{"id":81884,"date":"2020-05-17T13:42:18","date_gmt":"2020-05-17T11:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity"},"modified":"2020-05-17T13:42:18","modified_gmt":"2020-05-17T11:42:18","slug":"bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","title":{"rendered":"Security and DBMS: what to keep in mind when selecting protection measures.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<h1><img decoding=\"async\" alt=\"Security and DBMS: what to keep in mind when selecting protection measures.\" src=\"\/wp-content\/uploads\/2020\/05\/ac49253838e36336af127d71394139d8.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/h1>\n<p>\nMy name is Denis Rozhkov, and I am the head of software development at Gazinformservice, part of the product team. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\">Jatoba<\/a><\/noindex>. Legislation and corporate standards impose certain requirements on data storage security. No one wants third parties to access confidential information, which is why the following issues are crucial for any project: identification and authentication, access management to data, ensuring information integrity in the system, and logging security events. Therefore, I want to discuss some interesting points regarding database security. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nThis article is based on a presentation at <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup,<\/a><\/noindex> organized by <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/\">Mail.ru Cloud Solutions<\/a><\/noindex>. If you don't want to read, you can watch:<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"n-54j9FHaMU\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/n-54j9FHaMU\/hqdefault.jpg\" alt=\"Play video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\nThe article will have three parts:<\/p>\n<ul>\n<li>How to secure connections.<\/li>\n<li>What is action auditing and how to log what happens from the database side and the connection to it.<\/li>\n<li>How to protect data within the database itself and what technologies are available for this.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Security and DBMS: what to keep in mind when selecting protection measures.\" src=\"\/wp-content\/uploads\/2020\/05\/fbdca7f4a925b9ceb78de06c6e245b23.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>The three components of database security: connection protection, action auditing, and data protection.<\/i><\/p>\n<h2>Connection Protection<\/h2>\n<p>\nYou can connect to the database either directly or indirectly through web applications. Typically, a business user, that is, a person who works with the database management system (DBMS), interacts with it indirectly.<\/p>\n<p>Before discussing connection protection, it's important to answer key questions that determine how security measures will be structured:<\/p>\n<ul>\n<li>Is one business user equivalent to one DBMS user?<\/li>\n<li>Is access to DBMS data provided only through an API that you control, or is there direct access to tables?<\/li>\n<li>Is the DBMS isolated in a separate secure segment, and who interacts with it?<\/li>\n<li>Is pooling\/proxy and intermediary layers used that can change information about how the connection is structured and who is using the database?<\/li>\n<\/ul>\n<p>\nNow let's look at the tools that can be used to protect connections:<\/p>\n<ol>\n<li>Use database firewall-class solutions. An additional layer of protection will at least increase visibility into what is happening in the DBMS, and at most, you will be able to ensure additional data protection.<\/li>\n<li>Utilize password policies. Their application depends on how your architecture is structured. In any case, having only one password in the configuration file of a web application that connects to the DBMS is insufficient for protection. There are several DBMS tools that allow you to monitor what user and password require updating.\n<p>You can read more about user assessment features <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.cloud.oracle.com\/en-us\/iaas\/data-safe\/doc\/user-assessment-reports.html\">here<\/a><\/noindex>, and you can also learn about MS SQL Vulnerability Assessment <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.microsoft.com\/en-us\/sql\/relational-databases\/security\/sql-vulnerability-assessment?view=sql-server-ver15\">here<\/a><\/noindex>.