Database and Web Server Configuration Review

Flow chart of the Database and Web Server Configuration engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Baseline Selection. We list the database engines and web servers in scope and select the matching CIS Benchmark, such as CIS Microsoft SQL Server, Apache or Nginx. Activities: Inventory database engines, versions and hosting locations; Inventory web servers and reverse proxies in scope; Select the matching CIS Benchmark per engine and server; Agree which instances allow safe active validation. Hands over Tier Inventory and Baseline Selection. Phase 2, Evidence and Config Collection. We gather configuration files, parameters and access settings as read-only evidence, using DBeaver and server config exports. Activities: Export database instance parameters and startup settings; List database logins, roles and object-level grants; Collect Apache, Nginx and IIS configuration files and modules; Record TLS certificate, protocol and cipher settings per endpoint. Hands over Tier Configuration Evidence Set. Phase 3, Benchmark Comparison. We run CIS-CAT Pro against each tier and map results to CIS controls and vendor hardening guides. Activities: Run CIS-CAT Pro against each database and web server; Run Nessus database compliance policies where supported; Map failed checks to CIS control numbers per engine; Score each instance against its benchmark. Hands over CIS Benchmark Scorecard Per Instance. Phase 4, Manual Review and Safe Validation. We review authentication, encryption, permissions and logging by hand, then safely validate exposure with Nikto, testssl.sh and read-only sqlmap checks where appropriate. Activities: Check for default accounts, shared logins and weak SQL authentication; Review TLS ciphers and protocols with testssl.sh; Scan web servers with Nikto for exposed files and headers; Run read-only sqlmap checks on agreed endpoints; Verify audit logging captures privileged database activity. Hands over TLS and Access-Control Assessment. Phase 5, Prioritised Findings. Findings are ranked by exposure to your data, with affected instances listed so remediation is precise. Activities: Rank findings by how close they sit to sensitive data; Name the affected instances and endpoints per finding; Separate settings changeable live from those needing a restart; Walk the database and platform owners through the results. Hands over Database and Web Server Findings Report. Phase 6, Remediation and Re-Check. We provide hardening guidance per engine and server, then re-check to confirm the settings and TLS grades have improved. Activities: Write hardening steps per engine with exact parameter values; Provide tested TLS configuration blocks for each server type; Advise on sequencing changes around maintenance windows; Re-run the benchmark and TLS checks and reissue the grades. Hands over Hardening Runbook and Re-Check Report. Each phase begins from the artefact the phase before it produced.