Database Firewall.

An inline security appliance or proxy that inspects SQL traffic against an allow-list policy and blocks injection, privilege misuse, and unauthorized statements before they hit the database. It belongs to the Defense & Operations category of cybersecurity.

An inline security appliance or proxy that inspects SQL traffic against an allow-list policy and blocks injection, privilege misuse, and unauthorized statements before they hit the database.

A database firewall sits between applications and the database engine — as a network proxy, agent, or reverse-proxy gateway — and parses SQL into a normalized fingerprint that is matched against a learned baseline or hand-crafted allow-list. Statements that deviate (suspicious UNION SELECT, OR 1=1, unexpected DDL, exports to spool tables) are blocked or quarantined. Products such as Imperva SecureSphere DBF, Oracle Database Firewall (Audit Vault and Database Firewall), DataSunrise, and IBM Guardium operate in monitor or blocking mode and integrate with WAFs and SIEMs. Unlike a DAM, which observes and alerts, a database firewall enforces by terminating offending sessions in line.

Defences for Database Firewall typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: DB firewall, SQL firewall.