\u00a0<\/li>\n<li>Enrich the session context with necessary information. If the session is opaque, and you do not understand who is operating within the DBMS, you can supplement the information regarding who is doing what and why within the executed operation. This information can be seen in the audit.<\/li>\n<li>Configure SSL if you do not have network segregation between the DBMS and end-users, and it is not in a separate VLAN. In such cases, it is essential to secure the channel between the consumer and the DBMS. Protection tools are available, including open source options.<\/li>\n<\/ol>\n<p><\/p>\n<h3>How will this affect DBMS performance?<\/h3>\n<p>\nLet's look at the example of PostgreSQL, how SSL affects CPU load, increases timings, and decreases TPS; will it not consume too many resources if enabled.<\/p>\n<p>We load PostgreSQL using pgbench \u2014 a simple program for running performance tests. It repeatedly executes a single sequence of commands, possibly in parallel database sessions, and then calculates the average transaction speed.<\/p>\n<p><strong>Test 1 without SSL and with SSL<\/strong> \u2014 a connection is established for each transaction:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require\nsslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Test 2 without SSL and with SSL<\/strong> \u2014 all transactions are executed in one connection:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require\nsslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Other settings<\/strong>:<\/p>\n<pre><code class=\"plaintext\">scaling factor: 1\nquery mode: simple\nnumber of clients: 10\nnumber of threads: 1\nnumber of transactions per client: 5000\nnumber of transactions actually processed: 50000\/50000<\/code><\/pre>\n<p>\n<strong>Test Results<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>NO SSL<\/strong><br \/>\n<strong>SSL<\/strong><\/p>\n<p><strong>A connection is established for each transaction<\/strong><\/p>\n<p>latency average<br \/>\n171.915 ms<br \/>\n187.695 ms<\/p>\n<p>tps including connections establishing<br \/>\n58.168112<br \/>\n53.278062<\/p>\n<p>tps excluding connections establishing<br \/>\n64.084546<br \/>\n58.725846<\/p>\n<p>CPU<br \/>\n24%<br \/>\n28%<\/p>\n<p><strong>All transactions are executed in one connection<\/strong><\/p>\n<p>latency average<br \/>\n6.722 ms<br \/>\n6.342 ms<\/p>\n<p>tps including connections establishing<br \/>\n1587.657278<br \/>\n1576.792883<\/p>\n<p>tps excluding connections establishing<br \/>\n1588.380574<br \/>\n1577.694766<\/p>\n<p>CPU<br \/>\n17%<br \/>\n21%<\/p>\n<p>\nUnder light loads, the impact of SSL is comparable to measurement error. However, if the volume of transmitted data is very large, the situation may be different. If we establish one connection per transaction (which is rare, as connections are typically shared among users), the number of connects\/disconnects can increase, slightly raising the impact. In other words, there might be performance risks, but the difference is not significant enough to forgo security.<\/p>\n<p>Note that there is a significant difference when comparing operating modes: whether you're working within a single session or across different ones. This is understandable: resources are consumed in establishing each connection.<\/p>\n<p>We had a case where we connected Zabbix in trust mode, meaning we did not check md5; authentication was unnecessary. Later, the client requested to enable md5 authentication. This led to a considerable CPU load, and performance declined. We began searching for optimization routes. One possible solution is to implement network restrictions, create separate VLANs for the DBMS, and add configurations to clarify who is connecting and from where, while eliminating authentication. Additionally, authentication settings can be optimized to reduce costs when enabling authentication, but in general, the use of various authentication methods impacts performance and must be factored into the design of server computational resources (hardware) for the DBMS.<\/p>\n<p>Conclusion: in several solutions, even minor nuances in authentication can significantly affect the project, and it is unfortunate when this becomes apparent only during deployment into production.<\/p>\n<h2>Action Audit<\/h2>\n<p>\nAuditing may not be limited to the DBMS. An audit entails gathering information about what is happening across various segments. This can include database firewalls and the operating system on which the DBMS is built.