DevTalks.ro 2019 What's New in MySQL 8.0 Security
•Descargar como PPTX, PDF•
2 recomendaciones•456 vistas
a 2019 version of the talk.
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Similar a DevTalks.ro 2019 What's New in MySQL 8.0 Security
Similar a DevTalks.ro 2019 What's New in MySQL 8.0 Security (20)
Más de Georgi Kodinov
Más de Georgi Kodinov (20)
Último
Último (20)
DevTalks.ro 2019 What's New in MySQL 8.0 Security
- 1. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL 8.0 What’s New in Security ? Georgi “Joro” Kodinov MySQL SrvGen Team Lead
- 2. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, timing, and pricing of any features or functionality described for Oracle’s products may change and remains at the sole discretion of Oracle Corporation.
- 3. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | Georgi “Joro” Kodinov, MySQL @ Oracle Server General Team Lead Works on MySQL since 2006 Specializes in: Security Client/server protocol Performance monitoring Component infrastructure Loves history, diverse world cultures, gardening A devoted Formula 1 fan (Go, Vettel !)
- 4. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | Program Agenda Security Challenges New Security Features in MySQL 8 New Security Features in MySQL Enterprise Edition MySQL Security Architecture 1 2 3 4 4
- 5. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | 5
- 6. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | Cost of Data Breaches 6 Source: Ponemon Institute, 2018 $1.9M $2.8M $4.6M $6.3M $0 $1,000,000 $2,000,000 $3,000,000 $4,000,000 $5,000,000 $6,000,000 $7,000,000 Less than 10,000 10,000 to 25,000 25,001 to 50,000 Greater than 50,000 Records Small to Medium Breaches $199M $279M $325M $350M $0 $50,000,000 $100,000,000 $150,000,000 $200,000,000 $250,000,000 $300,000,000 $350,000,000 $400,000,000 20 Million 30 Million 40 Million 50 Million Records Mega Breaches
- 7. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | Regulatory Compliance • Regulations – PCI – DSS: Payment Card Data – HIPAA: Privacy of Health Data – Sarbanes Oxley, GLBA, The USA Patriot Act: Financial Data, NPI "personally identifiable financial information" – FERPA – Student Data – EU General Data Protection Directive: Protection of Personal Data (GDPR) – Data Protection Act (UK): Protection of Personal Data • Requirements – Continuous Monitoring (Users, Schema, Backups, etc.) – Data Protection (Encryption, Privilege Management, etc.) – Data Retention (Backups, User Activity, etc.) – Data Auditing (User activity, etc.) 7
- 8. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | How to Secure your Databases Assess Locate Risks and Vulnerabilities, Ensure that necessary security controls are Prevent Using Cryptography, User Controls, Access Controls, etc Detect Still a possibility of a breach – so Audit, Monitor, Alert Recover Ensure service is not interrupted as a result of a security incident Even through the outage of a primary database Forensics – post mortem – fix vulnerability 8
- 9. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | New Security Features in MySQL 8.0 9
- 10. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | 10 MySQL Security Overview Authentication Authorization Encryption Firewall MySQL Security Auditing New! Masking/De-Identification • Available in 5.7.24 & 8.0.13 • Will be in MySQLaaS as well
- 11. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | New! MySQL Roles Improving MySQL Access Controls • Introduced in the 8.0.0 DMR • Easier to manage user and applications rights • As standards compliant as practically possible • Multiple default roles • Can export the role graph in GraphML 11 Feature Request from DBAs Directly Indirectly Set Role(s) Default Role(s) Set of ACLS Set of ACLS
- 12. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | SQL Roles Implementation: MySQL Extras • Roles can have an optional host part (not currently used) • Pre-roles ACL code is used when there’s no active role(s) • Users can be assigned several roles • Users can have zero or more default roles • Active Roles can be changed – from various assigned roles – For example just escalate or change privileges from within an application for certain operations 12
- 13. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | Role Examples 13
- 14. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL Enterprise Masking and De-Identification New in MySQL 8.0.13 AND 5.7.24! • Data De-identification helps database customers improve security • Accelerates compliance for – Government – GDPR, CHHS – Financial - PCI – Healthcare – HIPAA, Clinic Trials Data • Reduce IT costs by simplifying sanitizing production data – Transforming sensitive data for use in analytics, testing, development, and more 14
