vaayaa Inclusive Education
Technical risk assessment

Database Administration and Data Engineering Risk Assessment: Access, Integrity and Recovery Controls

A worked example of how a database and data engineering team identifies, scores and controls the risks that threaten the confidentiality, integrity and availability of data, from credential compromise and misconfiguration to backup failure and privacy duties.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Database Administration and Data Engineering course

Executive summary

This assessment shows how a database and data engineering team can find, rate and control the risks that matter most to the confidentiality, integrity and availability of its data. Eight risks were chosen because they are plausible in daily platform work. Credential compromise is the highest inherent risk because administrator access reaches all personal records. Misconfiguration, backup failure, workstation malware and pipeline errors follow closely. Each risk is scored before controls and again after existing and additional controls. Most residual scores fall to Medium or Low, but privileged access and endpoint risks remain Medium because their impact is serious. The first actions are multi-factor sign in for administrators, a hardened configuration baseline, a tested full restore and separate administration devices. The platform is a teaching example, so every score illustrates method rather than describing a real system.

Focus area
Database administration and data engineering
Setting
Data platform team supporting internal analytics and operational applications in a mid-sized organization
Method
Five by five likelihood and impact risk register

Scope

This assessment covers a shared relational database platform, the data pipelines that load and transform its contents, and the administrator accounts and workstations used to manage both. It considers risks to confidentiality, integrity and availability, privacy duties, logging and recovery. It does not cover application code design or any specific vendor product. Jurisdiction, hosting model, data volumes and the nature of personal data are assumptions made for teaching.

Context

The platform holds customer records, order history and operational reference data used by several internal applications and a reporting team. Database administrators manage servers, user roles, backups and patching. Data engineers build extraction and transformation jobs that run on a schedule and write to shared tables. Administrators use company laptops and a privileged access route, while engineers connect from development environments. Logs are kept centrally for a limited period. Each risk is scored before controls to show its natural level, then again after the existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to keep data accurate, available and confidential, meet privacy and retention duties, and maintain trust with customers, colleagues and regulators. The assets in scope are the production and reporting databases, the pipelines and schedules that feed them, backup copies, administrator accounts and workstations, and the logs that show who did what. Stakeholders include database administrators, data engineers, analysts, the data protection lead, the information security lead, suppliers, customers and the privacy regulator. Every risk has one owner role, and the head of database administration keeps the register current and reports to the data governance group each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain Likelihood 5, impact 4, score 20, critical: H01
4 Likely Likelihood 4, impact 3, score 12, high: H04 Likelihood 4, impact 4, score 16, high: H05
3 Possible Likelihood 3, impact 3, score 9, medium: H08 Likelihood 3, impact 4, score 12, high: H07 Likelihood 3, impact 5, score 15, high: H02 H03
2 Unlikely Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H08 Likelihood 2, impact 3, score 6, medium: H02 H03 H04 H06 H07 Likelihood 2, impact 4, score 8, medium: H01 H05
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Unauthorized access through compromised administrator credentials 20 Critical 8 Medium Head of database administration
H02 Misconfiguration that exposes database services 15 High 6 Medium Database platform engineer
H03 Backup failure and unrecoverable data loss 15 High 6 Medium Database administrator
H04 Pipeline or schema change that corrupts data integrity 12 High 6 Medium Lead data engineer
H05 Phishing and malware on administrator workstations 16 High 8 Medium Information security lead
H06 Insider misuse of privileged data access 10 High 6 Medium Data protection lead
H07 Third-party hosting or tooling exposure 12 High 6 Medium Supplier risk manager
H08 Breach of retention and privacy duties for personal data 9 Medium 4 Low Data protection lead
H01

Unauthorized access through compromised administrator credentials

Technology and data Before 20 After 8

An attacker obtains a database administrator password or session token through reuse, theft or a weak sign in process, then reads, changes or deletes records using privileged rights that were never reviewed.

Who or what is affected: Customers, data subjects, database administrators and reporting users

Causes

Reused passwords, shared service accounts and privileged rights added for convenience and not removed.

Consequences

Data theft, record tampering, regulator notice and loss of customer trust.

Existing controls

  • Administrator accounts require individual logins with a password policy.
  • Privileged sessions are routed through a central access service.

Control gaps

Service accounts with standing privileges are not reviewed, and alerts on role changes are not in place.

Additional controls

  • Prevent: Require multi-factor sign in and short lived credentials for every administrator account.
  • Detect: Alert on new privileged role grants, logins from unknown locations and bulk reads of personal data.
Likelihood 5 x impact 4 before; 2 x 4 after Owner: Head of database administration Target: Within 30 days Early warning: A privileged role granted or used outside an approved change window.
H02

Misconfiguration that exposes database services

Technology and data Before 15 After 6

A listener port, default account, open network rule or weak encryption setting is left in place after a change, making the database reachable or readable by people and systems that should have no access.