<\/p>\n<p>In commercial Enterprise-level DBMS systems, auditing is well-managed, but this is not always the case in open-source systems. Here\u2019s what is available in PostgreSQL:<\/p>\n<ul>\n<li>default log \u2014 built-in logging;<\/li>\n<li>extensions: pgaudit \u2014 if the default logging is insufficient, separate configurations can be utilized to address some tasks.<\/li>\n<\/ul>\n<p>\n<b>Supplement to the report in the video:<\/b><\/p>\n<p>The basic registration of operators can be achieved using the standard logging tool with log_statement = all.<\/p>\n<p>This is acceptable for monitoring and other types of usage, but does not provide the level of detail typically required for auditing.<\/p>\n<p>It is not enough to have a list of all operations performed on the database.<\/p>\n<p>There should also be a way to find specific statements that are of interest to the auditor.<\/p>\n<p>The standard logging tool shows what the user requested, while pgAudit focuses on the details of what happened when the database executed the request.<\/p>\n<p>For example, an auditor may want to ensure that a particular table was created during a documented maintenance window.<\/p>\n<p>This may seem like a simple task for basic auditing and grep, but what if you get something like this (intentionally convoluted) example:<\/p>\n<p>DO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<\/p>\n<p>The standard logging will give you this:<\/p>\n<p>LOG: statement: DO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<\/p>\n<p>It seems that finding the table of interest may require some knowledge of the code in cases where tables are created dynamically.<\/p>\n<p>This is not ideal, as it would be preferable to simply search by the table name.<\/p>\n<p>This is where pgAudit will be useful.<\/p>\n<p>For the same input, it will produce this output in the log:<\/p>\n<p>AUDIT: SESSION,33,1,FUNCTION,DO,,,\"DO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;\"<br \/>\nAUDIT: SESSION,33,2,DDL,CREATE TABLE,TABLE,public.important_table,CREATE TABLE important_table (id INT)<\/p>\n<p>Not only the DO block is logged, but also the full text of CREATE TABLE with the type of operator, object type, and full name, which makes searching easier.<\/p>\n<p>When logging SELECT and DML operators, pgAudit can be configured to log a separate entry for each relation referenced in the operator.<\/p>\n<p>No parsing is required to find all operators that pertain to a specific table (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/pgaudit\/pgaudit\/blob\/master\/README.md\">*<\/a><\/noindex>)\u00bb.<\/p>\n<h3>How will this affect DBMS performance?<\/h3>\n<p>\nLet's run tests with full auditing enabled and see how it affects PostgreSQL performance. We will enable maximum database logging across all parameters.<\/p>\n<p>In the configuration file, we change almost nothing; the important thing is to enable debug5 mode to get the most information.<\/p>\n<p>postgresql.conf<\/p>\n<p>log_destination = 'stderr'<br \/>\nlogging_collector = on<br \/>\nlog_truncate_on_rotation = on<br \/>\nlog_rotation_age = 1d<br \/>\nlog_rotation_size = 10MB<br \/>\nlog_min_messages = <strong>debug5<\/strong><br \/>\nlog_min_error_statement = <strong>debug5<\/strong><br \/>\nlog_min_duration_statement = 0<br \/>\ndebug_print_parse = on<br \/>\ndebug_print_rewritten = on<br \/>\ndebug_print_plan = on<br \/>\ndebug_pretty_print = on<br \/>\nlog_checkpoints = on<br \/>\nlog_connections = on<br \/>\nlog_disconnections = on<br \/>\nlog_duration = on<br \/>\nlog_hostname = on<br \/>\nlog_lock_waits = on<br \/>\nlog_replication_commands = on<br \/>\nlog_temp_files = 0<br \/>\nlog_timezone = 'Europe\/Moscow'<\/p>\n<p>\nOn PostgreSQL with parameters 1 CPU, 2.8 GHz, 2 GB RAM, 40 GB HDD, we conduct three load tests using the following commands:<\/p>\n<pre><code class=\"plaintext\">$ pgbench -p 3389 -U postgres -i -s 150 benchmark\n$ pgbench -p 3389 -U postgres -c 50 -j 2 -P 60 -T 600 benchmark\n$ pgbench -p 3389 -U postgres -c 150 -j 2 -P 60 -T 600 benchmark<\/code><\/pre>\n<p>\n<strong>Test results:<\/strong><\/p>\n<p><strong>Without logging<\/strong><br \/>\n<strong>With logging<\/strong><\/p>\n<p>Total time to fill the DB<br \/>\n43.74 sec<br \/>\n53.23 sec<\/p>\n<p>RAM<br \/>\n24%<br \/>\n40%<\/p>\n<p>CPU<br \/>\n72%<br \/>\n91%<\/p>\n<p><strong>Test 1 (50 connections)<\/strong><\/p>\n<p>Number of transactions in 10 min<br \/>\n74169<br \/>\n32445<\/p>\n<p>Transactions\/sec<br \/>\n123<br \/>\n54<\/p>\n<p>Average latency<br \/>\n405 ms<br \/>\n925 ms<\/p>\n<p><strong>Test 2 (150 connections with 100 possible)<\/strong><\/p>\n<p>Number of transactions in 10 min<br \/>\n81727<br \/>\n31429<\/p>\n<p>Transactions\/sec<br \/>\n136<br \/>\n52<\/p>\n<p>Average latency<br \/>\n550 ms<br \/>\n1432 ms<\/p>\n<p><strong>About sizes<\/strong><\/p>\n<p>DB size<br \/>\n2251 MB<br \/>\n2262 MB<\/p>\n<p>Log size of the DB<br \/>\n0 MB<br \/>\n4587 MB<\/p>\n<p>\nIn conclusion: full auditing is not very good. The data from auditing will amount to the same volume as the data in the database itself, or even more. Such a volume of logging generated during operation with the DBMS is a common problem in production.