- 15. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | NEW! MySQL Enterprise Masking and De-Identification 15 De-identify, Anonymize Sensitive Data ID Last First SSN 1111 Smith John 555-12-5555 1112 Templeton Richard 444-12-4444 ID Last First SSN 2874 Smith John XXX-XX- 5555 3281 Templeton Richard XXX-XX- 4444 Employee Table Masked View "Data Masking is a method to hide sensitive information by replacing real values with substitutes.” Random Data Generation
- 16. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | • Data Masking – String masking – Dictionary based replacement – Specific masking • SSN • Payment card : Strict/Relaxed • Random Data Generators – Random number within a range – Email – Payment card (Luhn check compliant) – SSN – Dictionary based generation 16 MySQL Enterprise Masking and De-Identification Data Masking and Random Data Generation
- 17. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | Data Masking Examples
- 18. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL Enterprise Authentication 18 • Integrate with Centralized Authentication Infrastructure – Centralized Account Management – Password Policy Management – Groups & Roles Supports – Windows Active Directory (for windows MySQL servers) – Linux PAM (Pluggable Authentication Modules) – New Native LDAP • Ultra Fast and Flexible • Works with Windows AD (even on non-windows MySQL servers) Integrates MySQL with existing security infrastructures
- 19. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL Enterprise Authentication: Native LDAP • Direct Connection over LDAP Protocol/Ports • Authentication with – User and Password – or SASL • Customizable for users and groups 19 Connector LDAP Service Dir Tree Port:389 MySQL Native LDAP Plugin 1) User/Password Or 2) SASL 2) SASL SASLD
- 20. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | New! Atomic ACL Statements • Long standing MySQL issue! – For Replication, HA, Backups, etc. • Possible now - ACL tables reside in 8.0 InnoDB Data Dictionary • Not just a table operation: memory caches need update too • Applies to statements performing multiple logical operations, e.g. – CREATE USER u1, u2 – GRANT SELECT ON *.* TO u1, u2 • Uses a custom MDL lock to block ACL related activity – While altering the ACL caches and tables 20 Feature Request from DBAs
- 21. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | New! Dynamic Privileges Provides finer grained administrative level access controls • Too often SUPER is required for tasks when less privilege is really needed – Support concept of “least privilege” • Needed to allow adding administrative access controls – Now can come with new components – Examples • Replication • HA • Backup • Give us your ideas 21 Feature Request from DBAs
- 22. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL Password Features • New! Password Management – Require new passwords not reuse old ones - By number of changes and/or time. – Password-reuse (aka Password History) • Policy can be set globally as well as on a per-account basis. – New in 8.0.13: Can require old password when changing too • New! SHA2 with Caching. Now Default ! – Strong (when storing) and Fast (when connecting) • Strong - SHA-256 password hashing (many rounds, random salt, …) • Fast – Caching: Greatly reduces latency • New! Seamless RSA password-exchange capabilities (Lowers SSL Costs) 22
- 23. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL 8.0 TDE • New! AES 256 encryption of UNDO and REDO Logs Super Simple to manage - Set innodb_undo_log_encrypt=ON/OFF innodb_redo_log_encrypt=ON/OFF And ON - Pages written after setting are encrypted OFF - Pages written after setting are not. New in 8.0.13 ! Support for encryption in shared table-spaces 23
- 24. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | New! Security Model For The Cloud: Why ? How ? • Requirements – Allow end users to administer their instances without allowing them to “cut the branch they’re sitting on” • Problems – Single “super-user” that’s allowed to do everything – Some privileges not too granular (e.g. CREATE USER is a global privilege) • Solution: Create two classes of users: “internal” and “external” – Internal “super-user” can handle all users (backward compatible) – External “super-user” can only handle external users
- 25. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | New! Security Model For the Cloud: The Tools • SYSTEM_USER global privilege – When granted to an account allows it to handle all other accounts it’s granted on – Checked in addition to existing privilege checks. • Partial revokes – Problem: One can elevate their own privileges by updating the ACL tables – Problem: We want global level grants to work for external super users – Solution: Allow sticky “exceptions” to global grants: • GRANT SELECT ON *.* TO foo; • REVOKE SELECT ON mysql.* FROM foo;
- 26. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL Security Architecture
