Welcome!

Microsoft Cloud Authors: John Basso, Liz McMillan, Pat Romanski, Glenn Rossman, Elizabeth White

Blog Feed Post

Best Practices for MySQL Encryption

MySQL encryption cloud security best practices  mytechlogy Best Practices for MySQL EncryptionMany applications have a database at their core, and very often, this database is the mature and popular MySQL. Often it is the most sensitive information that gets stored in the database: customer details, credit card numbers, passwords (or password hashes) and so on. MySQL encryption is an industry best practice.

MySQL Encryption: Why?

Obviously, the sensitive information within the database is enough motivation for secure MySQL Encryption.
Often there are also requirements by regulatory bodies to encrypt the database-resident data, either applying to the entire database or to selected tables or columns.
There is often another motivation to encrypt some of the data: segregation between users, between applications, and most often between administrative users – such as the Database Administrator – and the business data. Without encryption, the DBA can read any of the data stored in the database. With encryption, provided it happens at the right layer, you can protect the most sensitive data, while keeping most of the data unencrypted and so more accessible to applications and utility tools.

MySQL Encryption: How?

Until recently, you typically needed to set up your own MySQL instance on a server, and manage the database yourself. The organization would have to deal with scaling, replication, backups and disaster recovery. Many organizations ended up employing a full time person to continuously care for the database.
In the last few years, cloud-based databases have become increasingly popular. The most prominent one is Amazon Web Services’ RDS, a service that supports several database technologies, including MySQL. It should be noted that RDS and other cloud databases do not in general provide encryption out of the box. Some of the techniques described below also apply to cloud databases, with the important exception of full-disk encryption.

MySQL Encryption: Available Options

The simplest way to encrypt a database is to overlay it on a fully-encrypted disk. There are many solutions available for full-disk encryption (FDE). Two examples are the Linux open-source dm-crypt, and the more user-friendly Porticor Virtual Private Data, which bundles up-in-minutes full disk encryption together with an innovative and highly secure key management service.
Once you have the encrypted disk, it is an easy matter to configure the database so that the data directory resides on that disk. Now, assuming you manage your encryption keys correctly, if you ever lose your disk, you do not need to worry about your sensitive data being exposed to prying eyes. This addresses some of the threats facing your data, but clearly not all of them. For example, someone who breaks into the application or someone who obtains administrative privileges on the database would still be able to read the data, even though it is fully encrypted.
So let us look at encryption at a higher layer. The next layer up from the disk would be the RDBMS (database engine) itself. Unlike other databases, MySQL unfortunately does not provide a Transparent Data Encryption (TDE) solution. Which means we need to go still higher.
MySQL does offer encryption functions that are available to SQL code run from the application, as well as to stored procedures. Please refer to the MySQL documentation for details. You can use these functions to encrypt specific database tables, columns or even individual fields. Just like for disk encryption, it is best to have a key management solution available, so that you don’t need to rely on easy to guess passwords or end up storing your encryption keys along with the data. Once you have a cryptographic key from your key management solution, you can use it in the following SQL statement:
UPDATE T1 SET T1.f = AES_ENCRYPT(value, encryption_key) WHERE …
This will encrypt the value before it is saved into the database. To retrieve the original value you can use AES_DECRYPT to decrypt stored value, as part of a SELECT statement.
There are different ways to wrap this functionality so that code changes are minimized. One alternative is to create a database view that performs decryption of data on the fly, which eliminates the need to change all relevant SELECT statements. The security cost is high though: the encryption key would need to be specified during the view definition and so would be available to all database users with the appropriate privileges. That is, no more protection from a rogue DBA.
You should note that when using the native MySQL encryption functions, the sensitive data is still sent to the database, even if it is never stored. If you want to protect against an active attacker on the database, your best bet is application-level encryption. Essentially all programming languages are nowadays available with decent encryption facilities. Examples include the Java SealedObject class and .NET Cryptographic Services). This may be more onerous than using the MySQL built-ins, but the upside is that you can get better security by using cipher-block chaining (a.k.a. CBC mode) than you’d get with the MySQL native ECB mode.

MySQL Encryption: An Important Layer of Security

To summarize, database encryption provides an important layer of security to your sensitive data. There are different ways to encrypt the data, all very practical. But remember that even the best crypto library will not secure your data unless you are using a secure key management infrastructure

