Best practice for securing user accounts for a MySQL

Q:

Which of the following are considered best practice for securing user accounts for a MySQL installation? Select all that apply.
Hint: This question goes somewhat further than what was covered in the lecture so you will probably need to do some reading to correctly answer this question.
1.
When connecting to a database, never send the password on the command line or code it in plain text into the front end. You can use a properties file, and can hide it by moving it elsewhere and/or changing its name. Better yet, use the mysql_config_editor to store authentication details in an encrypted file.
2.
Any code used to set up users and/or update passwords from the front end needs to ensure that communications with the database are encrypted so that passwords are not sent across the network in plain text.
3.
A MySQL account should only have the privileges that it absolutely needs; different user profiles generally warrant the creation of different accounts. Only administrative accounts should have access to things like triggers and procedures, and they should be restricted to logging in from specific IP addresses (or localhost) where possible.
4.
When giving edit privileges to a user, it is best to have them log in through a front end that does initial checks for attacks such as SQL injection. This front end should communicate via the database through specific procedure calls to insert or update data, to limit the ways in which data is changed. Such procedures should also perform data integrity checks before allow data to be changed.
5.
None of the above.

 

Solution:

1>
When connecting to a database, never send the password on the command line or
code it in plain text into the front end. You can use a properties file,
and can hide it by moving it elsewhere and/or changing its name.
Better yet, use the mysql_config_editor to store authentication details in an encrypted file

I feel the proper method to get passwords for MYSQL servers is to , to have a sign on prompt and get client to enter
the passwords. or have a secured , protected file to save the password.
so coding password in a plain text is highly unadvisable or getting it from command line.
and saving it in a config file using mysql_config editor is advisable.
so option A in your question is one among the best options to secure accounts.

2>Any code used to set up users and/or update passwords from the front end needs to ensure that communications with the database are encrypted
so that passwords are not sent across the network in plain text.
   Communications with database should always be encrypted because, any insert or update statements
might log user passwords as it is. Here privileges comes into picture, only user with super privileges should be allowed to update passwords.
so when password is entered from front end , it should be shown as ******.
also hashing the password , before it travels from user end to database also using secure networks such as https instead of http is a plus.
storing passwords in encrypted way , there is also unique salts for each encrypted passwords, ensure double security.
so option B in your question is one among the best options to secure accounts.
3>yes this is right, we cannot give all privileges to all users in system.
we should have administrative accounts/admins at different levels.
so option C is also one among the best options to secure accounts.
4>so when we are granting edit privileges to user, initially we would have to login as super user or root user.
I feel when entered as super user, we are compromising a lot on security.
its not just the procedures to perform integrity checks, privileges at table level, columns level, proxy privil, along with procedure privileges should be taken care of.
so option 4 is all good, but not the best among 4 described here.