SlideShare a Scribd company logo
Database Security
Threats - MariaDB
Security Best
Practices
Jonathan Day, MariaDB Senior
Solution Architect
Security threats
Best practices
The Internet
Threats
Viruses
Hacker attacks
Defense
• Don’t allow TCP connections to
MariaDB from the Internet
• Evaluate your DNS infrastructure
• Configure MariaDB to listen only to
the application host
• Design your physical network to
connect the app to MariaDB
• Use bind-address to bind to
a specific network interface
• Use your OS’s firewall
• Keep your OS patched
Applications
Threats
Denial of Service
Attacks created by
overloading
application
SQL query
injection attacks
Defense
• Don’t run your application
on the MariaDB Server
• Don’t install unnecessary packages
– An overloaded application can cause
MariaDB to be slow or even killed by the
OS. (DDoS attack vector)
– A compromised application or service can
have many serious side effects
• Discovery of MariaDB credentials
• Direct access to data
• Privilege escalation
Excessive Trust
Threats
Disgruntled employees
Mistakes and human error
Defense
• Limit users who have:
– SSH access to your MariaDB server.
– Sudo privileges on your MariaDB server.
• Set the secure_file_priv option to ensure that
users with the FILE privilege cannot write or
read MariaDB data or important system files.
• Do not run mysqld as root
• Avoid ‘%”, use specific host names
Excessive Trust
Threats
Disgruntled employees
Mistakes and human error
Defense
• Don’t use the MariaDB “root” user for application
access
• Minimize the privileges granted to the MariaDB
accounts used by your applications
– Don’t grant CREATE or DROP privileges.
– Don’t grant the FILE privilege.
– Don’t grant the SUPER privilege.
– Don’t grant access to the
mysql database
• Grant only the privileges required
Best Practices: Encryption
• Encrypt sensitive data in the application
– Credit Card numbers, PII
• Encrypt data at rest
– InnoDB tablespace encryption
– InnoDB redo log encryption
– Binary log encryption
• Encrypt data in transit with SSL
– From clients to MariaDB
– From clients to MariaDB MaxScale
– Between MariaDB replicated servers
Best Practices: Use a database proxy
• Use MariaDB MaxScale as a database
firewall
• Restrict the operations that clients are
allowed to perform
• Identify and flag potentially dangerous
queries
• Customize rules about what’s allowed
and what’s not
• Implement connection pooling
capabilities
Best Practices: User Management
• Protect MariaDB data and backups via
OS permissions
• Use strong passwords
• Allow root access to MariaDB only from
local clients—no administrative access
over the network
• Use a separate MariaDB user account for
each of your applications
• Allow access from a minimal set of IP
addresses
• Regularly audit your users and grants
Best Practices: Auditing
• Use MariaDB Audit Plugin to log events
to syslog or files
• Ensure regulatory compliance with
robust logging
• Record connections, query executions,
and tables accessed
• Be selective in what your are monitoring
• Plan auditing resources
– Budget
– Processes
• Consider using “Honeypots”
• Have a process to review the logs and
follow it… Very Important
• Audit your auditing
MariaDB Server
Security Features
Authentication
Password Validation
Simple_password_check plugin
Enforce a minimum password
length and type/number of
characters to be used
External Authentication
• Single Sign On is becoming
mandatory in many Enterprises.
– PAM-Authentication Plugin
allows using /etc/shadow and any
PAM based authentication like LDAP
– Kerberos-Authentication as a
standardized network authentication
protocol is provided GSSAPI based on
UNIX and SSPI based on Windows
MariaDB PAM Authentication
GSS-API on Linux
• Red Hat
Directory Server
• OpenLDAP
SSPI on Windows
• Active DirectoryKDC Client MariaDB
2
3
4
1
Ticket
request
Service
ticket
Here is my
service ticket,
authenticate me
Client /
server
session
MariaDB 10.2 New User Features
● The SHOW CREATE USER statement was introduced.
● New CREATE USER options for limiting resource usage and tls/ssl.
● New ALTER USER statement.
MariaDB Role Based Access Control
DBA
Developer
Sysadmin
Database
Tables
MariaDB 10
Role: DBA
Permissions:
• Update Schema
• View Statistics
• Create Database
Encryption for Data in Motion
Secured Connections
SSL Connections based on
the TLSv1.2 Protocol
Between MariaDB
Connectors and Server
Between MariaDB
Connectors and MaxScale
SSL can also be enabled
for the replication channel
Encryption
• Application control
of data encryption
• Based on the AES (Advanced
Encryption Standard) or DES
(Data Encryption
Standard) algorithm
Encryption for Data at Rest
Data-at-rest Encryption
• Everything:
– Tables or tablespaces
– Log files
• Independent of encryption
capabilities of applications
• Based on encryption keys,
key ids, key rotation and
key versioning
• Low performance overhead
Key Management Services
• Encryption plugin API offers choice
– Plugin to implement
the data encryption
– Manage encryption Keys
• MariaDB Server options
– Simple Key Management included
– Amazon AWS KMS Plugin included
– Eperi KMS for on premise key
management – optional
MariaDB Audit Plugin
• Logs server activity
– Who connected to the server
– Source of connection
– Queries executed
– Tables touched
• File based or syslog based logging
Auditing for Security and Compliance
Connection Disconnect
Connect
Failed Connect
Timestamp
Host User
SessionQuery DML + TCL
DDL
DCL
Object
Tables
Database
MariaDB MaxScale
Security Features
Attack Protection with MariaDB MaxScale
Database Firewall Denial of Service Attack
Protection
• MariaDB MaxScale
Persistent Connections
• Connection pooling protects
against connection surges
• Cache the connections from
MaxScale to the database server
• Rate limitation
• Client multiplexing
• Protects against SQL injection
• Prevents unauthorized user
access and data damage
• White-list or Black-list Queries
– Queries that match a set of rules
– Queries matching rules
for specified users
– Queries that match certain
patterns, columns, statement types
• Multiple ordered rule
MariaDB MaxScale
• Database Proxy for
– Security
– Scalability
– High Availability
– Data Streaming
• Insulates client applications from the
complexities of backend database cluster.
• Core + functionality provided by plugins
– Protocol
– Filters
– Routers
– Monitors
Core
Protocol
Authentication
Filter&
Logging
Monitor
Routing
MaxScale
Client
Master
Slave
Slave
Database Firewall
• A filter installed into the request processing chain.
• Rules define what constitutes a match:
– wildcard, columns, function, regex, no where clause
– when to apply
– what users are affected
– what statements are affected
• The filter mode defines what to do with a match:
– allow => whitelist
– block => blacklist
• limit_queries rule sensible only with blacklisting
– match if more than N queries are made within a time period
Client
MaxScale
Filter
Router
Database Firewall Example
[TheFirewall]
type=filter
module=dbfwfilter
action=block
rules=firewall-rules.txt
[TheService]
type=service
...
filters=TheFirewall
MaxScale configuration file.
rule require_where_clause deny no_where_clause on_queries select
users %@% match all rules require_where_clause
Only defines what constitutes a match.
● wildcard
● columns col1-name col2-name …
● regex regular expression
● no_where_clause
● ...
on_queries [select|update|...]
MySQL [testdb]> select * from table;
ERROR 1141 (HY000): Access denied for user 'johan'@'127.0.0.1': Required WHERE/HAVING
clause is missing.
MySQL [testdb]>
DDoS: Server Overload Protection
• Persistent connections to backend.
– When server connections are logically closed, keep them
in pool for reuse.
• Client connection limitation.
– Specify the maximum number of connections for a
particular service.
• Limit rate of queries using the firewall.
[SomeService]
...
max_connections=100
maxscale.cnf[SomeServer]
...
maxpersistpoolmax=30
maxscale.cnf
rule prevent_overload deny limit_queries 15 5 10
firewall.txt
Client Client Client Client
If more than 15 queries are received in 5 seconds, block all queries for 10 seconds.
DDoS: Network Overload Protection
• Cap the amount that can be returned.
– By rows or by size.
– Data will be returned to MaxScale, but MaxScale will not
necessarily forward to client.
• Limit rate of queries using the firewall.
[LimitSize]
type=filter
module=maxrows
max_resultset_rows=500
firewall.txt
Client Client Client Client
rule prevent_overload deny limit_queries 15 5 10
MaxRows Filter
• Set cap on the amount of data that can be returned.
– Specified by number of resultset rows and/or resultset size. If both are specified, then both
apply.
• Configuration options:
– max_resultset_rows: The maximum number of rows that may be returned.
– max_resultset_size: The maximum amount of data that may be returned.
– max_resultset_return: What should be returned in case the limit is reached.
empty: An empty resultset.
ok: An OK packet.
error: An error packet containing the offending statement.
MaxRows Configuration Example
[TheLimitations]
type=filter
module=maxrows
max_resultset_rows=1000
max_resultset_size=262144
max_resultset_return=error
[TheService]
type=service
...
filters=TheLimitations
At most 1000 rows may be returned.
At most 256 kilobytes may be returned.
That could also be expressed as 256Ki.
If either the rows or size limit is reached,
return an error packet containing the
offending statement.
MariaDB [(test)]> select * from table;
ERROR 1415 (0A000): Row limit/size exceeded for query: select * from table
Selective Data Masking
• Mask the values of certain columns.
– Allow the use of column in a query, but do not return the actual value.
> SELECT name, ssn FROM person;
+-------+-------------+
+ name | ssn |
+-------+-------------+
| Alice | 721-07-4426 |
| Bob | 435-22-3267 |
...
> SELECT name, ssn FROM person;
+-------+-------------+
+ name | ssn |
+-------+-------------+
| Alice | XXX-XX-XXXX |
| Bob | XXX-XX-XXXX |
...
Without masking With masking
Selective Data Masking Configuration Example
{
"rules": [
{
"replace": {
"column": "ssn"
},
"with": {
"value": "XXX-XX-XXXX",
"fill": "Y"
},
"exempted": [ "'admin'" ]
}
]
}
[TheMasking]
type=filter
module=masking
warn_type_mismatch=always
large_payload=abort
rules=masking_rules.json
[TheService]
type=service
...
filters=TheMasking
Replace the value of all columns whose
name is “SSN” irrespective of which
table or database is in question.
Replace the value with
“XXX-XX-XXXX”. However, that will be
done only if the length of the database
value is exactly the same as the length
of the replacement string.
Should the length of the database value not
exactly match the length of the
replacement string, replace the value with
as many “Y” as needed.
The masking is applied to every user (no
applies_to key), except the user
“admin”.
Current Masking Limitations
• The masking works only on the result set, not on the request.
– Trivial to bypass.
> SELECT fld FROM tbl;
+-------+
| a |
+-------+
| XXXXX |
+-------+
> SELECT concat(fld) FROM tbl;
+-------------+
| concat(fld) |
+-------------+
| hello |
+-------------+
• Preventing that requires combining the firewall filter with the masking filter.
• In 2.1 it is quite complex.
• In 2.2 it will be explicitly possible to deny the use of functions in conjunction with
certain columns.
Thank you

