Database security

Hi

I recently hosted a web app on a server which constantly modifies a simple MySQL DB that is present on the same server. My actual back end processing is done by a .NET based system that accesses this same MySQL DB remotely. For this, I configured the MySQL server to accept all incoming connections on port 3306, and added a user role for the same. All is working well, but it got me thinking whether it is a security flaw to keep MySQL accepting connections.

How does any web app communicate with MySQL? What protocol is used? Is there any way to secure it using SSH or something?

Thanks.

Edit : Formatting