- 27. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL Enterprise Edition - SECURITY • MySQL Enterprise TDE – Data-at-Rest Encryption – Key Management/Security • MySQL Enterprise Authentication – External Authentication Modules • Microsoft AD, Linux PAMs, LDAP • MySQL Enterprise Encryption – Public/Private Key Cryptography – Asymmetric Encryption – Digital Signatures, Data Validation – User Activity Auditing, Regulatory Compliance • MySQL Data Masking 27 • MySQL Enterprise Firewall – Block SQL Injection Attacks – Intrusion Detection • MySQL Enterprise Audit – User Activity Auditing, Regulatory Compliance • MySQL Enterprise Monitor – Changes in Database Configurations, Users Permissions, Database Schema, Passwords • MySQL Enterprise Backup – Securing Backups, AES 256 encryption • MySQL Enterprise Thread pool – Attack Hardening
- 28. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | 28 Enterprise Security Architecture Workbench •Model •Data •Audit Data •User Management Enterprise Monitor •Identifies Vulnerabilities •Security hardening policies •Monitoring & Alerting •User Monitoring •Password Monitoring •Schema Change Monitoring •Backup Monitoring Data Encryption •TDE •Encryption •PKI Firewall Enterprise Authentication •SSO - LDAP, AD, PAM Network Encryption Enterprise Audit •Powerful Rules Engine Audit Vault Strong Authentication Access Controls Assess Prevent Detect Recover Enterprise Backup •Encrypted HA •Innodb Cluster Thread Pool •Attack minimization Key Vault •Protect Keys Enterprise Masking & De-Identification •Masking •Substitute/Subset •Random Formatted Data •Blacklisted Data
- 29. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | What is Transparent Data Encryption? • Data at Rest Encryption – Tablespaces, Disks, Storage, OS File system • Transparent to applications and users – No application code, schema or data type changes • Transparent to DBAs – Keys are hidden from DBAs, no configuration changes • Requires Key Management – Protection, rotation, storage, recovery 29
- 30. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | Using MySQL Transparent Data Encryption is EASY SQL • New option in CREATE TABLE ENCRYPTION=“Y” • New SQL: ALTER INSTANCE ROTATE INNODB MASTER KEY Plugin Infrastructure • New plugin type: keyring • Ability to load plugin before InnoDB initialization: --early-plugin-load Keyring plugin • Used to retrieve keys from Key Stores • Over Standardized KMIP protocol InnoDB • Support for encrypted tables • IMPORT/EXPORT of encrypted tables • Support for master key rotation • New! undo/redo log encryption 30
- 31. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL Enterprise TDE: KMIP Compliant • KMIP – Key Management Interoperability Protocol (Oasis Standard) • Keys are protected and secure • Enables customers to meet regulatory requirements • KMIP mode tested with the following products – Oracle Key Vault (OKV) – Gemalto Safenet KeySecure – Fornetix Key Orchestration Appliance – Thales Vormetric 31
- 32. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | The Keyring API: The Big Picture 32 The MySQL ServerPlugins (Consumers) Keys Keyring Plugin (backend) Key Storage Keys Keyring Plugin Service Keyring Plugin API Keys Key Ring API Each Key Has a Name/ACL
- 33. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | What is the Keyring API ? • A uniform infrastructure for handling keys • Usable by both the server and plugins • Available in MySQL 5.7 and up as a plugin API and a plugin service • Fully extensible • Can be initialized before InnoDB at startup • Minimum effort to add new backends and consumers • New! A keyring migration tool to facilitate moving keys across back-ends ! 33
- 34. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | Keyring plugins: The Inventory • Current Consumers – InnoDB tablespace encryption – SQL user defined functions (UDF) plugin – Enterprise Audit • Current Backends – Flat file backend (In EE can be encrypted) – KMIP compliant clients • Oracle KeyVault • Gemalto Safenet KeySecure • Probably more if they support KMIP standards – give it a try. 34
- 35. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL Enterprise Encryption • MySQL encryption functions – Symmetric encryption AES256 (All Editions) – Public-key / asymmetric cryptography – RSA • Key management functions – Generate public and private keys – Key exchange methods: DH • Sign and verify data functions – Cryptographic hashing for digital signing, verification, & validation – RSA,DSA • New since 8.0.11: MySQL can work in FIPs mode 35
- 36. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL Enterprise Audit • Out-of-the-box logging of connections, logins, and query • User defined policies for filtering, and log rotation • Dynamically enabled, disabled: no server restart • XML-based audit stream per Oracle Audit Vault spec • New! Features in 5.7.21 and in 8.0 – JSON – Compression – Encryption 36 Adds regulatory compliance to MySQL applications (HIPAA, Sarbanes-Oxley, PCI, etc.)
