{"id":81884,"date":"2020-05-17T13:42:18","date_gmt":"2020-05-17T11:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity"},"modified":"2020-05-17T13:42:18","modified_gmt":"2020-05-17T11:42:18","slug":"bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","title":{"rendered":"Varnost in DBMS: na kaj je treba pomisliti pri izbiri za\u0161\u010ditnih sredstev","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<h1><img decoding=\"async\" alt=\"Varnost in DBMS: na kaj je treba pomisliti pri izbiri za\u0161\u010ditnih sredstev\" src=\"\/wp-content\/uploads\/2020\/05\/ac49253838e36336af127d71394139d8.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/h1>\n<p>\nMoje ime je Denis Ro\u017ekov, vodim razvoj programske opreme v podjetju \u201eGazinformservice\u201c, v ekipi izdelka <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\">Jatoba<\/a><\/noindex>. Zakonodaja in korporativna pravila nalagajo dolo\u010dene zahteve glede varnosti shranjevanja podatkov. Nih\u010de no\u010de, da bi tretje osebe pridobile dostop do zaupnih informacij, zato so za vsak projekt pomembna naslednja vpra\u0161anja: identifikacija in avtentikacija, upravljanje dostopov do podatkov, zagotavljanje celovitosti informacij v sistemu, bele\u017eenje varnostnih dogodkov. Zato \u017eelim spregovoriti o nekaterih zanimivih vidikih, povezanih z varnostjo DBMS. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n\u010clanek je pripravljen na podlagi nastopa na <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup,<\/a><\/noindex> ki ga je organiziral <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/\">Mail.ru Cloud Solutions<\/a><\/noindex>. \u010ce ne \u017eelite brati, si lahko ogledate:<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"n-54j9FHaMU\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/n-54j9FHaMU\/hqdefault.jpg\" alt=\"Predvajaj video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\nV \u010dlanku bodo tri dele:<\/p>\n<ul>\n<li>Kako za\u0161\u010dititi povezave.<\/li>\n<li>Kaj je revizija dejanj in kako zabele\u017eiti, kaj se dogaja z vidika baze podatkov in njenega povezovanja.<\/li>\n<li>Kako za\u0161\u010dititi podatke v sami bazi podatkov in katere tehnologije so za to na voljo.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Varnost in DBMS: na kaj je treba pomisliti pri izbiri za\u0161\u010ditnih sredstev\" src=\"\/wp-content\/uploads\/2020\/05\/fbdca7f4a925b9ceb78de06c6e245b23.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tri sestavine varnosti DBMS: za\u0161\u010dita povezav, revizija dejanj in za\u0161\u010dita podatkov<\/i><\/p>\n<h2>Za\u0161\u010dita povezav<\/h2>\n<p>\nDo baze podatkov se lahko pove\u017eete neposredno ali posredno preko spletnih aplikacij. Na splo\u0161no uporabnik iz poslovnega sektorja, torej oseba, ki dela z DBMS, ne komunicira z njo neposredno.<\/p>\n<p>Preden govorimo o za\u0161\u010diti povezav, je treba odgovoriti na pomembna vpra\u0161anja, od katerih je odvisno, kako bodo oblikovane varnostne dejavnosti:<\/p>\n<ul>\n<li>ali je eden poslovni uporabnik enak enemu uporabniku DBMS;<\/li>\n<li>ali je dostop do podatkov DBMS omogo\u010den le preko API-ja, ki ga nadzorujete, ali je dostop neposredno do tabel;<\/li>\n<li>ali je DBMS dodeljen v lo\u010den za\u0161\u010diten segment, kdo in kako z njim sodeluje;<\/li>\n<li>ali se uporabljajo pooling\/proxy in vmesni sloji, ki lahko spreminjajo informacije o tem, kako je povezava oblikovana in kdo uporablja bazo podatkov.<\/li>\n<\/ul>\n<p>\nZdaj pa poglejmo, katere instrumente lahko uporabimo za za\u0161\u010dito povezav:<\/p>\n<ol>\n<li>Uporabite re\u0161itve razreda po\u017earne stene za baze podatkov. Dodatna plast za\u0161\u010dite bo vsaj pove\u010dala preglednost tega, kar se dogaja v DBMS, v najbolj\u0161em primeru pa boste lahko zagotovili dodatno za\u0161\u010dito podatkov.<\/li>\n<li>Uporabite politike gesel. Njihova uporaba je odvisna od va\u0161e arhitekture. Kljub temu je en sam gesel v konfiguracijski datoteki spletne aplikacije, ki se povezuje s podatkovno bazo, premalo za za\u0161\u010dito. Na voljo je vrsta orodij za podatkovne baze, ki omogo\u010dajo nadzor, ali uporabnik in geslo zahtevata posodobitev.