks grounded in recognized database-hardening benchmarks, assessed per connected database and refreshed on a schedule.
AthonisOne module 06 of 08
Database Security
Hardened — or just assumed to be?
Databases are usually assumed to be hardened. This module reads their configuration and security state and evaluates every setting against established hardening benchmarks, so you can see exactly where a database deviates — and what could not be measured at all.
What it answers
The questions this module exists for.
- 01 Are our databases hardened against benchmark best practice?
- 02 Which specific settings deviate, and on which databases?
- 03 What could we not measure, and why?
- 04 Can we prove database compliance to an auditor?
- 05 How is our database posture trending?
What it checks
In detail.
Compliant, deviation, not measured
A clear verdict on every setting. An item that could not be checked is never silently treated as clean.
Configuration and compliance state
Configuration, hardening and compliance state for both Microsoft SQL Server and Oracle Database, with findings mapped to the controls they evidence.
Each pluggable database on its own
An Oracle connection that lands in a pluggable database is audited, scored and named as that database, not merged with the others in its container. Two connections to the same pluggable database are still one database.
Typed findings
Each with the evidence behind it, not just a severity label.
Finding Wiki
A built-in explainer on every finding — what it is, why it matters, what to do.
A posture score
Rolled up from the findings and trended over time.
Compliance evidence
Findings mapped to the framework controls they evidence.
How it judges
Where it refuses to over-claim.
A check that guesses produces false findings, and false findings teach a team to ignore the real ones. These are the places this module holds back.
- A disabled, renamed built-in administrator login is treated as hardened — disabling it is the remedy, so it is not reported again for sitting in the admin role.
- Oracle password limits are read the way Oracle enforces them, including how the reuse limits combine, and a locked account is not reported for still having a default password.
- Unencrypted connections count client sessions only — not the replicas of an availability group talking to each other.
- A server reached through two connections produces one set of findings, not two copies.
- Every database finding has a Finding Wiki page.
What it reads
Connected to what you already run.
- Microsoft SQL ServerConfiguration, hardening and compliance state, over a read-only database connection
- Oracle DatabaseConfiguration, hardening and compliance state, over a read-only database connection
What it never does
The boundary, stated plainly.
- Never writes to a database. The connection is read-only.
Findings from this module evidence the configuration-hardening and technical-controls areas of every activated framework.
Works with
One dataset, so the modules answer each other.
See what Database Security would say about your estate.
Licensed on its own, and on the same platform as every other module. We'll show you the answer — and what it would say it couldn't measure.