- 37. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL Enterprise Firewall • Real Time Protection – Queries analyzed and matched against White List • Blocks SQL Injection Attacks – Block Out of Policy Transactions • Intrusion Detection – Detect and Alert on Out of Policy Transactions • Learns White List – Automated creation of approved list of SQL command patterns on a per user basis • Transparent – No changes to application required • New! Feature in 5.7.20/8.0 – Combined Firewall/Audit Rules – Create more general allow/deny firewall rules using JSON syntax – using abort=on 37 MySQL Enterprise Firewall monitoring
- 38. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL Enterprise Firewall • New! Feature in 5.7.20 – Combined Firewall/Audit Rules – Create more general allow/deny firewall rules using JSON syntax – using abort=on Example - block execution of specific • SQL statements (insert, update, delete) • For a specific table (finances.bank_account) Test rules • By writing to audit log • If data as expected change to firewall – add “abort” 38
- 39. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | Security Direction • Continuing to focus a great deal on security • New things are in the works, especially in these areas: – TDE / Encryption / Key management – Masking, Obfuscation, De-identification, Tokenization – Audit – Firewall – Authentication – Integration to various Oracle Cloud services – Data masking 39 Customer feedback and requirements drive our priorities Tell us what you want, need, etc. Give us problematic use cases
- 40. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | 40 Enterprise Security Architecture Workbench •Model •Data •Audit Data •User Management Enterprise Monitor •Identifies Vulnerabilities •Security hardening policies •Monitoring & Alerting •User Monitoring •Password Monitoring •Schema Change Monitoring •Backup Monitoring Data Encryption •TDE •Encryption •PKI Firewall Enterprise Authentication •SSO - LDAP, AD, PAM Network Encryption Enterprise Audit •Powerful Rules Engine Audit Vault Strong Authentication Access Controls Assess Prevent Detect Recover Enterprise Backup •Encrypted HA •Innodb Cluster Thread Pool •Attack minimization Key Vault •Protect Keys Enterprise Masking & De-Identification •Masking •Substitute/Subset •Random Formatted Data •Blacklisted Data
- 41. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | MySQL Enterprise Edition - SECURITY • MySQL Enterprise TDE – Data-at-Rest Encryption – Key Management/Security • MySQL Enterprise Authentication – External Authentication Modules • Microsoft AD, Linux PAMs, LDAP • MySQL Enterprise Encryption – Public/Private Key Cryptography – Asymmetric Encryption – Digital Signatures, Data Validation – User Activity Auditing, Regulatory Compliance • MySQL Data Masking 41 • MySQL Enterprise Firewall – Block SQL Injection Attacks – Intrusion Detection • MySQL Enterprise Audit – User Activity Auditing, Regulatory Compliance • MySQL Enterprise Monitor – Changes in Database Configurations, Users Permissions, Database Schema, Passwords • MySQL Enterprise Backup – Securing Backups, AES 256 encryption • MySQL Enterprise Thread pool – Attack Hardening
- 42. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | Security Resources • http://mysqlserverteam.com/ • http://insidemysql.com/ • https://blogs.oracle.com/mysql • https://www.mysql.com/why-mysql/#en-0-40 • https://www.mysql.com/why-mysql/presentations/#en-17-40 • https://www.mysql.com/news-and-events/on-demand-webinars/#en-20- 40 • https://www.mysql.com/news-and-events/health-check/ 42
- 43. Copyright © 2019, Oracle and/or its affiliates. All rights reserved. | Thank you! 43
Notas del editor
- Today I want to cover 5 areas. First I want to briefly relate at a high level the challenges out there. I won’t spend too much time here – but I do think its important to understand the whys and whats After that I want to give you a high level view of all the solutions we have and how they map together to fill out all the various aspects of security Next I go into some of the details behind the MySQL solutions And finally look at whats new, and where are focus is, and also to hear from you all where your needs lie, to see if were headed in the direction you need, etc.