More Related Content

What's hot

MySQL Administrator 2021 - 네오클로바
MySQL Administrator 2021 - 네오클로바MySQL Administrator 2021 - 네오클로바
MySQL Administrator 2021 - 네오클로바
NeoClova
 
Tuning Autovacuum in Postgresql
Tuning Autovacuum in PostgresqlTuning Autovacuum in Postgresql
Tuning Autovacuum in Postgresql
Mydbops
 
AWS 환경에서 MySQL BMT
AWS 환경에서 MySQL BMTAWS 환경에서 MySQL BMT
AWS 환경에서 MySQL BMT
I Goo Lee
 
MariaDB MaxScale monitor 매뉴얼
MariaDB MaxScale monitor 매뉴얼MariaDB MaxScale monitor 매뉴얼
MariaDB MaxScale monitor 매뉴얼
NeoClova
 
MySQL 상태 메시지 분석 및 활용
MySQL 상태 메시지 분석 및 활용MySQL 상태 메시지 분석 및 활용
MySQL 상태 메시지 분석 및 활용
I Goo Lee
 
MySQL/MariaDB Proxy Software Test
MySQL/MariaDB Proxy Software TestMySQL/MariaDB Proxy Software Test
MySQL/MariaDB Proxy Software Test
I Goo Lee
 
Almost Perfect Service Discovery and Failover with ProxySQL and Orchestrator
Almost Perfect Service Discovery and Failover with ProxySQL and OrchestratorAlmost Perfect Service Discovery and Failover with ProxySQL and Orchestrator
Almost Perfect Service Discovery and Failover with ProxySQL and Orchestrator
Jean-François Gagné
 
Planning for Disaster Recovery (DR) with Galera Cluster
Planning for Disaster Recovery (DR) with Galera ClusterPlanning for Disaster Recovery (DR) with Galera Cluster
Planning for Disaster Recovery (DR) with Galera Cluster
Codership Oy - Creators of Galera Cluster
 
Maxscale_메뉴얼
Maxscale_메뉴얼Maxscale_메뉴얼
Maxscale_메뉴얼
NeoClova
 
Galera Cluster 4 presentation at Percona Live Austin 2019
Galera Cluster 4 presentation at Percona Live Austin 2019 Galera Cluster 4 presentation at Percona Live Austin 2019
Galera Cluster 4 presentation at Percona Live Austin 2019
Sakari Keskitalo
 
DAT202_Getting started with Amazon Aurora
DAT202_Getting started with Amazon AuroraDAT202_Getting started with Amazon Aurora
DAT202_Getting started with Amazon Aurora
Amazon Web Services
 
Building Stream Infrastructure across Multiple Data Centers with Apache Kafka
Building Stream Infrastructure across Multiple Data Centers with Apache KafkaBuilding Stream Infrastructure across Multiple Data Centers with Apache Kafka
Building Stream Infrastructure across Multiple Data Centers with Apache Kafka
Guozhang Wang
 
Optimizing MariaDB for maximum performance
Optimizing MariaDB for maximum performanceOptimizing MariaDB for maximum performance
Optimizing MariaDB for maximum performance
MariaDB plc
 
Getting the most out of MariaDB MaxScale
Getting the most out of MariaDB MaxScaleGetting the most out of MariaDB MaxScale
Getting the most out of MariaDB MaxScale
MariaDB plc
 
MySQL Security
MySQL SecurityMySQL Security
MySQL Security
Ted Wennmark
 
My sql failover test using orchestrator
My sql failover test  using orchestratorMy sql failover test  using orchestrator
My sql failover test using orchestrator
YoungHeon (Roy) Kim
 
Evolution of MongoDB Replicaset and Its Best Practices
Evolution of MongoDB Replicaset and Its Best PracticesEvolution of MongoDB Replicaset and Its Best Practices
Evolution of MongoDB Replicaset and Its Best Practices
Mydbops
 
Getting started with MariaDB with Docker
Getting started with MariaDB with DockerGetting started with MariaDB with Docker
Getting started with MariaDB with Docker
MariaDB plc
 
Fine-tuning Group Replication for Performance
Fine-tuning Group Replication for PerformanceFine-tuning Group Replication for Performance
Fine-tuning Group Replication for Performance
Vitor Oliveira
 
MariaDB MaxScale: an Intelligent Database Proxy
MariaDB MaxScale: an Intelligent Database ProxyMariaDB MaxScale: an Intelligent Database Proxy
MariaDB MaxScale: an Intelligent Database Proxy
Markus Mäkelä
 

What's hot (20)

MySQL Administrator 2021 - 네오클로바
MySQL Administrator 2021 - 네오클로바MySQL Administrator 2021 - 네오클로바
MySQL Administrator 2021 - 네오클로바
 
Tuning Autovacuum in Postgresql
Tuning Autovacuum in PostgresqlTuning Autovacuum in Postgresql
Tuning Autovacuum in Postgresql
 
AWS 환경에서 MySQL BMT
AWS 환경에서 MySQL BMTAWS 환경에서 MySQL BMT
AWS 환경에서 MySQL BMT
 
MariaDB MaxScale monitor 매뉴얼
MariaDB MaxScale monitor 매뉴얼MariaDB MaxScale monitor 매뉴얼
MariaDB MaxScale monitor 매뉴얼
 
MySQL 상태 메시지 분석 및 활용
MySQL 상태 메시지 분석 및 활용MySQL 상태 메시지 분석 및 활용
MySQL 상태 메시지 분석 및 활용
 