The post Best Practices for MySQL Encryption appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@ThingsExpo Stories
IoT is rapidly changing the way enterprises are using data to improve business decision-making. In order to derive business value, organizations must unlock insights from the data gathered and then act on these. In their session at @ThingsExpo, Eric Hoffman, Vice President at EastBanc Technologies, and Peter Shashkin, Head of Development Department at EastBanc Technologies, discussed how one organization leveraged IoT, cloud technology and data analysis to improve customer experiences and effi...
The Internet of Things will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform. In his session at @ThingsExpo, Craig Sproule, CEO of Metavine, demonstrated how to move beyond today's coding paradigm and shared the must-have mindsets for removing complexity from the develo...
SYS-CON Events announced today that MangoApps will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. MangoApps provides modern company intranets and team collaboration software, allowing workers to stay connected and productive from anywhere in the world and from any device.
The IETF draft standard for M2M certificates is a security solution specifically designed for the demanding needs of IoT/M2M applications. In his session at @ThingsExpo, Brian Romansky, VP of Strategic Technology at TrustPoint Innovation, explained how M2M certificates can efficiently enable confidentiality, integrity, and authenticity on highly constrained devices.
“delaPlex Software provides software outsourcing services. We have a hybrid model where we have onshore developers and project managers that we can place anywhere in the U.S. or in Europe,” explained Manish Sachdeva, CEO at delaPlex Software, in this SYS-CON.tv interview at @ThingsExpo, held June 7-9, 2016, at the Javits Center in New York City, NY.
The IoT is changing the way enterprises conduct business. In his session at @ThingsExpo, Eric Hoffman, Vice President at EastBanc Technologies, discussed how businesses can gain an edge over competitors by empowering consumers to take control through IoT. He cited examples such as a Washington, D.C.-based sports club that leveraged IoT and the cloud to develop a comprehensive booking system. He also highlighted how IoT can revitalize and restore outdated business models, making them profitable ...
Internet of @ThingsExpo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with the 19th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world and ThingsExpo Silicon Valley Call for Papers is now open.
We all know the latest numbers: Gartner, Inc. forecasts that 6.4 billion connected things will be in use worldwide in 2016, up 30 percent from last year, and will reach 20.8 billion by 2020. We're rapidly approaching a data production of 40 zettabytes a day – more than we can every physically store, and exabytes and yottabytes are just around the corner. For many that’s a good sign, as data has been proven to equal money – IF it’s ingested, integrated, and analyzed fast enough. Without real-ti...
SYS-CON Events announced today that 910Telecom will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Housed in the classic Denver Gas & Electric Building, 910 15th St., 910Telecom is a carrier-neutral telecom hotel located in the heart of Denver. Adjacent to CenturyLink, AT&T, and Denver Main, 910Telecom offers connectivity to all major carriers, Internet service providers, Internet backbones and ...
Big Data, cloud, analytics, contextual information, wearable tech, sensors, mobility, and WebRTC: together, these advances have created a perfect storm of technologies that are disrupting and transforming classic communications models and ecosystems. In his session at @ThingsExpo, Erik Perotti, Senior Manager of New Ventures on Plantronics’ Innovation team, provided an overview of this technological shift, including associated business and consumer communications impacts, and opportunities it ...
You think you know what’s in your data. But do you? Most organizations are now aware of the business intelligence represented by their data. Data science stands to take this to a level you never thought of – literally. The techniques of data science, when used with the capabilities of Big Data technologies, can make connections you had not yet imagined, helping you discover new insights and ask new questions of your data. In his session at @ThingsExpo, Sarbjit Sarkaria, data science team lead ...
WebRTC is bringing significant change to the communications landscape that will bridge the worlds of web and telephony, making the Internet the new standard for communications. Cloud9 took the road less traveled and used WebRTC to create a downloadable enterprise-grade communications platform that is changing the communication dynamic in the financial sector. In his session at @ThingsExpo, Leo Papadopoulos, CTO of Cloud9, discussed the importance of WebRTC and how it enables companies to focus...
ReadyTalk has expanded the capabilities of the FoxDen collaboration platform announced late last year to include FoxDen Connect, an in-room video collaboration experience that launches with a single touch. With FoxDen Connect, users can now not only engage in HD video conferencing between iOS and Android mobile devices or Chrome browsers, but also set up in-person meeting rooms for video interactions. A host’s mobile device automatically recognizes the presence of a meeting room via beacon tech...
Manufacturers are embracing the Industrial Internet the same way consumers are leveraging Fitbits – to improve overall health and wellness. Both can provide consistent measurement, visibility, and suggest performance improvements customized to help reach goals. Fitbit users can view real-time data and make adjustments to increase their activity. In his session at @ThingsExpo, Mark Bernardo Professional Services Leader, Americas, at GE Digital, discussed how leveraging the Industrial Internet a...
On Dice.com, the number of job postings asking for skill in Amazon Web Services increased 76 percent between June 2015 and June 2016. Salesforce.com saw its own skill mentions increase 37 percent, while DevOps and Cloud rose 35 percent and 28 percent, respectively. Even as they expand their presence in the cloud, companies are also looking for tech professionals who can manage projects, crunch data, and figure out how to make systems run more autonomously. Mentions of ‘data science’ as a skill ...
IoT generates lots of temporal data. But how do you unlock its value? You need to discover patterns that are repeatable in vast quantities of data, understand their meaning, and implement scalable monitoring across multiple data streams in order to monetize the discoveries and insights. Motif discovery and deep learning platforms are emerging to visualize sensor data, to search for patterns and to build application that can monitor real time streams efficiently. In his session at @ThingsExpo, ...
"delaPlex is a software development company. We do team-based outsourcing development," explained Mark Rivers, COO and Co-founder of delaPlex Software, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
SYS-CON Events announced today that LeaseWeb USA, a cloud Infrastructure-as-a-Service (IaaS) provider, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. LeaseWeb is one of the world's largest hosting brands. The company helps customers define, develop and deploy IT infrastructure tailored to their exact business needs, by combining various kinds cloud solutions.
Amazon has gradually rolled out parts of its IoT offerings in the last year, but these are just the tip of the iceberg. In addition to optimizing their back-end AWS offerings, Amazon is laying the ground work to be a major force in IoT – especially in the connected home and office. Amazon is extending its reach by building on its dominant Cloud IoT platform, its Dash Button strategy, recently announced Replenishment Services, the Echo/Alexa voice recognition control platform, the 6-7 strategic...
The cloud market growth today is largely in public clouds. While there is a lot of spend in IT departments in virtualization, these aren’t yet translating into a true “cloud” experience within the enterprise. What is stopping the growth of the “private cloud” market? In his general session at 18th Cloud Expo, Nara Rajagopalan, CEO of Accelerite, explored the challenges in deploying, managing, and getting adoption for a private cloud within an enterprise. What are the key differences between wh...