\n<p>Ve\u010d o funkcijah ocenjevanja uporabnikov lahko preberete <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.cloud.oracle.com\/en-us\/iaas\/data-safe\/doc\/user-assessment-reports.html\">ovde<\/a><\/noindex>, prav tako lahko izveste o MS SQL Vulnerability Assessment <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.microsoft.com\/en-us\/sql\/relational-databases\/security\/sql-vulnerability-assessment?view=sql-server-ver15\">tukaj<\/a><\/noindex>.\u00a0<\/li>\n<li>Obogatite kontekst seje z ustreznimi informacijami. \u010ce je seja neprozorna, ne razumete, kdo deluje v njeni okviru v podatkovni bazi, lahko dodatno obogatitete informacije o tem, kdo, kaj in zakaj po\u010dne. Te informacije lahko vidite v reviziji.<\/li>\n<li>Nastavite SSL, \u010de nimate omre\u017ene lo\u010ditve podatkovne baze od kon\u010dnih uporabnikov, ki ni v lo\u010denem VLAN-u. V takih primerih je nujno za\u0161\u010dititi kanal med potro\u0161nikom in samo podatkovno bazo. Orodja za za\u0161\u010dito so na voljo tudi med odprtokodnimi re\u0161itvami.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Kako bo to vplivalo na zmogljivost podatkovne baze?<\/h3>\n<p>\nPoglejmo na primeru PostgreSQL, kako SSL vpliva na obremenitev CPU, pove\u010danje \u010dasov in zmanj\u0161anje TPS, ali ne bo preveliko breme, \u010de ga omogo\u010dimo.<\/p>\n<p>Obremenjujemo PostgreSQL z uporabo pgbench \u2014 to je preprost program za izvajanje testov zmogljivosti. Ve\u010dkrat izvaja eno zaporedje ukazov, morda v vzporednih sejah podatkovne baze, in nato izra\u010duna povpre\u010dno hitrost transakcij.<\/p>\n<p><strong>Test 1 brez SSL in z uporabo SSL<\/strong> \u2014 povezava se vzpostavi pri vsaki transakciji:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require\nsslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Test 2 brez SSL in z uporabo SSL<\/strong> \u2014 vse transakcije se izvajajo v eni povezavi:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require\nsslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Ostale nastavitve<\/strong>:<\/p>\n<pre><code class=\"plaintext\">dejstvo skaliranja: 1\nna\u010din poizvedbe: preprost\n\u0161tevilo strank: 10\n\u0161tevilo niti: 1\n\u0161tevilo transakcij na stranko: 5000\n\u0161tevilo dejansko obdelanih transakcij: 50000\/50000<\/code><\/pre>\n<p>\n<strong>V\u00fdsledky testov\u00e1n\u00ed<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>Brez SSL<\/strong><br \/>\n<strong>SSL<\/strong><\/p>\n<p><strong>Povezava se vzpostavi pri vsaki transakciji<\/strong><\/p>\n<p>povpre\u010dna latenca<br \/>\n171.915 ms<br \/>\n187.695 ms<\/p>\n<p>tps vklju\u010dno z vzpostavljanjem povezav<br \/>\n58.168112<br \/>\n53.278062<\/p>\n<p>tps brez vzpostavljanja povezav<br \/>\n64.084546<br \/>\n58.725846<\/p>\n<p>CPU<br \/>\n24%<br \/>\n28%<\/p>\n<p><strong>Vse transakcije se izvajajo v eni povezavi<\/strong><\/p>\n<p>povpre\u010dna latenca<br \/>\n6.722 ms<br \/>\n6.342 ms<\/p>\n<p>tps vklju\u010dno z vzpostavljanjem povezav<br \/>\n1587.657278<br \/>\n1576.792883<\/p>\n<p>tps brez vzpostavljanja povezav<br \/>\n1588.380574<br \/>\n1577.694766<\/p>\n<p>CPU<br \/>\n17%<br \/>\n21%<\/p>\n<p>\nPri manj\u0161ih obremenitvah je vpliv SSL primerljiv s napako merjenja. \u010ce je koli\u010dina prenesenih podatkov zelo velika, je situacija lahko druga\u010dna. \u010ce vzpostavimo eno povezavo za vsako transakcijo (to se redko dogaja, obi\u010dajno povezavo delijo razli\u010dni uporabniki), imate veliko \u0161tevilo povezav\/odklopov, vpliv je lahko nekoliko ve\u010dji. To pomeni, da so tveganja za zmanj\u0161anje zmogljivosti prisotna, vendar razlika ni dovolj velika, da bi se za\u0161\u010dita ne uporabljala.<\/p>\n<p>Upo\u0161tevajte \u2014 mo\u010dna razlika se pojavi, \u010de primerjate na\u010dine delovanja: v okviru ene seje delate ali v razli\u010dnih. To je razumljivo: za vzpostavitev vsake povezave se porabljajo viri.<\/p>\n<p>Imeli smo primer, ko smo povezovali Zabbix v na\u010dinu zaupanja, torej nismo preverjali md5, pri avtentikaciji ni bilo potrebe. Pozneje je naro\u010dnik zaprosil za vklju\u010ditev md5 avtentikacije. To je povzro\u010dilo veliko obremenitev za CPU, zmogljivost se je poslab\u0161ala. I\u0161\u010demo na\u010dine optimizacije. Ena od mo\u017enih re\u0161itev problema je izvedba omre\u017enega omejevanja, da se za DBMS naredijo lo\u010deni VLAN-i, dodati nastavitve, da bo jasno, kdo in od kod se povezuje, ter odstraniti avtentikacijo. Prav tako je mogo\u010de optimizirati nastavitve avtentikacije, da se zmanj\u0161ajo stro\u0161ki pri vklju\u010ditvi avtentikacije, vendar na splo\u0161no razli\u010dne metode avtentikacije vplivajo na zmogljivost in je treba te dejavnike upo\u0161tevati pri na\u010drtovanju ra\u010dunalni\u0161ke mo\u010di stre\u017enikov (strojne opreme) za DBMS.