MySQL/MariaDB Proxy Software Test
MySQL/MariaDB Proxy Software TestMySQL/MariaDB Proxy Software Test
MySQL/MariaDB Proxy Software Test
 
Almost Perfect Service Discovery and Failover with ProxySQL and Orchestrator
Almost Perfect Service Discovery and Failover with ProxySQL and OrchestratorAlmost Perfect Service Discovery and Failover with ProxySQL and Orchestrator
Almost Perfect Service Discovery and Failover with ProxySQL and Orchestrator
 
Planning for Disaster Recovery (DR) with Galera Cluster
Planning for Disaster Recovery (DR) with Galera ClusterPlanning for Disaster Recovery (DR) with Galera Cluster
Planning for Disaster Recovery (DR) with Galera Cluster
 
Maxscale_메뉴얼
Maxscale_메뉴얼Maxscale_메뉴얼
Maxscale_메뉴얼
 
Galera Cluster 4 presentation at Percona Live Austin 2019
Galera Cluster 4 presentation at Percona Live Austin 2019 Galera Cluster 4 presentation at Percona Live Austin 2019
Galera Cluster 4 presentation at Percona Live Austin 2019
 
DAT202_Getting started with Amazon Aurora
DAT202_Getting started with Amazon AuroraDAT202_Getting started with Amazon Aurora
DAT202_Getting started with Amazon Aurora
 
Building Stream Infrastructure across Multiple Data Centers with Apache Kafka
Building Stream Infrastructure across Multiple Data Centers with Apache KafkaBuilding Stream Infrastructure across Multiple Data Centers with Apache Kafka
Building Stream Infrastructure across Multiple Data Centers with Apache Kafka
 
Optimizing MariaDB for maximum performance
Optimizing MariaDB for maximum performanceOptimizing MariaDB for maximum performance
Optimizing MariaDB for maximum performance
 
Getting the most out of MariaDB MaxScale
Getting the most out of MariaDB MaxScaleGetting the most out of MariaDB MaxScale
Getting the most out of MariaDB MaxScale
 
MySQL Security
MySQL SecurityMySQL Security
MySQL Security
 
My sql failover test using orchestrator
My sql failover test  using orchestratorMy sql failover test  using orchestrator
My sql failover test using orchestrator
 
Evolution of MongoDB Replicaset and Its Best Practices
Evolution of MongoDB Replicaset and Its Best PracticesEvolution of MongoDB Replicaset and Its Best Practices
Evolution of MongoDB Replicaset and Its Best Practices
 
Getting started with MariaDB with Docker
Getting started with MariaDB with DockerGetting started with MariaDB with Docker
Getting started with MariaDB with Docker
 
Fine-tuning Group Replication for Performance
Fine-tuning Group Replication for PerformanceFine-tuning Group Replication for Performance
Fine-tuning Group Replication for Performance
 
MariaDB MaxScale: an Intelligent Database Proxy
MariaDB MaxScale: an Intelligent Database ProxyMariaDB MaxScale: an Intelligent Database Proxy
MariaDB MaxScale: an Intelligent Database Proxy
 

Viewers also liked

HPC DAY 2017 | Prometheus - energy efficient supercomputing
HPC DAY 2017 | Prometheus - energy efficient supercomputingHPC DAY 2017 | Prometheus - energy efficient supercomputing
HPC DAY 2017 | Prometheus - energy efficient supercomputing
HPC DAY
 
Libnetwork updates
Libnetwork updatesLibnetwork updates
Libnetwork updates
Moby Project
 
HPC DAY 2017 | NVIDIA Volta Architecture. Performance. Efficiency. Availability
HPC DAY 2017 | NVIDIA Volta Architecture. Performance. Efficiency. AvailabilityHPC DAY 2017 | NVIDIA Volta Architecture. Performance. Efficiency. Availability
HPC DAY 2017 | NVIDIA Volta Architecture. Performance. Efficiency. Availability
HPC DAY
 
Java on the GPU: Where are we now?
Java on the GPU: Where are we now?Java on the GPU: Where are we now?
Java on the GPU: Where are we now?
Dmitry Alexandrov
 
HPC DAY 2017 | Accelerating tomorrow's HPC and AI workflows with Intel Archit...
HPC DAY 2017 | Accelerating tomorrow's HPC and AI workflows with Intel Archit...HPC DAY 2017 | Accelerating tomorrow's HPC and AI workflows with Intel Archit...
HPC DAY 2017 | Accelerating tomorrow's HPC and AI workflows with Intel Archit...
HPC DAY
 
HPC DAY 2017 | HPE Strategy And Portfolio for AI, BigData and HPC
HPC DAY 2017 | HPE Strategy And Portfolio for AI, BigData and HPCHPC DAY 2017 | HPE Strategy And Portfolio for AI, BigData and HPC
HPC DAY 2017 | HPE Strategy And Portfolio for AI, BigData and HPC
HPC DAY
 
Latency tracing in distributed Java applications
Latency tracing in distributed Java applicationsLatency tracing in distributed Java applications
Latency tracing in distributed Java applications
Constantine Slisenka
 
HPC DAY 2017 | HPE Storage and Data Management for Big Data
HPC DAY 2017 | HPE Storage and Data Management for Big DataHPC DAY 2017 | HPE Storage and Data Management for Big Data
HPC DAY 2017 | HPE Storage and Data Management for Big Data
HPC DAY
 
Model Simulation, Graphical Animation, and Omniscient Debugging with EcoreToo...
Model Simulation, Graphical Animation, and Omniscient Debugging with EcoreToo...Model Simulation, Graphical Animation, and Omniscient Debugging with EcoreToo...
Model Simulation, Graphical Animation, and Omniscient Debugging with EcoreToo...
Benoit Combemale
 
Raspberry home server
Raspberry home serverRaspberry home server
Raspberry home server
Massimiliano Perrone
 
HPC DAY 2017 | Altair's PBS Pro: Your Gateway to HPC Computing
HPC DAY 2017 | Altair's PBS Pro: Your Gateway to HPC ComputingHPC DAY 2017 | Altair's PBS Pro: Your Gateway to HPC Computing
HPC DAY 2017 | Altair's PBS Pro: Your Gateway to HPC Computing
HPC DAY
 
LinuxKit and OpenOverlay
LinuxKit and OpenOverlayLinuxKit and OpenOverlay
LinuxKit and OpenOverlay
Moby Project
 
GPU databases - How to use them and what the future holds
GPU databases - How to use them and what the future holdsGPU databases - How to use them and what the future holds
GPU databases - How to use them and what the future holds
Arnon Shimoni
 
Design patterns in Java - Monitis 2017
Design patterns in Java - Monitis 2017Design patterns in Java - Monitis 2017
Design patterns in Java - Monitis 2017
Arsen Gasparyan
 
Getting Started with Embedded Python: MicroPython and CircuitPython
Getting Started with Embedded Python: MicroPython and CircuitPythonGetting Started with Embedded Python: MicroPython and CircuitPython
Getting Started with Embedded Python: MicroPython and CircuitPython
Ayan Pahwa
 
An Introduction to OMNeT++ 5.1
An Introduction to OMNeT++ 5.1An Introduction to OMNeT++ 5.1
An Introduction to OMNeT++ 5.1
Alpen-Adria-Universität
 
Drive into calico architecture
Drive into calico architectureDrive into calico architecture
Drive into calico architecture
Anirban Sen Chowdhary
 
Vertx
VertxVertx
세션1. block chain as a platform
세션1. block chain as a platform세션1. block chain as a platform
세션1. block chain as a platform
Jay JH Park
 
Scylla Summit 2017: Repair, Backup, Restore: Last Thing Before You Go to Prod...
Scylla Summit 2017: Repair, Backup, Restore: Last Thing Before You Go to Prod...Scylla Summit 2017: Repair, Backup, Restore: Last Thing Before You Go to Prod...
Scylla Summit 2017: Repair, Backup, Restore: Last Thing Before You Go to Prod...
ScyllaDB
 

Viewers also liked (20)

HPC DAY 2017 | Prometheus - energy efficient supercomputing
HPC DAY 2017 | Prometheus - energy efficient supercomputingHPC DAY 2017 | Prometheus - energy efficient supercomputing
HPC DAY 2017 | Prometheus - energy efficient supercomputing
 
Libnetwork updates
Libnetwork updatesLibnetwork updates
Libnetwork updates
 
HPC DAY 2017 | NVIDIA Volta Architecture. Performance. Efficiency. Availability
HPC DAY 2017 | NVIDIA Volta Architecture. Performance. Efficiency. AvailabilityHPC DAY 2017 | NVIDIA Volta Architecture. Performance. Efficiency. Availability
HPC DAY 2017 | NVIDIA Volta Architecture. Performance. Efficiency. Availability
 
Java on the GPU: Where are we now?
Java on the GPU: Where are we now?Java on the GPU: Where are we now?
Java on the GPU: Where are we now?
 