- Mega breaches involving millions of compromised records continue to make headlines. For example: The Equifax breach revealed the names, Social Security numbers, birth dates, and addresses of almost half of the total U.S. population. Around 400,000 U.K. customers were also reportedly affected. Final findings revealed a total of 145.5 million exposed records. At SingHealth, Singapore’s largest healthcare group, the nonmedical personal data of 1.5 million patients was reportedly accessed, including their national identification number, address, and date of birth as part of the attack. The stolen data also included the outpatient medical data of 160,000 patients. In March of this year, the athletic wear company Under Armour disclosed that data tied to its fitness app was breached this year, affecting 150 million user accounts. Users' usernames, email addresses and passwords were affected In August of this year, British Airways said that names, addresses, email addresses, and sensitive payment card details from 380,000 transactions were all compromised. Though people have reached a seeming point of desensitization to news citing a data breach, protecting user data has become increasingly important amid stricter regulation implementation. Companies are no longer just required to announce that their systems have been breached but also pay fines that can reach up to 4 percent of their annual turnover should they deal with the data belonging to European Union (EU) citizens in accordance with the General Data Protection Regulation (GDPR) requirements. Sources -------------- https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/data-breach-101
- Data breaches continue to be costlier and result in more consumer records being lost or stolen, year after year. In 2017 there were over 1500 data breaches in the United States alone and over 170 million records exposed. A data breach involving more than one million compromised records, is referred to as a mega breach. A mega breach of 1 million records yields an average total cost of $40 million A mega breach of 50 million records yields an average total cost of $350 million While we continue to hear about mega breaches the cost of smaller breaches is also in the millions of dollars. What contributes to these costs is: Detection activities such Forensics & Auditing Services Notification Costs, including communicating with Regulators Legal Costs and regulatory fines Lost business and company reputation ---------------- Sources https://databreachcalculator.mybluemix.net/assets/2018_Global_Cost_of_a_Data_Breach_Report.pdf https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/)
- So how many in the room are dealing with regulations and guidelines? How many are dealing with multiple. This is just a subset of regulations that your company may need to comply with. The new kid on the block is GDPR. If you deal with the EU – no matter where your company resides – you need to comply to it.
- At a high level you need to ASSESS – hopefully pre-production during the design process, but then also continuously check things out to make sure your servers are secure and hardened. The goal – to reduce risks, detect and resolve any vulnerabilities, make sure controls – like user permissions, password and network access policies, encryption requirements. Be DEFENSIVE – and PREVENT – MySQL has encryption, user controls, access controls, … for this . We’ll go into the details in a minute. But even if you’ve performed strong Assessment and Prevention – things could still happen – the sooner you spot an issue, a misuse, a hack, the better. For this you need to act like a security guard – DETECT - watch what’s happening with Audit, Monitor for suspect changes, and get Alerted so you know immediately when suspect activity occurs. Finally – be able to RECOVER – even if the worst happens – say a server gets encrypted and ransomed – or its to complex to safely recover the server from an attack – you need a clean server you can bring online and resume critical services. Then you can go back and look through audit data, logs, and other forensics carefully without tainting a server. You can move forward but still preserve evidence if you need to prosecute. Etc. You may even need to bring back old backups from archive. Backups have many purposes beyond disaster recovery.
