Who is able to physically access your database hardware? Can you or any of your employees walk up to it? If so, who? If someone had a gun to your head and deman

Who is able to physically access your database hardware? Can you or any of your employees walk up to it? If so, who? If someone had a gun to your head and demanded your username and password list or they'd shoot you, how would you get the data for them? Who knows the sensitive database passwords? Where are they stored? How often are they changed? Have you fired anyone recently? Was their access revoked and were all passwords changed? Things you didn't mention as precautions are protections from SQL injection attacks (I'm assuming you're using prepared statements) and that you're using huge passphrases, along with making sure that your applications are up to date with the latest security patches.