<\/p>\n<p>Zaklju\u010dek: v nekaterih re\u0161itvah lahko tudi majhne podrobnosti glede avtentikacije mo\u010dno vplivajo na projekt in slabo, ko to postane jasno \u0161ele ob uvedbi v produkcijo.<\/p>\n<h2>Revizija dejanj<\/h2>\n<p>\nRevizija ni samo za DBMS. Revizija je pridobivanje informacij o tem, kar se dogaja na razli\u010dnih segmentih. To je lahko tudi po\u017earni zid za bazo podatkov, pa tudi operacijski sistem, na katerem je zgrajen DBMS.<\/p>\n<p>Pri komercialnih DBMS ravni Enterprise je s revizijo vse v redu, pri odprtokodnih pa ne vedno. Tukaj je, kar je na voljo v PostgreSQL:<\/p>\n<ul>\n<li>privzeta dnevni\u0161ka datoteka \u2014 vgrajeno bele\u017eenje;<\/li>\n<li>raz\u0161iritve: pgaudit \u2014 \u010de vam privzeta bele\u017eenja ne zadostuje, lahko uporabite lo\u010dene nastavitve, ki re\u0161ujejo del nalog.<\/li>\n<\/ul>\n<p>\n<b>Dopolnilo k poro\u010dilu v videu:<\/b><\/p>\n<p>Osnovna registracija operatera mo\u017ee biti osigurana standardnim sredstvom vo\u0111enja bele\u0161ki sa log_statement = all.<\/p>\n<p>To je prihvatljivo za nadzor i druge vrste upotrebe, ali ne obezbe\u0111uje nivo detaljnosti koji je obi\u010dno potreban za reviziju.<\/p>\n<p>Nije dovoljno imati listu svih operacija koje se izvode nad bazom podataka.<\/p>\n<p>Tako\u0111e, mora postojati mogu\u0107nost pronala\u017eenja konkretnih izjava koje su od interesa za revizora.<\/p>\n<p>Standardni sistem vo\u0111enja bele\u0161ki pokazuje ono \u0161to je korisnik zatra\u017eio, dok se pgAudit fokusira na detalje onoga \u0161to se dogodilo kada je baza podataka izvr\u0161avala zahtev.<\/p>\n<p>Na primer, revizor mo\u017ee \u017eeleti da se uveri da je odre\u0111ena tabela kreirana u dokumentovanom prozoru odr\u017eavanja.<\/p>\n<p>To se mo\u017ee \u010diniti jednostavnim zadatkom za osnovnu reviziju i grep, ali \u0161ta ako imate ne\u0161to poput ovog (namerno zbunjuju\u0107eg) primera:<\/p>\n<p>DO $$<br \/>\nPO\u010cNI<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<\/p>\n<p>Standardno vo\u0111enje bele\u0161ki \u0107e vam dati ovo:<\/p>\n<p>LOG: statement: DO $$<br \/>\nPO\u010cNI<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<\/p>\n<p>\u010cini se da \u0107e za pronala\u017eenje zanimljive tabele mo\u017eda biti potrebno neko poznavanje koda u slu\u010dajevima kada se tabele dinami\u010dki kreiraju.<\/p>\n<p>To nije idealno, jer bi bilo po\u017eeljno jednostavno tra\u017eiti po imenu tabele.<\/p>\n<p>Eto gde \u0107e pgAudit biti koristan.<\/p>\n<p>Za isti unos on \u0107e dati ovaj ispravak u bele\u0161kama:<\/p>\n<p>AUDIT: SESSION,33,1,FUNCTION,DO,,,\u00abDO $$<br \/>\nPO\u010cNI<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;\"<br \/>\nAUDIT: SESSION,33,2,DDL,CREATE TABLE,TABLE,public.important_table,CREATE TABLE important_table (id INT)<\/p>\n<p>Ne registruje se samo blok DO, ve\u0107 i potpuni tekst CREATE TABLE sa tipom operacije, tipom objekta i punim imenom, \u0161to olak\u0161ava pretragu.<\/p>\n<p>Kada se bele\u017ee SELECT i DML operatori, pgAudit mo\u017ee biti konfigurisano da registruje pojedina\u010dni unos za svaku relaciju na koju se upu\u0107uje u operatoru.<\/p>\n<p>Nije potrebna sintakti\u010dka analiza da bi se prona\u0161li svi operatori koji se odnose na odre\u0111enu tabelu (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/pgaudit\/pgaudit\/blob\/master\/README.md\">*<\/a><\/noindex>)\u00bb.<\/p>\n<h3>Kako bo to vplivalo na zmogljivost podatkovne baze?<\/h3>\n<p>\nHajde da testiramo uklju\u010divanje potpunog audita i vidimo kako \u0107e to uticati na performanse PostgreSQL-a. Uklju\u010di\u0107emo maksimalno logovanje baze podataka sa svim parametrima.<\/p>\n<p>U konfiguracionom fajlu gotovo ni\u0161ta ne menjamo, od va\u017enog \u2014 aktivira\u0107emo debug5 re\u017eim da bismo dobili maksimalne informacije.