Securing Your Database Dynamic DB Credentials by Sebastianus Kurniawan Hadisantoso & M. Yahya Harlan

1. PAGE
1
DEVOPS INDONESIA
PAGE
1
DEVOPS INDONESIA
Sebastianus Kurniawan Hadisantoso & M. Yahya Harlan
PAYFAZZ
Jakarta, 12 Agustus 2021
Securing Your Database:
Dynamic DB Credentials

2. Securing Your Database:
Dynamic DB Credentials

3. Speaker Profile
Sebastianus Kurniawan Hadisantoso
Vice President Engineering - Payfazz Teknologi Nusantara
- https://www.linkedin.com/in/sebastianuskh/
- https://github.com/sebastianusk

4. Speaker Profile
Muhammad Yahya Harlan
Site Reliability Engineering - Payfazz Teknologi Nusantara
- linkedin.com/in/mohdyahyahrln
- anakaiti.net

5. Let’s Begin With A Story

6. Once upon a time,
there is a happy developer…
Who need access to the DB

7. He ask the DBA, get the connection
String. Then, he use it… Everywhere...

8. It is hard to change everything. The
paper might be read by someone else
that is not allowed

9. How To Secure It?

10. “AAA” Computer Security
1. Authentication
2. Authorization
3. Accounting

11. Authentication
We need to make sure that the developer is the real one

12. Authorization
We need to make sure that the access is enough, not over
granted or lack of permission, maybe create roles for every
usage?

13. Accountability
Access should be auditable, the authorized person can check
the historical access

14. Avoid Human Vulnerability:
- Password Rotation
- Easy to remember password

15. Components

16. Vault
- Handles credential lifecycle
- Authenticates users & services
- Policy mapping
- Audit Logging
- AAA

17. Google
- User directory
- Groups for authorization
- Authentication

18. Kubernetes
- Service attestation
- Secret injection
env:
- key: DB_CONNSTR
value: vault:database/creds/...
- Secret lifecycle

19. Database
- Dynamic user creation
- Database roles
Write Read Delete
Apps
Engineers
Readonly

20. Demo Time!
github.com/anakaiti/dynamic-db-credentials-demo

21. Benefits

22. Authentication
1. We can be sure that user is legitw

23. Authentication - Improvement
Enforce password policy: password rotation, multi
authentication

24. Authorization
1. Easy to manage user
2. Multi level Authorization

25. Authorization - Improvement
1. Using IDP that support grouping

26. Accountability
1. Auditable Log can be reviewed

27. Accountability - Improvement
Send the log data to a better place to store auditrail log

28. Password Rotation
1. Auto rotation
2. Even better, the Human no need to know the
credentials!

29. Other Vault Use Cases

30. Vault K/V

31. Vault SSH

32. Any Questions?

33. We Are Hiring!
career@fazzfinancial.com

34. Stay Connected With Us!
t.me/iddevops
DevOps Indonesia
DevOps Indonesia
DevOps Indonesia
@iddevops
@iddevops
DevOps Indonesia
Scan here

35. PAGE
35
DEVOPS INDONESIA
Alone We are smart, together We are brilliant
THANK YOU !
Quote by Steve Anderson