MySQL Security: Best Practices

Manizha Davis
Oracle Enterprise Architect
[email protected]

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. |

Safe Harbor Statement
The following is intended to outline our general product direction. It is intended for
information purposes only, and may not be incorporated into any contract. It is not a
commitment to deliver any material, code, or functionality, and should not be relied
upon in making purchasing decisions.

The development, release, and timing of any features or functionality described for
Oracle’s products remains at the sole discretion of Oracle.

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 2

89%
of Organizations Experienced Data
Breaches, According to New Ponemon
Report
Source: Sixth Annual Benchmark Study on Privacy & Security of Healthcare Data,
conducted by Ponemon Institute

66% of the largest businesses in the UK have

suffered a cyberattack or data breach within
the past twelve months
Source: UK government's Cyber Security Breaches Survey 2016

25% experience a repeated breach at least one a

month
Source: UK government's Cyber Security Breaches Survey 2016

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | Oracle Confidential – Internal/Restricted/Highly Restricted 3
Goals are simple
• Protect Data
– From those who shouldn’t see it
– Don’t lose the data
• Maintain Data Availability

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 4

As a DBA / Developer / … we need to
• Ensure only users who should get in, can get in
• Limit what users and user applications can do
• Limit from where users and applications can access data
• Watching What is happening, and when it happened
• Make sure we can back things up (don’t lose data)
• Make sure we keep history of what happened
• Minimize attack surface

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 5

Database Vulnerabilities
• Poor Configurations • Lack of Encryption
– Set controls and change default setting – Data, Backup, & Network Encryption
• Over Privileged Accounts • Proper Credential & Key Management
– Privilege Policies – Use mysql_config_editor , Key Vaults
• Weak Access Control • Unsecured Backups
– Dedicated Administrative Accounts – Encrypted Backups
• Weak Authentication • No Monitoring
– Strong Password Enforcement – Security Monitoring, Users, Objects
• Weak Auditing • Poorly Coded Applications
– Compliance & Audit Policies – Database Firewall
Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 6
Attack Vectors and Targets
for Databases

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. |

Database Malicious Actions
• Information Disclosure: Obtain credit card and other personal information
– Defense: Encryption – Data and Network, Tighter Access Controls
• Denial of Service: Run resource intensive queries
– Defense: Resource Usage Limits – Set various limits – Max Connections, Sessions, Timeouts, …
• Elevation of Privilege: Retrieve and use administrator credentials
– Defense: Stronger authentication, Access Controls, Auditing
• Spoofing: Retrieve and use other credentials
– Defense: Stronger account and password policies
• Tampering: Change data in the database, Delete transaction records
• Defense: Tighter Access Controls, Auditing, Monitoring, Backups

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 8

Use most limited Grants
• For users and privileges be specific
• Its more work – but far better security
• Don’t go crazy with wildcards esp for the priv level
• Avoid GRANT priv_type ON *.*
• Use otions like - SSL on GRANTS, MAX_<op>_PER_HOUR, if data is esp.
sensitive.
• http://dev.mysql.com/doc/refman/5.6/en/grant.html

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 9

MySQL Password Policies
• Accounts without Passwords
– Assign passwords to all accounts to prevent unauthorized use
• Password Validation Plugin
– Enforce Strong Passwords
• Password Expiration/Rotation
– Require users to reset their password
• Account lockout (in v. 5.7)
• Password Retry Rules (in v. 5.7.16+)

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 10

Forced Password Expiration
• As in admin if you need to force a user to reset their password, but not set
one for them (or set a temp password)
• And Enterprise you may want to force this (and verify via Auditing)
• https://dev.mysql.com/doc/refman/5.6/en/password-expiration-sandbox-
mode.html
• Note: end user will need to use a client application that supports the
password reset.

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 11

MySQL Security Overview
MySQL Privilege Management
Linux / LDAP Administration
Windows AD Authentication Authorization Database & Objects
Custom Proxy Users

Security
SSL/TLS Block Threats
Firewall &
Public/Private Key Encryption Auditing
Auditing
Transparent Encryption Regulatory Compliance
Key Management Login and Query Activities

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | Oracle Confidential – Internal 12
Regulatory Compliance
• Regulations
– PCI – DSS: Payment Card Data
– HIPAA: Privacy of Health Data
– Sarbanes Oxley, GLBA, The USA Patriot Act:
Financial Data, NPI "personally identifiable financial information"
– FERPA – Student Data
– EU General Data Protection Directive: Protection of Personal Data (GDPR)
– Data Protection Act (UK): Protection of Personal Data
• Requirements
– Continuous Monitoring (Users, Schema, Backups, etc)
– Data Protection (Encryption, Privilege Management, etc.)
– Data Retention (Backups, User Activity, etc.)
– Data Auditing (User activity, etc.)