<\/p>\n<p>postgresql.conf<\/p>\n<p>log_destination = 'stderr'<br \/>\nlogging_collector = on<br \/>\nlog_truncate_on_rotation = on<br \/>\nlog_rotation_age = 1d<br \/>\nlog_rotation_size = 10MB<br \/>\nlog_min_messages = <strong>debug5<\/strong><br \/>\nlog_min_error_statement = <strong>debug5<\/strong><br \/>\nlog_min_duration_statement = 0<br \/>\ndebug_print_parse = on<br \/>\ndebug_print_rewritten = on<br \/>\ndebug_print_plan = on<br \/>\ndebug_pretty_print = on<br \/>\nlog_checkpoints = on<br \/>\nlog_connections = on<br \/>\nlog_disconnections = on<br \/>\nlog_duration = on<br \/>\nlog_hostname = on<br \/>\nlog_lock_waits = on<br \/>\nlog_replication_commands = on<br \/>\nlog_temp_files = 0<br \/>\nlog_timezone = 'Europe\/Moscow'<\/p>\n<p>\n\u041d\u0430 \u0421\u0423\u0411\u0414 PostgreSQL \u0441 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438 1 CPU, 2,8 \u0413\u0413\u0446, 2 \u0413\u0431 \u041e\u0417\u0423, 40 \u0413\u0431 HDD \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c \u0442\u0440\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u0447\u043d\u044b\u0445 \u0442\u0435\u0441\u0442\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b:<\/p>\n<pre><code class=\"plaintext\">$ pgbench -p 3389 -U postgres -i -s 150 benchmark\n$ pgbench -p 3389 -U postgres -c 50 -j 2 -P 60 -T 600 benchmark\n$ pgbench -p 3389 -U postgres -c 150 -j 2 -P 60 -T 600 benchmark<\/code><\/pre>\n<p>\n<strong>Rezultati testiranja:<\/strong><\/p>\n<p><strong>\u0411\u0435\u0437 \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f<\/strong><br \/>\n<strong>\u0421 \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c<\/strong><\/p>\n<p>\u0418\u0442\u043e\u0433\u043e\u0432\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0411\u0414<br \/>\n43,74 \u0441\u0435\u043a<br \/>\n53,23 \u0441\u0435\u043a<\/p>\n<p>RAM<br \/>\n24%<br \/>\n40%<\/p>\n<p>CPU<br \/>\n72%<br \/>\n91%<\/p>\n<p><strong>\u0422\u0435\u0441\u0442 1 (50 \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432)<\/strong><\/p>\n<p>\u041a\u043e\u043b-\u0432\u043e \u0442\u0440\u0430\u043d\u0437\u0430\u043a\u0446\u0438\u0439 \u0437\u0430 10 \u043c\u0438\u043d<br \/>\n74169<br \/>\n32445<\/p>\n<p>\u0422\u0440\u0430\u043d\u0437\u0430\u043a\u0446\u0438\u0439\/\u0441\u0435\u043a<br \/>\n123<br \/>\n54<\/p>\n<p>\u0421\u0440\u0435\u0434\u043d\u044f\u044f \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0430<br \/>\n405 \u043c\u0441<br \/>\n925 \u043c\u0441<\/p>\n<p><strong>\u0422\u0435\u0441\u0442 2 (150 \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043f\u0440\u0438 100 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445)<\/strong><\/p>\n<p>\u041a\u043e\u043b-\u0432\u043e \u0442\u0440\u0430\u043d\u0437\u0430\u043a\u0446\u0438\u0439 \u0437\u0430 10 \u043c\u0438\u043d<br \/>\n81727<br \/>\n31429<\/p>\n<p>\u0422\u0440\u0430\u043d\u0437\u0430\u043a\u0446\u0438\u0439\/\u0441\u0435\u043a<br \/>\n136<br \/>\n52<\/p>\n<p>\u0421\u0440\u0435\u0434\u043d\u044f\u044f \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0430<br \/>\n550 \u043c\u0441<br \/>\n1432 \u043c\u0441<\/p>\n<p><strong>\u041f\u0440\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u044b<\/strong><\/p>\n<p>\u0420\u0430\u0437\u043c\u0435\u0440 \u0411\u0414<br \/>\n2251 \u041c\u0411<br \/>\n2262 \u041c\u0411<\/p>\n<p>\u0420\u0430\u0437\u043c\u0435\u0440 \u043b\u043e\u0433\u043e\u0432 \u0411\u0414<br \/>\n0 \u041c\u0431<br \/>\n4587 \u041c\u0431<\/p>\n<p>\n\u0412 \u0438\u0442\u043e\u0433\u0435: \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u0443\u0434\u0438\u0442 \u2014 \u044d\u0442\u043e \u043d\u0435 \u043e\u0447\u0435\u043d\u044c \u0445\u043e\u0440\u043e\u0448\u043e. \u0414\u0430\u043d\u043d\u044b\u0445 \u043e\u0442 \u0430\u0443\u0434\u0438\u0442\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u0441\u044f \u043f\u043e \u043e\u0431\u044a\u0435\u043c\u0443, \u043a\u0430\u043a \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0430\u043c\u043e\u0439 \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445, \u0430 \u0442\u043e \u0438 \u0431\u043e\u043b\u044c\u0448\u0435. \u0422\u0430\u043a\u043e\u0439 \u043e\u0431\u044a\u0435\u043c \u0436\u0443\u0440\u043d\u0430\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0421\u0423\u0411\u0414, \u2014 \u043e\u0431\u044b\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0438\u0432\u0435.