Securing a MySQL database with more than just username and password
Here are some basic security recommendations.


Set complex password.
Use validate_password plugin.
Disable remote root login.
Disallow incoming traffic apart from your app and report server.
Always create users with the proper host(don't use '%').
Rotate password at every month.
Restrict MySQL data, log and backup directories.
Try to implement SSL communication between the server and the clients.
Restrict SSH access to the server where MySQL installed.
Prevent my.cnf from other users.


This blog may help you to implement more security: 

https://lalitvc.wordpress.com/2017/04/02/basics-of-mysql-administration-and-best-practices/