MySQL + GDPR

Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
MySQL Security and GDPR

Mark Swarbrick MySQL Principal Sales Consultant
Mark.swarbrick@oracle.com

Safe Harbor Statement
The following is intended to outline our general product direction. It is intended for
information purposes only, and may not be incorporated into any contract. It is not a
commitment to deliver any material, code, or functionality, and should not be relied upon
in making purchasing decisions. The development, release, and timing of any features or
functionality described for Oracle’s products remains at the sole discretion of Oracle.
2

Introduction
•  The E.U. General Data Protection Regulation (GDPR) comes into effect in
May 2018
•  GDPR is a European Union “EU”-wide framework
– Protection of personal data of EU-based individuals
– Restrictions to movement of that data
•  Published May 2016, Enforceable by May 2018
•  Fines for GDPR violations are
– The greater of 20,000,000 Euros or 4% of annual revenue (R150, A83)
Confidential – Oracle Internal 4

GDPR: Who and What
•  Who does the GDPR affect?
– The GDPR not only applies to organisations located within the EU but it will also apply
to organisations located outside of the EU if they offer goods or services to, or
monitor the behaviour of, EU data subjects. It applies to all companies processing and
holding the personal data of data subjects residing in the European Union, regardless
of the company’s location.
•  What constitutes personal data?
– Any information related to a natural person or ‘Data Subject’, that can be used to
directly or indirectly identify the person. It can be anything from a name, a photo, an
email address, bank details, posts on social networking websites, medical
information, or a computer IP address.
5
http://www.eugdpr.org/gdpr-faqs.html

Appropriate Security Controls
•  Data must be processed with controls that provide
“appropriate security and confidentiality “
– Recitals of note - R74-78, R81, R83, R87, R90, A5, A24-25, A28, A32, A35)
•  Exact security controls are not specified in the GDPR
– WHAT to do
– Not HOW to do it

EU General Data Protection Regulation (GDPR)
•  Data privacy as a fundamental right
•  Defines Data protection responsibilities, baselines, principles
•  Provides Enforcement Powers
Focus is on 3 Areas
•  Assessment – Processes, Profiles, Data Sensitivity, Ricks
•  Prevention – Encryption, Anonymization, Access Controls, Separation of Duties
•  Detection – Auditing, Activity monitoring, Alerting, Reporting
7

Complexity grows
Risk Grows
8

GDPR and MySQL
•  We can’t be entirely prescriptive
•  We have many things that can be applied towards attaining compliance
– Products
– Features
– Best Practices
– Documents
– Integrations
9

10
Enterprise
Security Architecture ¡ Workbench
• Model
• Data
• Audit Data
• User Management
¡ ¡ Enterprise Monitor
• Identifies Vulnerabilities
• Security hardening policies
• Monitoring & Alerting
• User Monitoring
• Password Monitoring
• Schema Change Monitoring
• Backup Monitoring
¡ Data Encryption
• TDE
• Encryption
• PKI
¡ Firewall
¡ Key Vault
¡ Enterprise Authentication
• SSO - LDAP, AD, PAM
¡ Network Encryption
¡ Enterprise Audit
• Powerful Rules Engine
¡ Audit Vault
¡ Strong Authentication
¡ Access Controls
¡ Assess
¡ Prevent
¡ Detect
¡ Recover
¡ Enterprise Backup
• Encrypted
¡ HA
• Innodb Cluster
¡ Thread Pool
• Attack minimization

Assess Security Risks
11
Discover
Personal
Data
Scan
Security
Configuration
Privilege
Analysis

Assess - MySQL Enterprise Features and GDPR
•  Assess Risks (Articles 35, 90, 91)
– MySQL Enterprise Monitor
•  Account assessment and reporting
•  Identifies Security Vulnerabilities – discover security holes, advises remediating actions
– Advisors provide rules designed to enforce security best practices and alert upon discovering vulnerabilities
– MySQL Workbench EE
•  Discover tables and columns containing “Personal Data”
•  Data Modeling tool - Reverse Engineering of Data Model to review data stored in the database
•  Schema Inspector, Table Inspectors – for schema assessment, grant inspection
– MySQL Security Best Practices Guidelines

