Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Webinar: Creating a Single View: Securing Your Deployment

746 views

Published on

Security is more critical than ever with new computing environments in the cloud and expanding access to the internet. There are a number of security protection mechanisms available for MongoDB to ensure you have a stable and secure architecture for your deployment. We'll walk through general security threats to databases and specifically how they can be mitigated for MongoDB deployments. Topics will include general security tools and how to configure those for MongoDB, an overview of security features available in MongoDB, including LDAP, SSL, x.509 and Authentication.

Published in: Technology
  • Be the first to comment

Webinar: Creating a Single View: Securing Your Deployment

  1. 1. Lead Security Engineer, MongoDB Andreas Nilsson Creating a single view: Securing the Application
  2. 2. How can we make data accessible securely?
  3. 3. Securing the Application: Agenda Securing a Database Access Control Data Protection Auditing
  4. 4. The Art of Securing a System “If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.” Sun Tzu, The Art of War 500 BC
  5. 5. Timeline Plan and design security as early as possible. ImplementDesign Test Deploy YES! NO!
  6. 6. Designing the Infrastructure
  7. 7. Access Control Configure Authentication and Authorization. ImplementDesign Test Deploy
  8. 8. Enable Access Control Design • Determine which types of users exist in the system. • Match the users to MongoDB roles. Create any customized roles. Deployment • Start/restart MongoDB with access control enabled. • Create the desired users.
  9. 9. MongoDB configuration Authentication - Who are you in MongoDB? • Application user, administrator, backup job, monitoring agent. Authorization - What can you do in MongoDB? • CRUD operations, configure the database, manage sharding, user management.
  10. 10. Enable Authentication Built-in authentication methods • Password challenge response • x.509 certificates Or integrate with existing authentication infrastructure
  11. 11. Role Based Access Control Builtin roles • read, readWrite, dbAdmin, clusterAdmin, root, etc.. User defined roles • Customized roles based on existing roles and privileges.
  12. 12. Internal Authentication Server-server authentication use shared keyfile or x.509.
  13. 13. Field Level Redaction - $redact $redact • New aggregation framework operator • Conditionally filter user documents Use cases • Implement user-based document level, content filtering. • Create egress filter, redacting sensitive information.
  14. 14. Access Control - Field Level Redaction Note: Need to understand the application better
  15. 15. Data Protection Encrypting data in transit (SSL) and data at rest. ImplementDesign Test Deploy
  16. 16. Data Protection End to End
  17. 17. Transport Encryption with SSL • Possible to protect client-server, server-server communications with SSL. • Support for commercially and internally issued x.509 certificates • Possible to run the server in FIPS 140-2 mode. • Support for mixed SSL and non-SSL clusters.
  18. 18. Data Protection - Transport Encryption Encrypt communications (SSL) Authenticate connections (x.509)
  19. 19. Data Protection - Encryption at rest Alternatives • Encrypt data client side • Use partner solution for file and OS level encryption
  20. 20. Security Auditing
  21. 21. The Audit Log • Security events can be written to either the console, the syslog or a file (JSON/BSON) • By default, all security events are written to audit log when enabled. • Events include Authentication failures and some commands. • Access control is not required for auditing. • They are separate components.
  22. 22. Audit Log Properties • Can filter based off of different criteria – Action Type, TimeFrame, IP Address/Port, Users • Events Have Total Order Per Connection • Audit Guarantees (AKA Writes/config) – Audit event written to disk BEFORE writing to the journal – A write will not complete before it has been audited
  23. 23. Some final tips…
  24. 24. Some tips along the way… 1. Do not directly expose database servers to the Internet 2. Design and configure access control 3. Enable SSL 4. Disable any unnecessary interfaces 5. Lock down database files and minimize account privileges
  25. 25. What did we talk about? Securing a Database Access Control Data Protection Auditing
  26. 26. Next steps • MongoDB Security Manual - http://docs.mongodb.org/manual/core/security-introduction/ • MongoDB Security Whitepaper - http://info.mongodb.com/rs/mongodb/images/MongoDB_Security_Archi tecture_WP.pdf
  27. 27. Lead Security Engineer, MongoDB Andreas Nilsson #MongoDBWorld Thank You

×