HPC DAY 2017 | Accelerating tomorrow's HPC and AI workflows with Intel Archit...
HPC DAY 2017 | Accelerating tomorrow's HPC and AI workflows with Intel Archit...HPC DAY 2017 | Accelerating tomorrow's HPC and AI workflows with Intel Archit...
HPC DAY 2017 | Accelerating tomorrow's HPC and AI workflows with Intel Archit...
 
HPC DAY 2017 | HPE Strategy And Portfolio for AI, BigData and HPC
HPC DAY 2017 | HPE Strategy And Portfolio for AI, BigData and HPCHPC DAY 2017 | HPE Strategy And Portfolio for AI, BigData and HPC
HPC DAY 2017 | HPE Strategy And Portfolio for AI, BigData and HPC
 
Latency tracing in distributed Java applications
Latency tracing in distributed Java applicationsLatency tracing in distributed Java applications
Latency tracing in distributed Java applications
 
HPC DAY 2017 | HPE Storage and Data Management for Big Data
HPC DAY 2017 | HPE Storage and Data Management for Big DataHPC DAY 2017 | HPE Storage and Data Management for Big Data
HPC DAY 2017 | HPE Storage and Data Management for Big Data
 
Model Simulation, Graphical Animation, and Omniscient Debugging with EcoreToo...
Model Simulation, Graphical Animation, and Omniscient Debugging with EcoreToo...Model Simulation, Graphical Animation, and Omniscient Debugging with EcoreToo...
Model Simulation, Graphical Animation, and Omniscient Debugging with EcoreToo...
 
Raspberry home server
Raspberry home serverRaspberry home server
Raspberry home server
 
HPC DAY 2017 | Altair's PBS Pro: Your Gateway to HPC Computing
HPC DAY 2017 | Altair's PBS Pro: Your Gateway to HPC ComputingHPC DAY 2017 | Altair's PBS Pro: Your Gateway to HPC Computing
HPC DAY 2017 | Altair's PBS Pro: Your Gateway to HPC Computing
 
LinuxKit and OpenOverlay
LinuxKit and OpenOverlayLinuxKit and OpenOverlay
LinuxKit and OpenOverlay
 
GPU databases - How to use them and what the future holds
GPU databases - How to use them and what the future holdsGPU databases - How to use them and what the future holds
GPU databases - How to use them and what the future holds
 
Design patterns in Java - Monitis 2017
Design patterns in Java - Monitis 2017Design patterns in Java - Monitis 2017
Design patterns in Java - Monitis 2017
 
Getting Started with Embedded Python: MicroPython and CircuitPython
Getting Started with Embedded Python: MicroPython and CircuitPythonGetting Started with Embedded Python: MicroPython and CircuitPython
Getting Started with Embedded Python: MicroPython and CircuitPython
 
An Introduction to OMNeT++ 5.1
An Introduction to OMNeT++ 5.1An Introduction to OMNeT++ 5.1
An Introduction to OMNeT++ 5.1
 
Drive into calico architecture
Drive into calico architectureDrive into calico architecture
Drive into calico architecture
 
Vertx
VertxVertx
Vertx
 
세션1. block chain as a platform
세션1. block chain as a platform세션1. block chain as a platform
세션1. block chain as a platform
 
Scylla Summit 2017: Repair, Backup, Restore: Last Thing Before You Go to Prod...
Scylla Summit 2017: Repair, Backup, Restore: Last Thing Before You Go to Prod...Scylla Summit 2017: Repair, Backup, Restore: Last Thing Before You Go to Prod...
Scylla Summit 2017: Repair, Backup, Restore: Last Thing Before You Go to Prod...
 

Similar to Database Security Threats - MariaDB Security Best Practices

Database Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best PracticesDatabase Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best Practices
MariaDB plc
 
Using MariaDB TX and MaxScale to meet GDPR - #OPEN18
Using MariaDB TX and MaxScale  to meet GDPR - #OPEN18Using MariaDB TX and MaxScale  to meet GDPR - #OPEN18
Using MariaDB TX and MaxScale to meet GDPR - #OPEN18
Kangaroot
 
Uso de MariaDB TX y MaxScale para el cumplimiento de GDPR
Uso de MariaDB TX y MaxScale para el cumplimiento de GDPRUso de MariaDB TX y MaxScale para el cumplimiento de GDPR
Uso de MariaDB TX y MaxScale para el cumplimiento de GDPR
MariaDB plc
 
Securing data and preventing data breaches
Securing data and preventing data breachesSecuring data and preventing data breaches
Securing data and preventing data breaches
MariaDB plc
 
Securing data and preventing data breaches
Securing data and preventing data breachesSecuring data and preventing data breaches
Securing data and preventing data breaches
MariaDB plc
 
Securing data and preventing data breaches
Securing data and preventing data breachesSecuring data and preventing data breaches
Securing data and preventing data breaches
MariaDB plc
 
Database Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best PracticesDatabase Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best Practices
MariaDB plc
 
MaxScale - The Pluggable Router
MaxScale - The Pluggable RouterMaxScale - The Pluggable Router
MaxScale - The Pluggable Router
MariaDB Corporation
 
Database Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best PracticesDatabase Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best Practices
MariaDB plc
 
Deep Dive on Amazon Relational Database Service
Deep Dive on Amazon Relational Database ServiceDeep Dive on Amazon Relational Database Service
Deep Dive on Amazon Relational Database Service
Amazon Web Services
 
How to Manage Scale-Out Environments with MariaDB MaxScale
How to Manage Scale-Out Environments with MariaDB MaxScaleHow to Manage Scale-Out Environments with MariaDB MaxScale
How to Manage Scale-Out Environments with MariaDB MaxScale
MariaDB plc
 
Deep Dive on Amazon Relational Database Service (November 2016)
Deep Dive on Amazon Relational Database Service (November 2016)Deep Dive on Amazon Relational Database Service (November 2016)
Deep Dive on Amazon Relational Database Service (November 2016)
Julien SIMON
 
Webinar: Securing your data - Mitigating the risks with MongoDB
Webinar: Securing your data - Mitigating the risks with MongoDBWebinar: Securing your data - Mitigating the risks with MongoDB
Webinar: Securing your data - Mitigating the risks with MongoDB
MongoDB
 
Enterprise-class security with PostgreSQL - 1
Enterprise-class security with PostgreSQL - 1Enterprise-class security with PostgreSQL - 1
Enterprise-class security with PostgreSQL - 1
Ashnikbiz
 
Cloud Data Strategy event London
Cloud Data Strategy event LondonCloud Data Strategy event London
Cloud Data Strategy event London
MongoDB
 
MongoDB Days UK: Securing Your Deployment with MongoDB Enterprise
MongoDB Days UK: Securing Your Deployment with MongoDB EnterpriseMongoDB Days UK: Securing Your Deployment with MongoDB Enterprise
MongoDB Days UK: Securing Your Deployment with MongoDB Enterprise
MongoDB
 
Securing Your Deployment with MongoDB Enterprise
Securing Your Deployment with MongoDB EnterpriseSecuring Your Deployment with MongoDB Enterprise
Securing Your Deployment with MongoDB Enterprise
MongoDB
 
Deep Dive on MySQL Databases on AWS - AWS Online Tech Talks
Deep Dive on MySQL Databases on AWS - AWS Online Tech TalksDeep Dive on MySQL Databases on AWS - AWS Online Tech Talks
Deep Dive on MySQL Databases on AWS - AWS Online Tech Talks
Amazon Web Services
 
Maximizing performance via tuning and optimization
Maximizing performance via tuning and optimizationMaximizing performance via tuning and optimization
Maximizing performance via tuning and optimization
MariaDB plc
 
Maximizing performance via tuning and optimization
Maximizing performance via tuning and optimizationMaximizing performance via tuning and optimization
Maximizing performance via tuning and optimization
MariaDB plc
 