<\/p>\n<p>Let's look at other parameters:<\/p>\n<ul>\n<li>The speed doesn't change much: without logging \u2014 43.74 sec, with logging \u2014 53.23 sec.<\/li>\n<li>Performance in terms of RAM and CPU will decline, as a file for auditing needs to be created. This is also noticeable in production.<\/li>\n<\/ul>\n<p>\nWith an increase in the number of connections, naturally, the indicators will deteriorate slightly.<\/p>\n<p>In corporations with auditing, it\u2019s even more complex:<\/p>\n<ul>\n<li>there is a lot of data;<\/li>\n<li>audit is needed not only through syslog in SIEM but also in files: in case something happens with syslog, there should be a file close to the database where data is saved;<\/li>\n<li>for auditing, a separate shelf is needed to avoid degrading disk I\/O, as it takes up a lot of space;<\/li>\n<li>sometimes IT staff need standards everywhere; they require state identification.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Access restriction to data<\/h2>\n<p>\nLet\u2019s look at the technologies used to protect data and access to it in commercial DBMS and open source.<\/p>\n<p>What can generally be used:<\/p>\n<ol>\n<li>Encryption and obfuscation of procedures and functions (Wrapping) \u2014 i.e., separate tools and utilities that make readable code unreadable. However, it cannot be changed or refactored back. This approach is sometimes required at least on the DBMS side \u2014 the logic of licensing restrictions or authorization logic is encrypted precisely at the level of procedures and functions.<\/li>\n<li>Row-Level Security (RLS) is when different users see the same table but different rows within it, meaning some information is restricted from being viewed at the row level.<\/li>\n<li>Data Masking is when users in one column of a table either see the data or just asterisks, meaning for some users the information will be hidden. The technology determines what to show each user based on their access level.<\/li>\n<li>Access Control for Security DBA\/Application DBA\/DBA is more about limiting access to the database management system itself, allowing for the separation of information security staff from database and application administrators. There aren't many such technologies in open source, but there are plenty in commercial DBMS. They are necessary when there are many users with access to the servers.<\/li>\n<li>File access restrictions at the filesystem level allow for granting rights and privileges to directories so that each administrator only accesses the necessary data.<\/li>\n<li>Mandatory access and memory cleansing are technologies that are rarely used.<\/li>\n<li>End-to-end encryption directly from the DBMS is client-side encryption with key management on the server side.<\/li>\n<li>Data encryption, such as column-level encryption, is when you use a mechanism that encrypts a specific column of the database.<\/li>\n<\/ol>\n<p><\/p>\n<h3>How does this affect DBMS performance?<\/h3>\n<p>\nLet's look at column encryption in PostgreSQL as an example. There is a pgcrypto module that allows certain fields to be stored in encrypted form. This is useful when only some data is valuable. To read encrypted fields, the client sends a decryption key, the server decrypts the data, and returns it to the client. Without the key, no one can do anything with your data.<\/p>\n<p><strong>Let's conduct a test with pgcrypto<\/strong>. We will create a table with encrypted data and another with regular data. Below are the commands to create the tables, with the first line being a useful command to create the extension and register the DBMS:<\/p>\n<pre><code class=\"plaintext\">CREATE EXTENSION pgcrypto;\nCREATE TABLE t1 (id integer, text1 text, text2 text);\nCREATE TABLE t2 (id integer, text1 bytea, text2 bytea);\nINSERT INTO t1 (id, text1, text2)\nVALUES (generate_series(1,10000000), generate_series(1,10000000)::text, generate_series(1,10000000)::text);\nINSERT INTO t2 (id, text1, text2) VALUES (\ngenerate_series(1,10000000),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'));<\/code><\/pre>\n<p>\nNext, we will try to create a data selection from each table and observe the execution timings.