12

MySQL Enterprise Monitor
•  Enforce MySQL Security Best Practices
–  Identifies Vulnerabilities
–  Assesses current setup against security hardening policies
•  Monitoring & Alerting
–  User Monitoring
–  Password Monitoring
–  Schema Change Monitoring
–  Backup Monitoring
–  Configuration Management
–  Configuration Tuning Advice
•  Centralized User Management
13
"I definitely recommend the MySQL Enterprise
Monitor to DBAs who don't have a ton of
MySQL experience. It makes monitoring
MySQL security, performance and availability
very easy to understand and to act on.”
Sandi Barr
Sr. Software Engineer
Schneider Electric

Assess MySQL Authorization
•  Administrative Privileges
•  Database Privileges
•  Session Limits and Object Privileges
•  User privileges
– Creating, altering and deleting databases
– Creating, altering and deleting tables
– Execute INSERT, SELECT, UPDATE, DELETE queries
– Create, execute, or delete stored procedures and with what rights
– Create or delete indexes
14
Security Privilege Management in MySQL Workbench

MySQL Enterprise Authentication
15
•  Integrate with Centralized Authentication Infrastructure
– Centralized Account Management
– Password Policy Management
– Groups & Roles
•  PAM (Pluggable Authentication Modules)
– Standard interface (Unix, LDAP, Kerberos, others)
– Windows
•  Access native Windows service - Use to Authenticate users using Windows
Active Directory or to a native host
Integrates MySQL with existing
security infrastructures

MySQL Enterprise Authentication: PAM
•  Standard Interface
– LDAP
– Unix/Linux
•  Proxy Users
16

MySQL Enterprise Authentication: Windows
•  Windows Active Directory
•  Windows Native Services
17

Assess your data and data model using MySQL Workbench
18

Prevent - MySQL Enterprise Features and GDPR
•  Prevent Attacks (Articles 32, 83, 28, 26, 5, 20, 27, 30, 64)
– MySQL Enterprise Security – Transparent Data Encryption
•  Includes Key Management
•  Protects Tablespace via Encryption, Keys via Key Manager/Vault integration
– MySQL Enterprise Security – Firewall
•  MySQL Firewall Statement/User/IP Whitelists, Rules
– MySQL Enterprise Authentication
– DBA configurable IP whitelisting, Connection Limits, …
•  Via server level and via per Account IP/Hostname Controls, Account resource limits,
– In transit data encryption -
•  Full support for TLS 1.2 - X509, Certificate Authorities, Exclude Lists, etc.
– Granular access controls
•  Table Grants, Database Views, Stored Procedures, Functions
19

MySQL Enterprise Firewall: Overview
20
Inbound
SQL Traffic
Web
Applications
SQL Injection Attack
Via Brower
ALLOW
BLOCK
DETECT
1
2
3
Instance
MySQL Enterprise FirewallInternet

MySQL Enterprise Firewall
•  Block SQL Injection Attacks
– Allow: SQL Statements that match Whitelist
– Block: SQL statements that are not on Whitelist
•  Intrusion Detection System
– Detect: SQL statements that are not on Whitelist
•  SQL Statements execute and alert administrators

21
Select * from employee where id=22
Select * from employee where id=22 or 1=1
Block✖
Allow✔
White List
Applications
Detect & Alert
Intrusion Detection

MySQL Enterprise Firewall
•  Real Time Protection
– Queries analyzed and matched against White List
•  Blocks SQL Injection Attacks
– Positive Security Model
•  Block Suspicious Traffic
– Out of Policy Transactions detected & blocked
•  Learns White List
– Automated creation of approved list of SQL command patterns on a per user basis
•  Transparent
– No changes to application required
22
MySQL Enterprise Firewall monitoring

Key Vault High-Level Architecture
Standby
Administration
Console, Alerts,
Reports
Secure Backups
= Credential Files/Other
Wallets
= Password/
phrases
Keystores
= Certificates
Databases
Servers
Middleware
23