Similar to Database Security Threats - MariaDB Security Best Practices (20)

Database Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best PracticesDatabase Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best Practices
 
Using MariaDB TX and MaxScale to meet GDPR - #OPEN18
Using MariaDB TX and MaxScale  to meet GDPR - #OPEN18Using MariaDB TX and MaxScale  to meet GDPR - #OPEN18
Using MariaDB TX and MaxScale to meet GDPR - #OPEN18
 
Uso de MariaDB TX y MaxScale para el cumplimiento de GDPR
Uso de MariaDB TX y MaxScale para el cumplimiento de GDPRUso de MariaDB TX y MaxScale para el cumplimiento de GDPR
Uso de MariaDB TX y MaxScale para el cumplimiento de GDPR
 
Securing data and preventing data breaches
Securing data and preventing data breachesSecuring data and preventing data breaches
Securing data and preventing data breaches
 
Securing data and preventing data breaches
Securing data and preventing data breachesSecuring data and preventing data breaches
Securing data and preventing data breaches
 
Securing data and preventing data breaches
Securing data and preventing data breachesSecuring data and preventing data breaches
Securing data and preventing data breaches
 
Database Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best PracticesDatabase Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best Practices
 
MaxScale - The Pluggable Router
MaxScale - The Pluggable RouterMaxScale - The Pluggable Router
MaxScale - The Pluggable Router
 
Database Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best PracticesDatabase Security Threats - MariaDB Security Best Practices
Database Security Threats - MariaDB Security Best Practices
 
Deep Dive on Amazon Relational Database Service
Deep Dive on Amazon Relational Database ServiceDeep Dive on Amazon Relational Database Service
Deep Dive on Amazon Relational Database Service
 
How to Manage Scale-Out Environments with MariaDB MaxScale
How to Manage Scale-Out Environments with MariaDB MaxScaleHow to Manage Scale-Out Environments with MariaDB MaxScale
How to Manage Scale-Out Environments with MariaDB MaxScale
 
Deep Dive on Amazon Relational Database Service (November 2016)
Deep Dive on Amazon Relational Database Service (November 2016)Deep Dive on Amazon Relational Database Service (November 2016)
Deep Dive on Amazon Relational Database Service (November 2016)
 
Webinar: Securing your data - Mitigating the risks with MongoDB
Webinar: Securing your data - Mitigating the risks with MongoDBWebinar: Securing your data - Mitigating the risks with MongoDB
Webinar: Securing your data - Mitigating the risks with MongoDB
 
Enterprise-class security with PostgreSQL - 1
Enterprise-class security with PostgreSQL - 1Enterprise-class security with PostgreSQL - 1
Enterprise-class security with PostgreSQL - 1
 
Cloud Data Strategy event London
Cloud Data Strategy event LondonCloud Data Strategy event London
Cloud Data Strategy event London
 
MongoDB Days UK: Securing Your Deployment with MongoDB Enterprise
MongoDB Days UK: Securing Your Deployment with MongoDB EnterpriseMongoDB Days UK: Securing Your Deployment with MongoDB Enterprise
MongoDB Days UK: Securing Your Deployment with MongoDB Enterprise
 
Securing Your Deployment with MongoDB Enterprise
Securing Your Deployment with MongoDB EnterpriseSecuring Your Deployment with MongoDB Enterprise
Securing Your Deployment with MongoDB Enterprise
 
Deep Dive on MySQL Databases on AWS - AWS Online Tech Talks
Deep Dive on MySQL Databases on AWS - AWS Online Tech TalksDeep Dive on MySQL Databases on AWS - AWS Online Tech Talks
Deep Dive on MySQL Databases on AWS - AWS Online Tech Talks
 
Maximizing performance via tuning and optimization
Maximizing performance via tuning and optimizationMaximizing performance via tuning and optimization
Maximizing performance via tuning and optimization
 
Maximizing performance via tuning and optimization
Maximizing performance via tuning and optimizationMaximizing performance via tuning and optimization
Maximizing performance via tuning and optimization
 

More from MariaDB plc

MariaDB Paris Workshop 2023 - MaxScale 23.02.x
MariaDB Paris Workshop 2023 - MaxScale 23.02.xMariaDB Paris Workshop 2023 - MaxScale 23.02.x
MariaDB Paris Workshop 2023 - MaxScale 23.02.x
MariaDB plc
 
MariaDB Paris Workshop 2023 - Newpharma
MariaDB Paris Workshop 2023 - NewpharmaMariaDB Paris Workshop 2023 - Newpharma
MariaDB Paris Workshop 2023 - Newpharma
MariaDB plc
 
MariaDB Paris Workshop 2023 - Cloud
MariaDB Paris Workshop 2023 - CloudMariaDB Paris Workshop 2023 - Cloud
MariaDB Paris Workshop 2023 - Cloud
MariaDB plc
 
MariaDB Paris Workshop 2023 - MariaDB Enterprise
MariaDB Paris Workshop 2023 - MariaDB EnterpriseMariaDB Paris Workshop 2023 - MariaDB Enterprise
MariaDB Paris Workshop 2023 - MariaDB Enterprise
MariaDB plc
 
MariaDB Paris Workshop 2023 - Performance Optimization
MariaDB Paris Workshop 2023 - Performance OptimizationMariaDB Paris Workshop 2023 - Performance Optimization
MariaDB Paris Workshop 2023 - Performance Optimization
MariaDB plc
 
MariaDB Paris Workshop 2023 - MaxScale
MariaDB Paris Workshop 2023 - MaxScale MariaDB Paris Workshop 2023 - MaxScale
MariaDB Paris Workshop 2023 - MaxScale
MariaDB plc
 
MariaDB Paris Workshop 2023 - novadys presentation
MariaDB Paris Workshop 2023 - novadys presentationMariaDB Paris Workshop 2023 - novadys presentation
MariaDB Paris Workshop 2023 - novadys presentation
MariaDB plc
 
MariaDB Paris Workshop 2023 - DARVA presentation
MariaDB Paris Workshop 2023 - DARVA presentationMariaDB Paris Workshop 2023 - DARVA presentation
MariaDB Paris Workshop 2023 - DARVA presentation
MariaDB plc
 
MariaDB Tech und Business Update Hamburg 2023 - MariaDB Enterprise Server
MariaDB Tech und Business Update Hamburg 2023 - MariaDB Enterprise Server MariaDB Tech und Business Update Hamburg 2023 - MariaDB Enterprise Server
MariaDB Tech und Business Update Hamburg 2023 - MariaDB Enterprise Server
MariaDB plc
 
MariaDB SkySQL Autonome Skalierung, Observability, Cloud-Backup
MariaDB SkySQL Autonome Skalierung, Observability, Cloud-BackupMariaDB SkySQL Autonome Skalierung, Observability, Cloud-Backup
MariaDB SkySQL Autonome Skalierung, Observability, Cloud-Backup
MariaDB plc
 
Einführung : MariaDB Tech und Business Update Hamburg 2023
Einführung : MariaDB Tech und Business Update Hamburg 2023Einführung : MariaDB Tech und Business Update Hamburg 2023
Einführung : MariaDB Tech und Business Update Hamburg 2023
MariaDB plc
 
Hochverfügbarkeitslösungen mit MariaDB
Hochverfügbarkeitslösungen mit MariaDBHochverfügbarkeitslösungen mit MariaDB
Hochverfügbarkeitslösungen mit MariaDB
MariaDB plc
 
Die Neuheiten in MariaDB Enterprise Server
Die Neuheiten in MariaDB Enterprise ServerDie Neuheiten in MariaDB Enterprise Server
Die Neuheiten in MariaDB Enterprise Server
MariaDB plc
 
Global Data Replication with Galera for Ansell Guardian®
Global Data Replication with Galera for Ansell Guardian®Global Data Replication with Galera for Ansell Guardian®
Global Data Replication with Galera for Ansell Guardian®
MariaDB plc
 
Introducing workload analysis
Introducing workload analysisIntroducing workload analysis
Introducing workload analysis
MariaDB plc
 
Under the hood: SkySQL monitoring
Under the hood: SkySQL monitoringUnder the hood: SkySQL monitoring
Under the hood: SkySQL monitoring
MariaDB plc
 
