Database servers should not be exposed to the public internet. Access should be restricted to application servers via firewall rules.