Who or what is affected: Data subjects, application owners and the security team

Causes

Manual changes under pressure, copied configuration files and unclear ownership of network rules.

Consequences

Unauthorized disclosure, forced downtime to correct the setting and regulator reporting.

Existing controls

  • Database servers sit behind a network firewall.
  • Changes to server settings are recorded in a change log.

Control gaps

Scans cover servers but not the database listeners or encryption settings.

Additional controls

  • Prevent: Apply a hardened configuration baseline and block default accounts at build time.
  • Detect: Run scheduled configuration scans and report any drift from the baseline within one day.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: Database platform engineer Target: Within 45 days Early warning: A configuration scan result that differs from the approved baseline.
H03

Backup failure and unrecoverable data loss

Operational Before 15 After 6

Backups fail silently, are corrupted, or cannot be restored within the agreed time, so a hardware fault, ransomware event or faulty release leaves the platform without usable data for a prolonged period.

Who or what is affected: Reporting users, operational applications, customers and the support desk

Causes

Storage capacity problems, jobs that report success without validating content and restores that were never rehearsed.

Consequences

Extended outage, lost transactions, missed reporting cycles and breach of service commitments.

Existing controls

  • Daily backups run to a separate storage location.
  • Backup job status is emailed to the administration mailbox.

Control gaps

Restore tests have not been run for the largest database, and mailbox alerts are often ignored.

Additional controls

  • Recover: Test a full restore of a sample database each quarter and record the time taken.
  • Detect: Verify backup checksums and alert when any job misses its window or reports a warning.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: Database administrator Target: Within 30 days Early warning: Two consecutive backup jobs that miss their window or fail verification.
H04

Pipeline or schema change that corrupts data integrity

Operational Before 12 After 6

A transformation job, schema migration or manual update writes incorrect values, drops a column or duplicates rows, and the error spreads into downstream reports and applications before anyone notices.

Who or what is affected: Data engineers, analysts, business decision makers and customers

Causes

Untested transformations, unclear data contracts and direct edits to production tables.

Consequences

Wrong management reports, incorrect customer communications and rework across several teams.

Existing controls

  • Schema changes are reviewed by a second engineer before release.
  • Pipelines write to a staging area before the production tables.

Control gaps

Direct edits are allowed for urgent fixes and are not logged against a change record.

Additional controls

  • Prevent: Require automated tests on row counts, null rates and key uniqueness before a pipeline promotes data.
  • Respond: Pause the affected pipeline, restore the prior table version and notify downstream owners.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Lead data engineer Target: Within 60 days Early warning: A sudden change in row counts or null rates outside the normal range for a table.
H05

Phishing and malware on administrator workstations

Technology and data Before 16 After 8

A convincing email or infected download gives an attacker a foothold on an administrator laptop, where saved connection strings, tools and session tokens can be harvested and reused against the database.

Who or what is affected: Database administrators, data engineers and the data subjects whose records are reachable

Causes

Shared administration laptops, saved passwords in tools and urgent requests that bypass normal checks.

Consequences

Credential theft, data exfiltration and a costly investigation.

Existing controls

  • Endpoint protection runs on all company laptops.
  • Staff complete a short phishing awareness course when they join.

Control gaps

Connection strings are stored in local configuration files, and awareness training is not repeated.

Additional controls

  • Prevent: Use separate administration devices with restricted browsing and no stored database credentials.
  • Detect: Monitor endpoint alerts for credential dumping tools and unusual outbound connections.
Likelihood 4 x impact 4 before; 2 x 4 after Owner: Information security lead Target: Within 30 days Early warning: An endpoint alert for a tool that reads stored credentials on an administrator device.
H06

Insider misuse of privileged data access

People Before 10 After 6

A staff member with legitimate access copies personal records, alters figures for personal gain or looks up records without a business reason, and the activity goes unseen because it looks like normal work.

Who or what is affected: Data subjects, colleagues, managers and the organization's reputation

Causes

Excessive access rights, financial pressure, grievances and weak supervision of routine queries.

Consequences

Privacy breach, dismissal and legal claims, and loss of trust in the platform.

Existing controls

  • Staff sign a confidentiality agreement when they join.
  • Access to the personal data table is limited to named roles.

Control gaps

Query logs are kept but never reviewed unless an incident is reported.

Additional controls

  • Detect: Review query logs for large exports and lookups of records with no matching case reference.
  • Respond: Suspend access at once when misuse is suspected and follow the documented disciplinary process.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Data protection lead Target: Within 60 days Early warning: A user whose export volume is several times higher than their usual pattern.
H07

Third-party hosting or tooling exposure

Supplier Before 12 After 6

A managed hosting provider, monitoring tool or contractor with access to the platform suffers its own breach, outage or staff change, and data or service continuity is affected even though the organization did not cause the event.

Who or what is affected: Data subjects, the procurement team and all platform users

Causes

Reliance on one provider, unclear shared responsibility and contracts that were not reviewed after changes.