<\/p>\n<p>\u0421\u043c\u043e\u0442\u0440\u0438\u043c \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b:<\/p>\n<ul>\n<li>\u0421\u043a\u043e\u0440\u043e\u0441\u0442\u044c \u0441\u0438\u043b\u044c\u043d\u043e \u043d\u0435 \u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f: \u0431\u0435\u0437 \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u2014 43,74 \u0441\u0435\u043a, \u0441 \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u2014 53,23 \u0441\u0435\u043a.<\/li>\n<li>\u041f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043f\u043e \u041e\u0417\u0423 \u0438 CPU \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u043e\u0441\u0435\u0434\u0430\u0442\u044c, \u0442\u0430\u043a \u043a\u0430\u043a \u043d\u0443\u0436\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b \u0441 \u0430\u0443\u0434\u0438\u0442\u043e\u043c. \u042d\u0442\u043e \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u043c\u0435\u0442\u043d\u043e \u043d\u0430 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0438\u0432\u0435.<\/li>\n<\/ul>\n<p>\n\u041f\u0440\u0438 \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0438 \u0447\u0438\u0441\u043b\u0430 \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432, \u0435\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0438 \u0431\u0443\u0434\u0443\u0442 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u0443\u0445\u0443\u0434\u0448\u0430\u0442\u044c\u0441\u044f.<\/p>\n<p>\u0412 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f\u0445 \u0441 \u0430\u0443\u0434\u0438\u0442\u043e\u043c \u0435\u0449\u0435 \u0441\u043b\u043e\u0436\u043d\u0435\u0435:<\/p>\n<ul>\n<li>\u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u043d\u043e\u0433\u043e;<\/li>\n<li>\u0430\u0443\u0434\u0438\u0442 \u043d\u0443\u0436\u0435\u043d \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 syslog \u0432 SIEM, \u043d\u043e \u0438 \u0432 \u0444\u0430\u0439\u043b\u044b: \u0432\u0434\u0440\u0443\u0433 \u0441 syslog \u0447\u0442\u043e-\u0442\u043e \u043f\u0440\u043e\u0438\u0437\u043e\u0439\u0434\u0435\u0442, \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0431\u043b\u0438\u0437\u043a\u043e \u043a \u0431\u0430\u0437\u0435 \u0444\u0430\u0439\u043b, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0434\u0430\u043d\u043d\u044b\u0435;<\/li>\n<li>\u0434\u043b\u044f \u0430\u0443\u0434\u0438\u0442\u0430 \u043d\u0443\u0436\u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u043b\u043a\u0430, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u043f\u0440\u043e\u0441\u0435\u0441\u0442\u044c \u043f\u043e I\/O \u0434\u0438\u0441\u043a\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043c\u043d\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430;<\/li>\n<li>\u0431\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0430\u043c \u0418\u0411 \u043d\u0443\u0436\u043d\u044b \u0432\u0435\u0437\u0434\u0435 \u0413\u041e\u0421\u0422\u044b, \u043e\u043d\u0438 \u0442\u0440\u0435\u0431\u0443\u044e\u0442 \u0433\u043e\u0441\u0442\u043e\u0432\u0443\u044e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.<\/li>\n<\/ul>\n<p><\/p>\n<h2>\u041e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0434\u0430\u043d\u043d\u044b\u043c<\/h2>\n<p>\n\u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043d\u0438\u043c \u0432 \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0445 \u0421\u0423\u0411\u0414 \u0438 open source.<\/p>\n<p>\u0427\u0442\u043e \u0432 \u0446\u0435\u043b\u043e\u043c \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c:<\/p>\n<ol>\n<li>\u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440 \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 (Wrapping) \u2014 \u0442\u043e \u0435\u0441\u0442\u044c \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0443\u0442\u0438\u043b\u0438\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0434\u0435\u043b\u0430\u044e\u0442 \u043d\u0435\u0447\u0438\u0442\u0430\u0435\u043c\u044b\u0439. \u041f\u0440\u0430\u0432\u0434\u0430, \u043f\u043e\u0442\u043e\u043c \u0435\u0433\u043e \u043d\u0435\u043b\u044c\u0437\u044f \u043d\u0438 \u043f\u043e\u043c\u0435\u043d\u044f\u0442\u044c, \u043d\u0438 \u0437\u0430\u0440\u0435\u0444\u0430\u043a\u0442\u043e\u0440\u0438\u0442\u044c \u043e\u0431\u0440\u0430\u0442\u043d\u043e. \u0422\u0430\u043a\u043e\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u0438\u043d\u043e\u0433\u0434\u0430 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0421\u0423\u0411\u0414 \u2014 \u043b\u043e\u0433\u0438\u043a\u0430 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u043e\u043d\u043d\u044b\u0445 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u0438\u043b\u0438 \u043b\u043e\u0433\u0438\u043a\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0448\u0438\u0444\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u043c\u0435\u043d\u043d\u043e \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u044b \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438.<\/li>\n<li>Omejitev vidnosti podatkov po vrsticah (RLS) pomeni, da razli\u010dni uporabniki vidijo isto tabelo, vendar razli\u010den nabor vrstic v njej, kar pomeni, da dolo\u010deni uporabniki ne smejo videti nekaterih podatkov na ravni vrstic.<\/li>\n<li>Urejanje prikazanih podatkov (Masking) pomeni, da uporabniki v isti stolpcu tabele vidijo bodisi podatke bodisi le zvezdice, kar pomeni, da bo za nekatere uporabnike informacija zaprta. Tehnologija dolo\u010da, katerim uporabnikom je kaj prikazano glede na raven dostopa.<\/li>\n<li>Razmejitev dostopa Security DBA\/Application DBA\/DBA se nana\u0161a predvsem na omejevanje dostopa do samega DBMS, kar pomeni, da se zaposleni za informacijsko varnost lahko lo\u010dijo od upravljavcev baz podatkov in aplikacij. V odprtokodnih re\u0161itvah je takih tehnologij malo, v komercialnih DBMS jih je dovolj. Te so potrebne, kadar je veliko uporabnikov z dostopom do stre\u017enikov.<\/li>\n<li>Omejevanje dostopa do datotek na ravni datote\u010dnega sistema. Lahko dodelite pravice in privilegije dostopa do map, tako da vsak upravitelj dobi dostop le do potrebnih podatkov.<\/li>\n<li>Mandatni dostop in \u010di\u0161\u010denje pomnilnika \u2013 te tehnologije se uporabljajo redko.<\/li>\n<li>End-to-end \u0161ifriranje neposredno DBMS pomeni \u0161ifriranje na strani odjemalca z upravljanjem klju\u010dev na stre\u017eni\u0161ki strani.<\/li>\n<li>\u0160ifriranje podatkov. Na primer, stolpi\u010dno \u0161ifriranje \u2013 ko uporabljate mehanizem, ki \u0161ifrira posamezni stolpec baze.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Kako to vpliva na zmogljivost DBMS?<\/h3>\n<p>\nPoglejmo na primeru stolpi\u010dnega \u0161ifriranja v PostgreSQL. Tam je modul pgcrypto, ki omogo\u010da shranjevanje izbranih polj v \u0161ifrirani obliki. To je koristno, kadar imajo vrednost le nekateri podatki. Da bi prebrali \u0161ifrirana polja, odjemalec po\u0161lje dekodirni klju\u010d, stre\u017enik raz\u0161ifrira podatke in jih izda odjemalcu. Brez klju\u010da va\u0161i podatki ne bodo uporabni.<\/p>\n<p><strong>Izvedimo test s pgcrypto<\/strong>. Ustvarili bomo tabelo s \u0161ifriranimi podatki in s obi\u010dajnimi podatki. Tukaj so ukazi za ustvarjanje tabel, v prvi vrstici je koristna ukaz \u2013 ustvarjanje samega raz\u0161iritve z registracijo DBMS:<\/p>\n<pre><code class=\"plaintext\">CREATE EXTENSION pgcrypto;\nCREATE TABLE t1 (id integer, text1 text, text2 text);\nCREATE TABLE t2 (id integer, text1 bytea, text2 bytea);\nINSERT INTO t1 (id, text1, text2)\nVALUES (generate_series(1,10000000), generate_series(1,10000000)::text, generate_series(1,10000000)::text);\nINSERT INTO t2 (id, text1, text2) VALUES (\ngenerate_series(1,10000000),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'));<\/code><\/pre>\n<p>\nNadal bomo posku\u0161ali pridobiti podatke iz vsake tabele in pogledali \u010das izvajanja.<\/p>\n<p><strong>Pridobitev iz tabele brez funkcije \u0161ifriranja<\/strong>:<\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select * from t1 limit 1000;\" \"host=192.168.220.129 dbname=taskdb\nuser=postgres sslmode=disable\" &gt; 1.txt<\/code><\/pre>\n<p>\n\u0160toper je vklopljen.<\/p>\n<p>\u00a0\u00a0id | text1 | text2<br \/>\n\u2014\u2014+\u2014\u2014-+\u2014\u2014-<br \/>\n 1 | 1 \u00a0 \u00a0 | 1<br \/>\n 2 | 2 \u00a0 \u00a0 | 2<br \/>\n 3 | 3 \u00a0 \u00a0 | 3<br \/>\n\u2026<br \/>\n997 | 997 \u00a0 | 997<br \/>\n998 | 998 \u00a0 | 998<br \/>\n999 | 999 \u00a0 | 999<br \/>\n1000 | 1000\u00a0 | 1000<br \/>\n(1000 vrstic)<\/p>\n<p>\u010cas: 1,386 ms<\/p>\n<p><strong>Pridobitev iz tabele s funkcijo \u0161ifriranja:<\/strong><\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select id, decrypt(text1, 'key'::bytea, 'bf'),\ndecrypt(text2, 'key'::bytea, 'bf') from t2 limit 1000;\"\n\"host=192.168.220.129 dbname=taskdb user=postgres sslmode=disable\" &gt; 2.txt<\/code><\/pre>\n<p>\n\u0160toper je vklopljen.