Introducing the R2DBC async Java connector
Introducing the R2DBC async Java connectorIntroducing the R2DBC async Java connector
Introducing the R2DBC async Java connector
MariaDB plc
 
MariaDB Enterprise Tools introduction
MariaDB Enterprise Tools introductionMariaDB Enterprise Tools introduction
MariaDB Enterprise Tools introduction
MariaDB plc
 
Faster, better, stronger: The new InnoDB
Faster, better, stronger: The new InnoDBFaster, better, stronger: The new InnoDB
Faster, better, stronger: The new InnoDB
MariaDB plc
 
The architecture of SkySQL
The architecture of SkySQLThe architecture of SkySQL
The architecture of SkySQL
MariaDB plc
 

More from MariaDB plc (20)

MariaDB Paris Workshop 2023 - MaxScale 23.02.x
MariaDB Paris Workshop 2023 - MaxScale 23.02.xMariaDB Paris Workshop 2023 - MaxScale 23.02.x
MariaDB Paris Workshop 2023 - MaxScale 23.02.x
 
MariaDB Paris Workshop 2023 - Newpharma
MariaDB Paris Workshop 2023 - NewpharmaMariaDB Paris Workshop 2023 - Newpharma
MariaDB Paris Workshop 2023 - Newpharma
 
MariaDB Paris Workshop 2023 - Cloud
MariaDB Paris Workshop 2023 - CloudMariaDB Paris Workshop 2023 - Cloud
MariaDB Paris Workshop 2023 - Cloud
 
MariaDB Paris Workshop 2023 - MariaDB Enterprise
MariaDB Paris Workshop 2023 - MariaDB EnterpriseMariaDB Paris Workshop 2023 - MariaDB Enterprise
MariaDB Paris Workshop 2023 - MariaDB Enterprise
 
MariaDB Paris Workshop 2023 - Performance Optimization
MariaDB Paris Workshop 2023 - Performance OptimizationMariaDB Paris Workshop 2023 - Performance Optimization
MariaDB Paris Workshop 2023 - Performance Optimization
 
MariaDB Paris Workshop 2023 - MaxScale
MariaDB Paris Workshop 2023 - MaxScale MariaDB Paris Workshop 2023 - MaxScale
MariaDB Paris Workshop 2023 - MaxScale
 
MariaDB Paris Workshop 2023 - novadys presentation
MariaDB Paris Workshop 2023 - novadys presentationMariaDB Paris Workshop 2023 - novadys presentation
MariaDB Paris Workshop 2023 - novadys presentation
 
MariaDB Paris Workshop 2023 - DARVA presentation
MariaDB Paris Workshop 2023 - DARVA presentationMariaDB Paris Workshop 2023 - DARVA presentation
MariaDB Paris Workshop 2023 - DARVA presentation
 
MariaDB Tech und Business Update Hamburg 2023 - MariaDB Enterprise Server
MariaDB Tech und Business Update Hamburg 2023 - MariaDB Enterprise Server MariaDB Tech und Business Update Hamburg 2023 - MariaDB Enterprise Server
MariaDB Tech und Business Update Hamburg 2023 - MariaDB Enterprise Server
 
MariaDB SkySQL Autonome Skalierung, Observability, Cloud-Backup
MariaDB SkySQL Autonome Skalierung, Observability, Cloud-BackupMariaDB SkySQL Autonome Skalierung, Observability, Cloud-Backup
MariaDB SkySQL Autonome Skalierung, Observability, Cloud-Backup
 
Einführung : MariaDB Tech und Business Update Hamburg 2023
Einführung : MariaDB Tech und Business Update Hamburg 2023Einführung : MariaDB Tech und Business Update Hamburg 2023
Einführung : MariaDB Tech und Business Update Hamburg 2023
 
Hochverfügbarkeitslösungen mit MariaDB
Hochverfügbarkeitslösungen mit MariaDBHochverfügbarkeitslösungen mit MariaDB
Hochverfügbarkeitslösungen mit MariaDB
 
Die Neuheiten in MariaDB Enterprise Server
Die Neuheiten in MariaDB Enterprise ServerDie Neuheiten in MariaDB Enterprise Server
Die Neuheiten in MariaDB Enterprise Server
 
Global Data Replication with Galera for Ansell Guardian®
Global Data Replication with Galera for Ansell Guardian®Global Data Replication with Galera for Ansell Guardian®
Global Data Replication with Galera for Ansell Guardian®
 
Introducing workload analysis
Introducing workload analysisIntroducing workload analysis
Introducing workload analysis
 
Under the hood: SkySQL monitoring
Under the hood: SkySQL monitoringUnder the hood: SkySQL monitoring
Under the hood: SkySQL monitoring
 
Introducing the R2DBC async Java connector
Introducing the R2DBC async Java connectorIntroducing the R2DBC async Java connector
Introducing the R2DBC async Java connector
 
MariaDB Enterprise Tools introduction
MariaDB Enterprise Tools introductionMariaDB Enterprise Tools introduction
MariaDB Enterprise Tools introduction
 
Faster, better, stronger: The new InnoDB
Faster, better, stronger: The new InnoDBFaster, better, stronger: The new InnoDB
Faster, better, stronger: The new InnoDB
 
The architecture of SkySQL
The architecture of SkySQLThe architecture of SkySQL
The architecture of SkySQL
 

Recently uploaded

The Ultimate Guide to Phone Spy Apps: Everything You Need to Know
The Ultimate Guide to Phone Spy Apps: Everything You Need to KnowThe Ultimate Guide to Phone Spy Apps: Everything You Need to Know
The Ultimate Guide to Phone Spy Apps: Everything You Need to Know
onemonitarsoftware
 
Girls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in City
Girls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in CityGirls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in City
Girls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in City
neshakor5152
 
Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...
Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...
Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...
revolutionary575
 
GT degree offer diploma Transcript
GT degree offer diploma TranscriptGT degree offer diploma Transcript
GT degree offer diploma Transcript
attueb
 
11 Top Cross Browser Testing Tools to Know About.pdf
11 Top Cross Browser Testing Tools to Know About.pdf11 Top Cross Browser Testing Tools to Know About.pdf
11 Top Cross Browser Testing Tools to Know About.pdf
kalichargn70th171
 
Independent Girls call Service Pune 000XX00000 Provide Best And Top Girl Serv...
Independent Girls call Service Pune 000XX00000 Provide Best And Top Girl Serv...Independent Girls call Service Pune 000XX00000 Provide Best And Top Girl Serv...
Independent Girls call Service Pune 000XX00000 Provide Best And Top Girl Serv...
bhumivarma35300
 
Artificial intelligence in customer services or chatbots
Artificial intelligence  in customer services or chatbotsArtificial intelligence  in customer services or chatbots
Artificial intelligence in customer services or chatbots
kayash1656
 
Top Chinese Government-backed APT Groups
Top Chinese Government-backed APT GroupsTop Chinese Government-backed APT Groups
Top Chinese Government-backed APT Groups
SOCRadar
 
Verified Girls Call Mumbai 👀 9820252231 👀 Cash Payment With Room DeliveryDeli...
Verified Girls Call Mumbai 👀 9820252231 👀 Cash Payment With Room DeliveryDeli...Verified Girls Call Mumbai 👀 9820252231 👀 Cash Payment With Room DeliveryDeli...
Verified Girls Call Mumbai 👀 9820252231 👀 Cash Payment With Room DeliveryDeli...
87tomato
 
Girls Call Jogeshwari 9967584737 Provide Best And Top Girl Service And No1 in...
Girls Call Jogeshwari 9967584737 Provide Best And Top Girl Service And No1 in...Girls Call Jogeshwari 9967584737 Provide Best And Top Girl Service And No1 in...
Girls Call Jogeshwari 9967584737 Provide Best And Top Girl Service And No1 in...
simran hot girls
 
Private Girls Call Navi Mumbai 🛵🚡9820252231 💃 Choose Best And Top Girl Servic...
Private Girls Call Navi Mumbai 🛵🚡9820252231 💃 Choose Best And Top Girl Servic...Private Girls Call Navi Mumbai 🛵🚡9820252231 💃 Choose Best And Top Girl Servic...
Private Girls Call Navi Mumbai 🛵🚡9820252231 💃 Choose Best And Top Girl Servic...
902basic
 