<\/p>\n<p><strong>Selection from the table without encryption function<\/strong>:<\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select * from t1 limit 1000;\" \"host=192.168.220.129 dbname=taskdb\nuser=postgres sslmode=disable\" &gt; 1.txt<\/code><\/pre>\n<p>\nThe stopwatch is running.<\/p>\n<p>\u00a0\u00a0id | text1 | text2<br \/>\n----+----+-+----<br \/>\n 1 | 1 \u00a0 \u00a0 | 1<br \/>\n 2 | 2 \u00a0 \u00a0 | 2<br \/>\n 3 | 3 \u00a0 \u00a0 | 3<br \/>\n\u2026<br \/>\n997 | 997 \u00a0 | 997<br \/>\n998 | 998 \u00a0 | 998<br \/>\n999 | 999 \u00a0 | 999<br \/>\n1000 | 1000\u00a0 | 1000<br \/>\n(1000 rows)<\/p>\n<p>Time: 1.386 ms<\/p>\n<p><strong>Selection from the table with encryption function:<\/strong><\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select id, decrypt(text1, 'key'::bytea, 'bf'),\ndecrypt(text2, 'key'::bytea, 'bf') from t2 limit 1000;\"\n\"host=192.168.220.129 dbname=taskdb user=postgres sslmode=disable\" &gt; 2.txt<\/code><\/pre>\n<p>\nThe stopwatch is running.<\/p>\n<p>\u00a0\u00a0id | decrypt | decrypt<br \/>\n----+--------+-----<br \/>\n 1 | x31 | x31<br \/>\n 2 | x32 | x32<br \/>\n 3 | x33 | x33<br \/>\n\u2026<br \/>\n999 | x393939 | x393939<br \/>\n1000 | x31303030 | x31303030<br \/>\n(1000 rows)<\/p>\n<p>Time: 50.203 ms<\/p>\n<p><strong>Test Results<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>Without encryption<\/strong><br \/>\n<strong>Pgcrypto (decrypt)<\/strong><\/p>\n<p>Selection of 1000 rows<br \/>\n1.386 ms<br \/>\n50.203 ms<\/p>\n<p>CPU<br \/>\n15%<br \/>\n35%<\/p>\n<p>RAM<br \/>\n\u00a0<br \/>\n+5%<\/p>\n<p>\nEncryption significantly affects performance. It is evident that timing has increased since decryption operations of encrypted data (and decryption is usually wrapped in your logic) require considerable resources. Thus, the idea of encrypting all columns containing any data carries the risk of reducing performance.<\/p>\n<p>At the same time, encryption is not a silver bullet that solves all issues. The decrypted data and the decryption key are present on the server during the decryption and data transfer processes. Therefore, keys can be intercepted by those who have full access to the database server, such as a system administrator.<\/p>\n<p>When there is one key for an entire column for all users (even if not for everyone, but for a limited set of clients), it is not always good or correct. This is why end-to-end encryption has started to be implemented; databases began exploring client-side and server-side data encryption options, leading to the emergence of key-vault storage \u2014 separate products that provide key management on the database side.<\/p>\n<p><img decoding=\"async\" alt=\"Security and DBMS: what to keep in mind when selecting protection measures.\" src=\"\/wp-content\/uploads\/2020\/05\/cbaa7b9579a65963518ba3cec6114842.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/docs.mongodb.com\/manual\/core\/security-client-side-encryption\/\"><i>An example of such encryption in MongoDB<\/i><\/a><\/noindex><\/p>\n<h2>Security features in commercial and open-source databases<\/h2>\n<p><\/p>\n<p><strong>Features<\/strong><br \/>\n<strong>Type<\/strong><br \/>\n<strong>Password Policy<\/strong><br \/>\n<strong>Audit<\/strong><br \/>\n<strong>Protection of source code procedures and functions<\/strong><br \/>\n<strong>RLS<\/strong><br \/>\n<strong>Encryption<\/strong><\/p>\n<p><strong>Oracle<\/strong><br \/>\nCommercial<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><strong>MsSql<\/strong><br \/>\nCommercial<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\"><strong>Jatoba<\/strong><\/a><\/noindex><br \/>\nCommercial<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\nextensions<\/p>\n<p><strong>PostgreSQL<\/strong><br \/>\nFree<br \/>\nextensions<br \/>\nextensions<br \/>\n\u2014<br \/>\n+<br \/>\nextensions<\/p>\n<p><strong>MongoDb<\/strong><br \/>\nFree<br \/>\n\u2014<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<br \/>\nAvailable in MongoDB Enterprise only<\/p>\n<p>\nThe table is far from complete, but the situation is as follows: in commercial products, security issues have been addressed for a long time, while in open source, security typically relies on some extensions; many features are lacking, and sometimes it is necessary to write something additional. For example, password policies \u2014 there are many different extensions in PostgreSQL.