<\/p>\n<p>\u00a0\u00a0id | decrypt | decrypt<br \/>\n\u2014\u2014+\u2014\u2014\u2014+\u2014\u2014\u2014<br \/>\n 1 | x31 | x31<br \/>\n 2 | x32 | x32<br \/>\n 3 | x33 | x33<br \/>\n\u2026<br \/>\n999 | x393939 | x393939<br \/>\n1000 | x31303030 | x31303030<br \/>\n(1000 vrstic)<\/p>\n<p>\u010cas: 50,203 ms<\/p>\n<p><strong>V\u00fdsledky testov\u00e1n\u00ed<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>Brez \u0161ifriranja<\/strong><br \/>\n<strong>Pgcrypto (decrypt)<\/strong><\/p>\n<p>Pridobitev 1000 vrstic<br \/>\n1,386 ms<br \/>\n50,203 ms<\/p>\n<p>CPU<br \/>\n15%<br \/>\n35%<\/p>\n<p>RAM<br \/>\n\u00a0<br \/>\n+5%<\/p>\n<p>\n\u0160ifriranje mo\u010dno vpliva na zmogljivost. Vidno je, da se je \u010das pove\u010dal, saj operacije de\u0161ifriranja \u0161ifriranih podatkov (in de\u0161ifriranje je obi\u010dajno \u0161e ovito v va\u0161o logiko) zahtevajo znatne vire. To pomeni, da ideja, da se \u0161ifrira vse stolpce, ki vsebujejo kakr\u0161ne koli podatke, prina\u0161a zmanj\u0161anje zmogljivosti.<\/p>\n<p>Vendar \u0161ifriranje ni srebrna krogla, ki re\u0161i vse te\u017eave. De\u0161ifrirani podatki in klju\u010d de\u0161ifriranja so med de\u0161ifriranjem in prenosom podatkov na stre\u017eniku. Zato lahko klju\u010de prestre\u017eejo tisti, ki imajo popoln dostop do stre\u017enika podatkov, na primer sistemski administrator.<\/p>\n<p>Ko je na celotnem stolpcu za vse uporabnike en klju\u010d (tudi \u010de ne za vse, ampak za stranke omejenega nabora), to ni vedno dobro in pravilno. Zato so uvedli \u0161ifriranje od konca do konca, v SDB so za\u010deli razmi\u0161ljati o mo\u017enostih \u0161ifriranja podatkov s strani odjemalca in stre\u017enika, pojavili so se tisti key-vault sistemi \u2014 lo\u010deni izdelki, ki zagotavljajo upravljanje s klju\u010di na strani SDB.<\/p>\n<p><img decoding=\"async\" alt=\"Varnost in DBMS: na kaj je treba pomisliti pri izbiri za\u0161\u010ditnih sredstev\" src=\"\/wp-content\/uploads\/2020\/05\/cbaa7b9579a65963518ba3cec6114842.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/docs.mongodb.com\/manual\/core\/security-client-side-encryption\/\"><i>Primer tak\u0161nega \u0161ifriranja v MongoDB<\/i><\/a><\/noindex><\/p>\n<h2>Varnostna sredstva v komercialnih in odprtokodnih SDB<\/h2>\n<p><\/p>\n<p><strong>Functions<\/strong><br \/>\n<strong>Tip<\/strong><br \/>\n<strong>Politika gesel<\/strong><br \/>\n<strong>Revizija<\/strong><br \/>\n<strong>Za\u0161\u010dita izvorne kode postopkov in funkcij<\/strong><br \/>\n<strong>RLS<\/strong><br \/>\n<strong>\u0160ifriranje<\/strong><\/p>\n<p><strong>Oracle<\/strong><br \/>\nKomercialno<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><strong>MsSql<\/strong><br \/>\nKomercialno<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\"><strong>Jatoba<\/strong><\/a><\/noindex><br \/>\nKomercialno<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\nraz\u0161iritve<\/p>\n<p><strong>PostgreSQL<\/strong><br \/>\nBrezpla\u010dno<br \/>\nraz\u0161iritve<br \/>\nraz\u0161iritve<br \/>\n\u2014<br \/>\n+<br \/>\nraz\u0161iritve<\/p>\n<p><strong>MongoDb<\/strong><br \/>\nBrezpla\u010dno<br \/>\n\u2014<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<br \/>\nNa voljo samo v MongoDB Enterprise<\/p>\n<p>\nTabela ni popolna, toda situacija je taka: v komercialnih izdelkih se varnostni problemi re\u0161ujejo \u017ee dolgo, v odprtokodnih pa obi\u010dajno za varnost uporabljajo razli\u010dne nadgradnje, mnogim funkcijam primanjkuje, v\u010dasih je potrebno kaj dodati. Na primer, politike gesel \u2014 v PostgreSQL je kar precej razli\u010dnih raz\u0161iritev.<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/postgres\/postgres\/tree\/master\/contrib\/passwordcheck\">1<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ykrysko\/passwordcheck\">2<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michaelpq\/pg_plugins\/tree\/master\/passwordcheck_extra\">3<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/devrimgunduz\/passwordcheck_cracklib\">4<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/asio\/password\">5<\/a><\/noindex>), ki izvajajo politike gesel, ampak po mojem mnenju nobena ne pokriva vseh potreb doma\u010dega korporativnega segmenta.