Unleashing the Future: Building a Scalable and Up-to-Date GenAI Chatbot with ...
Unleashing the Future: Building a Scalable and Up-to-Date GenAI Chatbot with ...Unleashing the Future: Building a Scalable and Up-to-Date GenAI Chatbot with ...
Unleashing the Future: Building a Scalable and Up-to-Date GenAI Chatbot with ...
confluent
 
Russian Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service ...
Russian Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service ...Russian Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service ...
Russian Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service ...
shanihomely
 
Odoo E-commerce website development guides
Odoo E-commerce website development guidesOdoo E-commerce website development guides
Odoo E-commerce website development guides
jhkdigitalmarketing
 
ThaiPy meetup - Indexes and Django
ThaiPy meetup - Indexes and DjangoThaiPy meetup - Indexes and Django
ThaiPy meetup - Indexes and Django
akshesh doshi
 
ERP Software Solutions Provider in Coimbatore
ERP Software Solutions Provider in CoimbatoreERP Software Solutions Provider in Coimbatore
ERP Software Solutions Provider in Coimbatore
Nextskill Technologies
 
Agra Girls Call Agra 0X0000000X Unlimited Short Providing Girls Service Avail...
Agra Girls Call Agra 0X0000000X Unlimited Short Providing Girls Service Avail...Agra Girls Call Agra 0X0000000X Unlimited Short Providing Girls Service Avail...
Agra Girls Call Agra 0X0000000X Unlimited Short Providing Girls Service Avail...
rachitkumar09887
 
Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...
Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...
Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...
3610stuck
 
Wired_2.0_Create_AmsterdamJUG_09072024.pptx
Wired_2.0_Create_AmsterdamJUG_09072024.pptxWired_2.0_Create_AmsterdamJUG_09072024.pptx
Wired_2.0_Create_AmsterdamJUG_09072024.pptx
SimonedeGijt
 
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
ThousandEyes
 

Recently uploaded (20)

The Ultimate Guide to Phone Spy Apps: Everything You Need to Know
The Ultimate Guide to Phone Spy Apps: Everything You Need to KnowThe Ultimate Guide to Phone Spy Apps: Everything You Need to Know
The Ultimate Guide to Phone Spy Apps: Everything You Need to Know
 
Girls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in City
Girls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in CityGirls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in City
Girls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in City
 
Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...
Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...
Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...
 
GT degree offer diploma Transcript
GT degree offer diploma TranscriptGT degree offer diploma Transcript
GT degree offer diploma Transcript
 
11 Top Cross Browser Testing Tools to Know About.pdf
11 Top Cross Browser Testing Tools to Know About.pdf11 Top Cross Browser Testing Tools to Know About.pdf
11 Top Cross Browser Testing Tools to Know About.pdf
 
Independent Girls call Service Pune 000XX00000 Provide Best And Top Girl Serv...
Independent Girls call Service Pune 000XX00000 Provide Best And Top Girl Serv...Independent Girls call Service Pune 000XX00000 Provide Best And Top Girl Serv...
Independent Girls call Service Pune 000XX00000 Provide Best And Top Girl Serv...
 
Artificial intelligence in customer services or chatbots
Artificial intelligence  in customer services or chatbotsArtificial intelligence  in customer services or chatbots
Artificial intelligence in customer services or chatbots
 
Top Chinese Government-backed APT Groups
Top Chinese Government-backed APT GroupsTop Chinese Government-backed APT Groups
Top Chinese Government-backed APT Groups
 
Verified Girls Call Mumbai 👀 9820252231 👀 Cash Payment With Room DeliveryDeli...
Verified Girls Call Mumbai 👀 9820252231 👀 Cash Payment With Room DeliveryDeli...Verified Girls Call Mumbai 👀 9820252231 👀 Cash Payment With Room DeliveryDeli...
Verified Girls Call Mumbai 👀 9820252231 👀 Cash Payment With Room DeliveryDeli...
 
Girls Call Jogeshwari 9967584737 Provide Best And Top Girl Service And No1 in...
Girls Call Jogeshwari 9967584737 Provide Best And Top Girl Service And No1 in...Girls Call Jogeshwari 9967584737 Provide Best And Top Girl Service And No1 in...
Girls Call Jogeshwari 9967584737 Provide Best And Top Girl Service And No1 in...
 
Private Girls Call Navi Mumbai 🛵🚡9820252231 💃 Choose Best And Top Girl Servic...
Private Girls Call Navi Mumbai 🛵🚡9820252231 💃 Choose Best And Top Girl Servic...Private Girls Call Navi Mumbai 🛵🚡9820252231 💃 Choose Best And Top Girl Servic...
Private Girls Call Navi Mumbai 🛵🚡9820252231 💃 Choose Best And Top Girl Servic...
 
Unleashing the Future: Building a Scalable and Up-to-Date GenAI Chatbot with ...
Unleashing the Future: Building a Scalable and Up-to-Date GenAI Chatbot with ...Unleashing the Future: Building a Scalable and Up-to-Date GenAI Chatbot with ...
Unleashing the Future: Building a Scalable and Up-to-Date GenAI Chatbot with ...
 
Russian Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service ...
Russian Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service ...Russian Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service ...
Russian Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service ...
 
Odoo E-commerce website development guides
Odoo E-commerce website development guidesOdoo E-commerce website development guides
Odoo E-commerce website development guides
 
ThaiPy meetup - Indexes and Django
ThaiPy meetup - Indexes and DjangoThaiPy meetup - Indexes and Django
ThaiPy meetup - Indexes and Django
 
ERP Software Solutions Provider in Coimbatore
ERP Software Solutions Provider in CoimbatoreERP Software Solutions Provider in Coimbatore
ERP Software Solutions Provider in Coimbatore
 
Agra Girls Call Agra 0X0000000X Unlimited Short Providing Girls Service Avail...
Agra Girls Call Agra 0X0000000X Unlimited Short Providing Girls Service Avail...Agra Girls Call Agra 0X0000000X Unlimited Short Providing Girls Service Avail...
Agra Girls Call Agra 0X0000000X Unlimited Short Providing Girls Service Avail...
 
Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...
Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...
Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...
 
Wired_2.0_Create_AmsterdamJUG_09072024.pptx
Wired_2.0_Create_AmsterdamJUG_09072024.pptxWired_2.0_Create_AmsterdamJUG_09072024.pptx
Wired_2.0_Create_AmsterdamJUG_09072024.pptx
 