MySQL Database
Encrypted
Tablespace
Files
Protected
Key
Hacker /
Dishonest OS User
Accesses
Files Directly
Information
Access Blocked
By Encryption
MySQL TDE – Protects against Attacks on Database Files

Key Vault
MySQL Enterprise Transparent Data Encryption
2 Tier Architecture
MySQL Database
Tablespace Keys

MySQL
Server
Plugin &
Services
Infrastructure
InnoDB
Client
Keyring
plugins

•  Master Key
•  Stored outside the database
•  Oracle Key Vault
•  SafeNet KeySecure
•  KMIP 1.1 Compliant Key Vault
•  Tablespace Key
•  Protected by master key
Master Key
Plain Text
Encrypted 2
Encrypted 1

Detect - MySQL Enterprise Features and GDPR – 1 of 2
•  Detect (Articles 30, 82, 33)
– MySQL Enterprise Security – Audit
•  Policy-based auditing solution – gather audit log of activity
•  Use to spot database misuse
•  Use to prove compliance to GDPR
– MySQL Enterprise Security – Firewall
•  Real-time protection against database specific attacks
•  Use to alert and/or block nefarious activity – such as personal data leakage
26

Focus on MySQL EE Audit
•  GDPR
– Mandates recording or auditing of the activities on the Personal Data
– Recommends records must be maintained centrally
•  Under the responsibility of the Controller.
– Processors and third-parties must not be able to tamper or destroy the audit records.
– In addition to book-keeping, auditing helps in forensic analysis in case of a breach.
•  MySQL Enterprise Audit Audit data can be
– Maintained in Oracle Audit Value – certified
– Outputs standard XML or JSON that easily integrate with various 3rd party solutions
– Supports encryption (MySQL 5.7.18+)
– Can direct security logs to write-once storage
27

MySQL Enterprise Audit - Work Flow
28

Detect - MySQL Enterprise Features and GDPR – 2 of 2
– MySQL Workbench EE
•  Security related –
– Inspect Audit Data
– Configure Firewall
– Manage Users
– MySQL Enterprise Monitor
•  Monitor/Alert on Firewall, Audit, Backups and more
•  Detect configuration changes
29

Additional Security Controls
Hashing, Signing, Encryption Functions
– Symmetric Encryption – AES
– Hashing – SHA-2, SHA-1
– Asymmetric Public Key Encryption (RSA)
– Asymmetric Private Key Decryption (RSA)
– Generate Public/Private Key (RSA, DSA, DH)
– Derive Symmetric Keys from Public and Private Key pairs (DH)
– Digitally Sign Data (RSA, DSA)
– Verify Data Signature (RSA, DSA)
– Validation Data Authenticity (RSA, DSA)

Additional Security Controls
•  HA
– Traditional Replication
– MySQL InnoDB Cluster
•  Disaster Recovery
– Traditional Replication
– MySQL InnoDB Cluster
•  Backup
– MySQL Enterprise Backup
•  Includes encryption
•  Support for MySQL TDE

MySQL Cloud Service
•  Designed for security
•  MySQL Enterprise Features
•  Backup & Recovery
– Based on MySQL Enterprise Backup
•  Support (with consultative support)
Confidential – Oracle Internal 32 Confidential – Oracle Internal 32
+
MySQL Enterprise Edition

References
•  Home page EU GDPR
– http://www.eugdpr.org/
•  MySQL Enterprise
– https://www.mysql.com/products/enterprise/
•  MySQL PCI DSS
– https://www.mysql.com/it/why-mysql/white-papers/mysql-pci-data-security-
compliance/
•  MySQL Security Best Practices
– https://www.mysql.com/it/why-mysql/presentations/mysql-security-best-practices/

MySQL + GDPR

More Related Content

What's hot

What's hot (20)

Similar to MySQL + GDPR

Similar to MySQL + GDPR (20)

More from Mark Swarbrick

More from Mark Swarbrick (20)

Recently uploaded

Recently uploaded (20)

MySQL + GDPR