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 13

MySQL Authorization
• Administrative Privileges
• Database Privileges
• Session Limits and Object Privileges
• Fine grained controls over user privileges

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 14

MySQL Authentication
• Built in Authentication
– user table stores users and encrypted passwords
• External Authentication with MySQL Enterprise Authentication
– Microsoft Active Directory
– Linux PAMs (Pluggable Authentication Modules)
• Support LDAP and more

• X.509
– Server authenticates client via certificates
• MySQL Native, SHA 256 Password plugin
– Native uses SHA1 or plugin with SHA-256 hashing and per user salting for user account passwords.

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 15

MySQL Enterprise Audit
• Out-of-the-box logging of connections, logins, and query
• Simple to fine grained policies for filtering, and log rotation
• Dynamically enabled, disabled: no server restart
• XML-based audit stream
– Send data to a remote server / audit data vault
• Oracle Audit Vault
• Splunk, etc.

Adds regulatory compliance to

MySQL applications
(HIPAA, Sarbanes-Oxley, PCI, etc.)

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 16

Logging For Audit
• Proper logging is always a requirement for security.
– FIPS, HIPAA, PCI-DSS, SOX, DISA STIG, …
• MySQL built-in logging infrastructure:
– general log, error log, NDB logs.
• MySQL Audit plugin:
– Granularity made for auditing.
– Can be modified live.
– Contains additional details.
– Compatible with Oracle Audit Vault

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. |

MySQL Enterprise Audit - Work Flow

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 18

MySQL Enterprise Encryption
• MySQL encryption functions
– Symmetric encryption AES256 (All Editions)
– Public-key / asymmetric cryptography – RSA
• Key management functions
– Generate public and private keys
– Key exchange methods: DH
• Sign and verify data functions
– Cryptographic hashing for digital signing, verification, & validation – RSA,DSA

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 19

MySQL Enterprise Encryption
Encryption/Decryption within MySQL

Encryption Encrypted Decryption Sensitive Data

Sensitive Data
Public Key Data Private Key

Private / Public Key Pairs

- Generate using MySQL Enterprise Encryption Functions
- Use externally generated (e.g. OpenSSL)

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. |

MySQL Enterprise Transparent Data Encryption
• Improves Security
– Added Layer– enforces access controls
– Simple to use and manage
• Meets Security and Regulatory Requirements
– Fit for cases where encryption is required
• Healthcare, FiServ, Government, etc.

• Secures and Manages Keys

– Supports Standard KMIP 1.2 protocols
– Supports Oracle Key Vault and other Key Stores

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. |

Database Firewall
• SQL Injection Attacks
– #1 Web Application Vulnerability
– 77% of Web Sites had vulnerabilities
• MySQL Enterprise Firewall
– Monitor database statements in real-time
– Automatic White List “rules” generation for any application
– Block SQL Injection Attacks
– Intrusion Detection System

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 22

MySQL Enterprise Firewall
• Block SQL Injection Attacks
– Allow: SQL Statements that match Whitelist
– Block: SQL statements that are not on Whitelist
• Intrusion Detection System
– Detect: SQL statements that are not on Whitelist
• SQL Statements execute and alert administrators

Select * from employee where id=22 ✔ Allow

Select * from employee where id=22 or 1=1

✖ Block
Applications
Detect & Alert
Intrusion Detection
White List Rule

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 23

MySQL Enterprise Monitor
• Enforce MySQL Security Best Practices
• Monitoring & Alerting
• Configuration Management
• Centralized User Management

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 24

Oracle Enterprise Manager for MySQL
• Availability monitoring
• Performance monitoring
• Configuration monitoring
• All available metrics collected
– Allowing for custom threshold
based incident reports
• MySQL auto-detection
Performance
Security
Availability

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 25

MySQL Enterprise Backup
• Online Backup for InnoDB (scriptable interface)
• Full, Incremental, Partial Backups (with compression)
• Strong Encryption (AES 256)
• Point in Time, Full, Partial Recovery options
• Metadata on status, progress, history
• Scales – High Performance/Unlimited Database Size
• Windows, Linux, Unix
• Certified with Oracle Secure Backup, NetBackup, Tivoli, others

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 26

Index
• MySQL Enterprise Security
• MySQL Enterprise Authentication
• MySQL Enterprise Firewall
• MySQL Enterprise Transparent Data Encryption
• MySQL Enterprise Audit

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | 27

Thank You

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. |