security_skill

Overview

This skill teaches practical database security: access control, encryption, SQL injection prevention, and auditing. It focuses on actionable configuration and patterns to protect data, control privileges, and meet compliance requirements. It pairs defensive techniques with monitoring and forensic-ready logging.

How this skill works

The skill inspects and hardens authentication, authorization, and privilege models (RBAC, row- and column-level rules) and shows how to apply least privilege. It demonstrates code- and database-level protections against SQL injection, encryption options (TDE, column-level, TLS), and key-management basics. It also covers audit logging, change tracking, and mapping controls to GDPR/PCI/HIPAA requirements for compliance and investigations.

When to use it

• Designing or refactoring database schemas with security in mind
• Implementing application-to-database access controls and least-privilege models
• Hardening production databases against injection and data exfiltration
• Preparing systems for compliance audits (GDPR, PCI-DSS, HIPAA)
• Implementing encryption and key management for sensitive data

Best practices

• Apply least privilege and role-based access; grant broad rights only to administrative roles
• Use parameterized queries or prepared statements; validate inputs at the application boundary
• Enable TLS for client/server connections and encrypt data at rest with managed keys
• Implement column-level encryption or tokenization for high-risk fields (PII, payment data)
• Centralize audit logging and retain immutable logs for investigation and compliance
• Automate periodic privilege reviews and rotate keys and credentials on a regular schedule

Example use cases

• Build RBAC and row-level policies for a multi-tenant SaaS database
• Harden an application stack to eliminate SQL injection vectors using ORM best practices
• Deploy Transparent Data Encryption and manage keys for compliance with PCI or HIPAA
• Set up audit trails and change tracking to support incident response and forensic analysis
• Design data retention and masking strategies to comply with GDPR data subject requests