3. Don't let your DB engine execute random executable like wget/dd (Apparmor/SELinux)
4. Don't let your DB host make outbound connections (iptables/ip6tables)
4. Don't let your DB host make outbound connections (iptables/ip6tables)
Which can also be prevented with SELinux