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
 

Database Security Threats - MariaDB Security Best Practices

  • 1. Database Security Threats - MariaDB Security Best Practices Jonathan Day, MariaDB Senior Solution Architect
  • 3. The Internet Threats Viruses Hacker attacks Defense • Don’t allow TCP connections to MariaDB from the Internet • Evaluate your DNS infrastructure • Configure MariaDB to listen only to the application host • Design your physical network to connect the app to MariaDB • Use bind-address to bind to a specific network interface • Use your OS’s firewall • Keep your OS patched
  • 4. Applications Threats Denial of Service Attacks created by overloading application SQL query injection attacks Defense • Don’t run your application on the MariaDB Server • Don’t install unnecessary packages – An overloaded application can cause MariaDB to be slow or even killed by the OS. (DDoS attack vector) – A compromised application or service can have many serious side effects • Discovery of MariaDB credentials • Direct access to data • Privilege escalation
  • 5. Excessive Trust Threats Disgruntled employees Mistakes and human error Defense • Limit users who have: – SSH access to your MariaDB server. – Sudo privileges on your MariaDB server. • Set the secure_file_priv option to ensure that users with the FILE privilege cannot write or read MariaDB data or important system files. • Do not run mysqld as root • Avoid ‘%”, use specific host names
  • 6. Excessive Trust Threats Disgruntled employees Mistakes and human error Defense • Don’t use the MariaDB “root” user for application access • Minimize the privileges granted to the MariaDB accounts used by your applications – Don’t grant CREATE or DROP privileges. – Don’t grant the FILE privilege. – Don’t grant the SUPER privilege. – Don’t grant access to the mysql database • Grant only the privileges required
  • 7. Best Practices: Encryption • Encrypt sensitive data in the application – Credit Card numbers, PII • Encrypt data at rest – InnoDB tablespace encryption – InnoDB redo log encryption – Binary log encryption • Encrypt data in transit with SSL – From clients to MariaDB – From clients to MariaDB MaxScale – Between MariaDB replicated servers
  • 8. Best Practices: Use a database proxy • Use MariaDB MaxScale as a database firewall • Restrict the operations that clients are allowed to perform • Identify and flag potentially dangerous queries • Customize rules about what’s allowed and what’s not • Implement connection pooling capabilities
  • 9. Best Practices: User Management • Protect MariaDB data and backups via OS permissions • Use strong passwords • Allow root access to MariaDB only from local clients—no administrative access over the network • Use a separate MariaDB user account for each of your applications • Allow access from a minimal set of IP addresses • Regularly audit your users and grants
  • 10. Best Practices: Auditing • Use MariaDB Audit Plugin to log events to syslog or files • Ensure regulatory compliance with robust logging • Record connections, query executions, and tables accessed • Be selective in what your are monitoring • Plan auditing resources – Budget – Processes • Consider using “Honeypots” • Have a process to review the logs and follow it… Very Important • Audit your auditing
  • 12. Authentication Password Validation Simple_password_check plugin Enforce a minimum password length and type/number of characters to be used External Authentication • Single Sign On is becoming mandatory in many Enterprises. – PAM-Authentication Plugin allows using /etc/shadow and any PAM based authentication like LDAP – Kerberos-Authentication as a standardized network authentication protocol is provided GSSAPI based on UNIX and SSPI based on Windows
  • 13. MariaDB PAM Authentication GSS-API on Linux • Red Hat Directory Server • OpenLDAP SSPI on Windows • Active DirectoryKDC Client MariaDB 2 3 4 1 Ticket request Service ticket Here is my service ticket, authenticate me Client / server session
  • 14. MariaDB 10.2 New User Features ● The SHOW CREATE USER statement was introduced. ● New CREATE USER options for limiting resource usage and tls/ssl. ● New ALTER USER statement.
  • 15. MariaDB Role Based Access Control DBA Developer Sysadmin Database Tables MariaDB 10 Role: DBA Permissions: • Update Schema • View Statistics • Create Database
  • 16. Encryption for Data in Motion Secured Connections SSL Connections based on the TLSv1.2 Protocol Between MariaDB Connectors and Server Between MariaDB Connectors and MaxScale SSL can also be enabled for the replication channel Encryption • Application control of data encryption • Based on the AES (Advanced Encryption Standard) or DES (Data Encryption Standard) algorithm
  • 17. Encryption for Data at Rest Data-at-rest Encryption • Everything: – Tables or tablespaces – Log files • Independent of encryption capabilities of applications • Based on encryption keys, key ids, key rotation and key versioning • Low performance overhead Key Management Services • Encryption plugin API offers choice – Plugin to implement the data encryption – Manage encryption Keys • MariaDB Server options – Simple Key Management included – Amazon AWS KMS Plugin included – Eperi KMS for on premise key management – optional
  • 18. MariaDB Audit Plugin • Logs server activity – Who connected to the server – Source of connection – Queries executed – Tables touched • File based or syslog based logging Auditing for Security and Compliance Connection Disconnect Connect Failed Connect Timestamp Host User SessionQuery DML + TCL DDL DCL Object Tables Database
  • 20. Attack Protection with MariaDB MaxScale Database Firewall Denial of Service Attack Protection • MariaDB MaxScale Persistent Connections • Connection pooling protects against connection surges • Cache the connections from MaxScale to the database server • Rate limitation • Client multiplexing • Protects against SQL injection • Prevents unauthorized user access and data damage • White-list or Black-list Queries – Queries that match a set of rules – Queries matching rules for specified users – Queries that match certain patterns, columns, statement types • Multiple ordered rule
  • 21. MariaDB MaxScale • Database Proxy for – Security – Scalability – High Availability – Data Streaming • Insulates client applications from the complexities of backend database cluster. • Core + functionality provided by plugins – Protocol – Filters – Routers – Monitors Core Protocol Authentication Filter& Logging Monitor Routing MaxScale Client Master Slave Slave
  • 22. Database Firewall • A filter installed into the request processing chain. • Rules define what constitutes a match: – wildcard, columns, function, regex, no where clause – when to apply – what users are affected – what statements are affected • The filter mode defines what to do with a match: – allow => whitelist – block => blacklist • limit_queries rule sensible only with blacklisting – match if more than N queries are made within a time period Client MaxScale Filter Router
  • 23. Database Firewall Example [TheFirewall] type=filter module=dbfwfilter action=block rules=firewall-rules.txt [TheService] type=service ... filters=TheFirewall MaxScale configuration file. rule require_where_clause deny no_where_clause on_queries select users %@% match all rules require_where_clause Only defines what constitutes a match. ● wildcard ● columns col1-name col2-name … ● regex regular expression ● no_where_clause ● ... on_queries [select|update|...] MySQL [testdb]> select * from table; ERROR 1141 (HY000): Access denied for user 'johan'@'127.0.0.1': Required WHERE/HAVING clause is missing. MySQL [testdb]>
  • 24. DDoS: Server Overload Protection • Persistent connections to backend. – When server connections are logically closed, keep them in pool for reuse. • Client connection limitation. – Specify the maximum number of connections for a particular service. • Limit rate of queries using the firewall. [SomeService] ... max_connections=100 maxscale.cnf[SomeServer] ... maxpersistpoolmax=30 maxscale.cnf rule prevent_overload deny limit_queries 15 5 10 firewall.txt Client Client Client Client If more than 15 queries are received in 5 seconds, block all queries for 10 seconds.
  • 25. DDoS: Network Overload Protection • Cap the amount that can be returned. – By rows or by size. – Data will be returned to MaxScale, but MaxScale will not necessarily forward to client. • Limit rate of queries using the firewall. [LimitSize] type=filter module=maxrows max_resultset_rows=500 firewall.txt Client Client Client Client rule prevent_overload deny limit_queries 15 5 10
  • 26. MaxRows Filter • Set cap on the amount of data that can be returned. – Specified by number of resultset rows and/or resultset size. If both are specified, then both apply. • Configuration options: – max_resultset_rows: The maximum number of rows that may be returned. – max_resultset_size: The maximum amount of data that may be returned. – max_resultset_return: What should be returned in case the limit is reached. empty: An empty resultset. ok: An OK packet. error: An error packet containing the offending statement.
  • 27. MaxRows Configuration Example [TheLimitations] type=filter module=maxrows max_resultset_rows=1000 max_resultset_size=262144 max_resultset_return=error [TheService] type=service ... filters=TheLimitations At most 1000 rows may be returned. At most 256 kilobytes may be returned. That could also be expressed as 256Ki. If either the rows or size limit is reached, return an error packet containing the offending statement. MariaDB [(test)]> select * from table; ERROR 1415 (0A000): Row limit/size exceeded for query: select * from table
  • 28. Selective Data Masking • Mask the values of certain columns. – Allow the use of column in a query, but do not return the actual value. > SELECT name, ssn FROM person; +-------+-------------+ + name | ssn | +-------+-------------+ | Alice | 721-07-4426 | | Bob | 435-22-3267 | ... > SELECT name, ssn FROM person; +-------+-------------+ + name | ssn | +-------+-------------+ | Alice | XXX-XX-XXXX | | Bob | XXX-XX-XXXX | ... Without masking With masking
  • 29. Selective Data Masking Configuration Example { "rules": [ { "replace": { "column": "ssn" }, "with": { "value": "XXX-XX-XXXX", "fill": "Y" }, "exempted": [ "'admin'" ] } ] } [TheMasking] type=filter module=masking warn_type_mismatch=always large_payload=abort rules=masking_rules.json [TheService] type=service ... filters=TheMasking Replace the value of all columns whose name is “SSN” irrespective of which table or database is in question. Replace the value with “XXX-XX-XXXX”. However, that will be done only if the length of the database value is exactly the same as the length of the replacement string. Should the length of the database value not exactly match the length of the replacement string, replace the value with as many “Y” as needed. The masking is applied to every user (no applies_to key), except the user “admin”.
  • 30. Current Masking Limitations • The masking works only on the result set, not on the request. – Trivial to bypass. > SELECT fld FROM tbl; +-------+ | a | +-------+ | XXXXX | +-------+ > SELECT concat(fld) FROM tbl; +-------------+ | concat(fld) | +-------------+ | hello | +-------------+ • Preventing that requires combining the firewall filter with the masking filter. • In 2.1 it is quite complex. • In 2.2 it will be explicitly possible to deny the use of functions in conjunction with certain columns.