<\/p>\n<p><strong>Kaj storiti, \u010de nikjer ni tistega, kar potrebujete<\/strong>? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u0421\u0423\u0411\u0414, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a.<\/p>\n<p>Potem lahko uporabite zunanje re\u0161itve, ki delujejo z razli\u010dnimi DBMS, na primer \u201eCrypto DB\u201c ali \u201eGarda DB\u201c. \u010ce govorimo o re\u0161itvah iz doma\u010dega segmenta, tam bolje poznajo GOST-e kot v open source.<\/p>\n<p>Druga mo\u017enost je, da sami napi\u0161ete, kar potrebujete, izvedete dostop do podatkov in \u0161ifriranje na ravni postopkov v aplikaciji. Res je, da bo s GOST-om te\u017eje. Ampak na splo\u0161no \u2014 lahko skrijete podatke, kot \u017eelite, shranite v DBMS in jih nato pridobite ter de\u0161ifrirate, kako je treba, neposredno na ravni aplikacije. Pri tem takoj razmislite, kako boste ti algoritmi za\u0161\u010ditili na ravni aplikacije. Po na\u0161em mnenju je to treba narediti na ravni DBMS, saj bo tako delovalo hitreje.<\/p>\n<p>Ta predstavitev je prvi\u010d zazvenela na <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup<\/a><\/noindex> by Mail.ru Cloud Solutions. Oglejte si<noindex><a rel=\"nofollow\" href=\"https:\/\/www.youtube.com\/redirect?q=https%3A%2F%2Fbit.ly%2F2U57FAd&amp;redir_token=XNWSBN1AKQA2sjhdReDAv6VnkOV8MTU4OTAxNjMwMEAxNTg4OTI5OTAw&amp;v=wigSv2_zWBU&amp;event=video_description\"> video <\/a><\/noindex>druge nastope in se prijavite na novice o dogodkih na Telegramu <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/k8s_mail\">Okoli Kubernetes v Mail.ru Group<\/a><\/noindex>.<\/p>\n<p><strong>Kaj \u0161e prebrati o temi<\/strong>:<\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/472694\/\">Ve\u010d kot Ceph: blokovno skladi\u0161\u010de obla\u010dnega MCS<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/kakuyu-bazu-dannyh-vybrat-dlya-proekta-chtoby-ne-oshibitsya\">Kako izbrati bazo podatkov za projekt, da je ne bi morali ponovno izbrati<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/500708\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441 \u0420\u043e\u0436\u043a\u043e\u0432, \u044f \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041f\u041e \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u00ab\u0413\u0430\u0437\u0438\u043d\u0444\u043e\u0440\u043c\u0441\u0435\u0440\u0432\u0438\u0441\u00bb, \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 Jatoba. \u0417\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043d\u043e\u0440\u043c\u044b \u043d\u0430\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445. \u041d\u0438\u043a\u0442\u043e \u043d\u0435 \u0445\u043e\u0447\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u0442\u0440\u0435\u0442\u044c\u0438 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432\u0430\u0436\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b: \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430\u043c\u0438 \u043a \u0434\u0430\u043d\u043d\u044b\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":81885,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-81884","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Varnost in DBMS: na kaj je treba pomisliti, ko izbirate za\u0161\u010ditna sredstva | ProHoster","description":"Moje ime je Denis.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster","og:description":"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-17T11:42:18+00:00","article:modified_time":"2020-05-17T11:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"81884","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:48:24","updated":"2022-10-05 02:01:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/81884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=81884"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/81884\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/81885"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=81884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=81884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=81884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}