- Now MySQL has Roles So you can assign permissions to roles And then assign users to roles and even roles to roles. This also allows you to define default roles – that happen with the connection OR you can set a role For example – in general keep permissions at a minimal and only escalate by setting a more powerfully permitted role when needed. This also makes it far harder for hacker – as they won’t necessarily know you are using roles etc.
- Here you can see how roles are Created Granted How you can use WITH ADMIN option – to allow others to grant same role.
- CHHS=UNIVERSITY OF MARYLAND CENTER FOR HEALTH & HOMELAND SECURITY PCI=Payment Card Industry (Health Insurance Portability and Accountability Act
- Security is often about manage-ability. Case in point – users and their accounts. Often its easier to manage the users identity in one place. MySQL Supports centralized user repositories with Enterprise Authentication plugins Users have SSO Managers can centrally add users to groups Managers can remove of disable users centrally You can limit user administration across one to many mysql instances You can manage authentication across applications Audit trails have common user identities for tracking all activity together
- Prior to 8.0 many ACLs or Access Controls which appeared in a single statement – were actually executed in multiple parts. With the new ACID based Innodb data dictionary in 8.0 and with other additional efforts – each statement is atomic – it succeeds or it fails. This is great new for standalone – but also very valuable for cleaner replication and HA> So statements creating many users, or granting to many users, etc are atomic now. New locks within 8.0 were created to preserve this atomic feature for the access control statements.
- Within the MySQL Enterprise Edition “Security” we have TDE – transparent data encryption (I’ll go more into this) – in a nutshell it uses encryption and secured keys to protect your data – with zero change to your applications. Next with have Authentication – providing integration with external Identity Servers like Microsoft Active directory, LDAP, and Linux PAMs In enterprise we provide full access to standard PKI (Public Key, Asymmetric Cryptography) functions for integration across your applications – so you can implement fine grained encryption for very sensitive data. A firewall to block the bad guys. Although SQL injection is very preventable at the application level – it extremely difficult to continuously determine if applications are constructed properly. And SQL inject attacks are simple to construction. Firewalls go a long way to protection from these attacks. Audit to watch what’s happening – esp. with sensitive data and tables, esp. with powerful admins and users. MEM – MySQL Enterprise Monitor – continuous best practice assessment. Spots weak security setup, advises on changes, then monitors to make sure things stay setup securely, and alerts when things need your attention. Backup – with encryption to make sure your data isn’t stolen via backup image theft, that you can recover from attacks And finally Thread pool – to minimalize DOS and other attacks attemption to overwhelm mysql connections. So – lets take a visual look at how this is put together from Architectural Stand point. Now lets dive down a bit into a few of these security technologies.
- Transparent Data Encryption – enforces database security by removing alternative routes to the database outside of a MySQL database Connection. So this means to files that MySQL uses – data in tables is in tablespaces and is stored in files. Too often these files can be copied and data accessed – by powerful os user on the file system, by getting to disk or other storage. Encrypted files with secured keys – don’t expose data. Transparent – in that for a DATABASE user and DATABASE applications – they don’t know encryption is going on. No calls to decryption functions, no access to keys, etc. Additionally – the goal is to minimize who has access to the keys – like the DBA Finally – if keys are lost or stolen – the data is lost or stolen. Key management is core to effective encryption. Lose keys lose data, expose keys, expose data, etc TDE solves many data compliance issues – where data encryption is required. And its fast – most don’t notice the addition of encryption. Buffered data is already decrypted and ready to server. Expect low single digit impact.
- Complexity is the enemy of security. So we worked hard to keep things SIMPLE You load the plugin of your choice You can create an new table as encrypted. Could can alter an existing table to be encrypted. Key rotation is trivial and happens in less than a second. Additionally we have support for TDE for TTS transportable tablespace files so you can export and import and keep data encrypted And MySQL Enterprise Backup support backup and recovery of encrypted data. (even for many years of archive)
- – best is kmip key management plugin – It’s a standard that is supported by OKV, Gemalto KeySecure, Fornetix or other KMIP compliance servers Also - as of 5.7.19 AWS KMS is supported and more are coming (OPC KMS).