<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/postgres\/postgres\/tree\/master\/contrib\/passwordcheck\">1<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ykrysko\/passwordcheck\">2<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michaelpq\/pg_plugins\/tree\/master\/passwordcheck_extra\">3<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/devrimgunduz\/passwordcheck_cracklib\">4<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/asio\/password\">5<\/a><\/noindex>), which implement password policies, but in my opinion, none meets all the needs of the domestic corporate segment.<\/p>\n<p><strong>What to do if you can't find what you need anywhere?<\/strong>? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u0421\u0423\u0411\u0414, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a.<\/p>\n<p>Then you can use third-party solutions that work with different DBMS, such as 'Crypto DB' or 'Garda DB'. When it comes to solutions from the domestic segment, they are more familiar with GOSTs than in open source.<\/p>\n<p>The second option is to write what you need by yourself, implementing data access and encryption at the procedure level in the application. However, it will be more challenging with GOST. Overall, you can hide data as needed, store it in the DBMS, and then retrieve and decrypt it appropriately, right at the application level. At the same time, think about how you will protect these algorithms at the application level. In our view, this should be done at the DBMS level for better performance.<\/p>\n<p>This presentation was first given at <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup<\/a><\/noindex> by Mail.ru Cloud Solutions. See<noindex><a rel=\"nofollow\" href=\"https:\/\/www.youtube.com\/redirect?q=https%3A%2F%2Fbit.ly%2F2U57FAd&amp;redir_token=XNWSBN1AKQA2sjhdReDAv6VnkOV8MTU4OTAxNjMwMEAxNTg4OTI5OTAw&amp;v=wigSv2_zWBU&amp;event=video_description\"> video <\/a><\/noindex>other presentations and subscribe for event announcements on Telegram <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/k8s_mail\">Around Kubernetes at Mail.ru Group<\/a><\/noindex>.<\/p>\n<p><strong>What else to read on the topic<\/strong>:<\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/472694\/\">More than Ceph: cloud block storage MCS<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/kakuyu-bazu-dannyh-vybrat-dlya-proekta-chtoby-ne-oshibitsya\">How to choose a database for a project so that you don't have to choose again.<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/500708\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441 \u0420\u043e\u0436\u043a\u043e\u0432, \u044f \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041f\u041e \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u00ab\u0413\u0430\u0437\u0438\u043d\u0444\u043e\u0440\u043c\u0441\u0435\u0440\u0432\u0438\u0441\u00bb, \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 Jatoba. \u0417\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043d\u043e\u0440\u043c\u044b \u043d\u0430\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445. \u041d\u0438\u043a\u0442\u043e \u043d\u0435 \u0445\u043e\u0447\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u0442\u0440\u0435\u0442\u044c\u0438 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432\u0430\u0436\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b: \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430\u043c\u0438 \u043a \u0434\u0430\u043d\u043d\u044b\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":81885,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-81884","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Security and DBMS: what to keep in mind when selecting protection tools | ProHoster","description":"My name is Denis.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster","og:description":"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-17T11:42:18+00:00","article:modified_time":"2020-05-17T11:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"81884","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:48:24","updated":"2022-10-05 02:01:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/81884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=81884"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/81884\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/81885"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=81884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=81884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=81884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}