Consequences

Loss of service, unclear breach obligations and difficulty moving data to another provider.

Existing controls

  • Contracts include confidentiality and data location clauses.
  • Contractor accounts are created by the platform team and expire at contract end.

Control gaps

Provider evidence is collected at signing but not refreshed during the contract.

Additional controls

  • Prevent: Require a security questionnaire and evidence of recovery testing before onboarding any provider.
  • Respond: Hold a list of alternate contacts and a documented exit plan for each critical supplier.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Supplier risk manager Target: Within 90 days Early warning: A provider notice of a security incident, maintenance window or staff change affecting the platform.
H08

Breach of retention and privacy duties for personal data

Legal and compliance Before 9 After 4

Personal data is kept longer than needed, copied into test or analytics environments without masking, or not deleted when a request is received, so the organization breaches its privacy duties.

Who or what is affected: Data subjects, the legal team and the privacy regulator

Causes

Unclear retention rules, manual copies for testing and deletion requests that are handled by email.

Consequences

Regulatory complaints, fines where applicable, and the cost of responding to data subjects.

Existing controls

  • A retention schedule lists the main tables and periods.
  • Production data is restricted to approved users.

Control gaps

Backups and test copies are excluded from the retention schedule, and deletion is not verified.

Additional controls

  • Prevent: Mask personal fields automatically when data is copied to any non-production environment.
  • Detect: Run a monthly report of records past their retention period and assign them for deletion.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Data protection lead Target: Within 90 days Early warning: Personal records found in a test environment or past their scheduled deletion date.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands. Low covers scores from 1 to 4 and means the risk is accepted and watched. Medium covers scores from 5 to 9 and needs routine controls with a named owner. High covers scores from 10 to 16 and needs a dated plan approved by a senior manager. Critical covers scores from 17 to 25 and needs immediate action and executive attention. Inherent risk is the score before any controls, and residual risk is the score after existing and additional controls. A residual score can never be higher than the inherent score. Impact is judged on data loss, time to restore, privacy harm, regulatory exposure and effect on customers, and a risk is never rated down only because it has not yet happened. Engineers and administrators should challenge the ratings during review, and any rating is reopened when a monitoring indicator reaches its escalation threshold or when the platform changes.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Privileged role grants or administrator logins outside an approved change window.Escalate to the head of database administration at once, and to the information security lead if the access cannot be explained within one working day.
Backup jobs that miss their window or fail verification.Escalate to the database administrator when one job fails, and to the head of database administration when two consecutive jobs fail.
Configuration scan results that differ from the approved baseline.Escalate to the database platform engineer for correction within one day, and to the head of database administration if the drift is still open after three days.
Users whose export volume is several times higher than their usual pattern.Escalate to the data protection lead at once, and suspend access while the activity is reviewed.
Provider notices of incidents, maintenance or staff changes affecting the platform.Escalate to the supplier risk manager within one day, and to the head of database administration if recovery is affected.

Contingency arrangements

If a serious event occurs, such as confirmed credential misuse, ransomware or a data exposure, the head of database administration isolates affected accounts and servers and preserves logs. Backups are restored only after integrity checks confirm they are clean. The data protection lead decides on notification duties with legal advice, and the information security lead coordinates forensic review. Customers and internal users receive early, plain updates on what is known and what is being done.

Prioritized action plan

  1. Enforce multi-factor sign in and remove standing privileges from service accounts, owner head of database administration, within 30 days.
  2. Test a full restore of the largest database and alert on missed backup windows, owner database administrator, within 30 days.
  3. Apply the hardened configuration baseline and scan database listeners, owner database platform engineer, within 45 days.
  4. Move administrator work to separate devices and stop storing connection strings locally, owner information security lead, within 30 days.
  5. Add automated data quality tests before pipelines promote data, owner lead data engineer, within 60 days.

Conclusion

Reliable databases depend on steady habits: multi-factor access for administrators, hardened configurations, tested restores, validated pipelines and regular reviews of who can see personal data. The highest inherent scores sit with credential compromise, misconfiguration and backup failure, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified security, privacy and legal advice for any real system.

Assumptions and limitations

Assumptions

  • Personal data is held, so privacy and data protection duties apply, but the governing jurisdiction is not specified.
  • The platform runs on managed servers with administrator access routed through a central identity service.
  • Backups are taken daily and copied off site, but restore testing frequency is not defined in this example.

Limitations

  • The scores are examples for learning and do not describe any real system, team or incident.
  • Privacy, security and data retention rules differ by country and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed security, legal or privacy advice.

Related frameworks to study

  • Principle of least privilege for accounts and roles
  • Defence in depth across network, host, database and data layers
  • Recovery point and recovery time objectives for backups
  • Three lines model of risk ownership
  • Hierarchy of controls

Technical Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Database Administration and Data Engineering course Read the best practices for this course

More Technical risk assessments

Hourly Active: 45,552 Learners