- MySQL includes a variety of encryption functions Standard symmetric – where one key encrypts and decrypts Asymmetric – which make use of public key cryptography Here more secure schemes can be used to allow encryption with public keys in applications without allowing decryption – unless the app has the private key. This can be far safer – limiting the capability of apps by removing decryption keys. Various functions for use to sign data so its immutable, verifiable, where changes can be detected. All interoperable with standard openssl libraries.
- Auditing is a key security tool – gives you the who what when from where and how MySQL Enterprise Audit is simple to install. Allows DBAs to define course to very fine grained auditing rules. The key to auditing is to watch sensitive things closely and fine tune your rules. Auditing everything isn’t necessarily preferred. It really depends on what you are auditing etc. And with 5.7.20 you can Compress – to reduce audit file sizes Encrypt – to protect the data in the audit trails Chose JSON formats Get Access from SQL – like tail calls – so Audit data can be reviewed w/o getting on the OS. Standard tools can be used to decrypt and uncompress the audit data files – so will interwork with other audit vaults, audit repos Audit works with Oracle Audit Vault – but there are many options for centrally archiving audit data. Audit includes a full suite of features – to roll files, force auditing always – mysql won’t run if auditing isn’t enabled, etc. Or it can be turned on and rules tuned if you are looking for specific suspect activity.
- To this day SQL inject is one of the top attacks MySQL Enterprise Firewall can stop those attacks Simply turn on learning mode for a user and automatically build your white list Change over to alert mode to confirm you don’t have any false positives (that is no false alarms) Once things look good – switch to full on block mode. In 5.7.21 add more general rules to block attacks by type, user, ip etc etc. And you can decide on alerting or blocking per rule.
- We are always looking for feedback related to security requirements. We’ve added many new things in account and password policies to meet customer requests over the last few years. Or if you have a regulatory requirement and can’t quite see if there’s something to meeting it – please ask. We may have it, or maybe we need to have it. Also the more we know about what you need the better. Often requests come in the form of a solution – without the problem. But as well all know often there’s more than one way to solve a problem - or maybe we’ve already solved things – just some other way that’s not obvious. Regarding TDE – MySQL 8.0 has already added redo and undo log encryption and were working on encrypting additional files (binlog, DD tables) New Ultra Fast and secure SHA256 protocol Openssl fips module support for govt folks. Again we’re looking for feedback - what do you developers want, what would your dba’s like to have?
- Within the MySQL Enterprise Edition “Security” we have TDE – transparent data encryption (I’ll go more into this) – in a nutshell it uses encryption and secured keys to protect your data – with zero change to your applications. Next with have Authentication – providing integration with external Identity Servers like Microsoft Active directory, LDAP, and Linux PAMs In enterprise we provide full access to standard PKI (Public Key, Asymmetric Cryptography) functions for integration across your applications – so you can implement fine grained encryption for very sensitive data. A firewall to block the bad guys. Although SQL injection is very preventable at the application level – it extremely difficult to continuously determine if applications are constructed properly. And SQL inject attacks are simple to construction. Firewalls go a long way to protection from these attacks. Audit to watch what’s happening – esp. with sensitive data and tables, esp. with powerful admins and users. MEM – MySQL Enterprise Monitor – continuous best practice assessment. Spots weak security setup, advises on changes, then monitors to make sure things stay setup securely, and alerts when things need your attention. Backup – with encryption to make sure your data isn’t stolen via backup image theft, that you can recover from attacks And finally Thread pool – to minimalize DOS and other attacks attemption to overwhelm mysql connections. So – lets take a visual look at how this is put together from Architectural Stand point. Now lets dive down a bit into a few of these security technologies.
- Finally I want to leave you with some links – do you know where to find things. The mysql server team blogs frequently on security We have various white papers – many specific – for example on PCI or GDPR and MySQL And we are happy to run a health check with you and can focus on security.