MySQL Security

-> 5.1 Database Security

-> Regulatory Compliance

-> Regulations Include:

-> GDPR, General Data Protection Regulation: Protection of

personal Data
-> PCI - DSS: Payment Card Data
-> HIPAA: Privacy of Health Data
-> Sarbanes Oxley, GLBA, The USA Patriot Act:
-> Financial Data, NPI "personally identifiable finantial
information"
-> FERPA: Student Data
-> Data Protection Act (UK): Protection of Personal Data
-> NIS2: Cybersecurity of Network and Information Systems

-> Requirements Include: Continuous Monitoring (Users, backups,

Schemas...etc)
-> Data Protection (Encryption, Privilege Managemente, etc)
-> Data Retention (Backups, User Activity, etc)
-> Data Auditing (User Activity, etc) > Você deve ser capaz de
auditar o acesso aos dados para que possa rastrear quais usuários obtiveram acesso
aos registros ou quando eles foram modificados.

-> 5.2 Mitigating Risks

-> Attack Vectors and Targets for Databases

-> Complexity Grows, Risks Grows
-> Entre os riscos, podemos citar o fator de falha humana.
-> Risk Multipliers: High Availability, Database consolidation,
Legacy Applications, Outsourcing, Cloud

-> Riscos associados diretamente ao Banco de Dados:

-> Poor Configuration: Set controls and change default setting

-> Over-privileged accounts: Use Privilege policies.
-> Weak Access Control: Use dedicated administrative accounts
-> Weak Authentication: Use strong password enforcement
-> Weak Auditing: Enforce compliances and audit policies
-> Lack of Encryption: use data, backup, and network encryption
-> Proper Credential and Key Management: Protect Passwords, use key
vaults
-> Unsecured Backups: Encrypt backups
-> No Monitoring: Implement security monitoring for users and objects
-> Poorly Coded Applications: Use Database Firewall
-> SQL Injection: DB Firewall (allow list), input validation
-> Buffer Overflow: Frequently apply database software updates, DB
Firewall (allow list), input validation.
-> Insider Abuse: Tight access controls, user-specific authentication
(no general accounts), auditing, monitoring, encryption
-> Brute Force Attack: lock out accounts after a defined number of
incorrect attempts.
-> Network Eavesdropping: Require SSL/TLS for all connections and
transport
-> Malware: Tight access controls, limited netowrk IP access, change
default settings, encryption
 -> Information Disclosure > Obtain credit card and other personal
information: Encryption - Data and Network, implement tighter access controls
-> Denial Of Service > Run Resource-intensive Queries: Resource usage
limits - Set various limits, e.g, maximium connections, sessions, timeouts, etc.
-> Elevation of Privilege > Retrieve and user administrative
credentials: Stronger authentication, access controls, auditing
-> Spoofing > Retrieve and use other credentials: Stronger account and
passwords policies
-> Tampering > Change data in the database and delete transactions
records: Tighter access controls, auditing, monitoring, backups

-> MySQL Database Hardening Best Practices

-> Installation: Keep MySQL up to date, MySQL Installer for Windows,

Yum/Apt/other repositories
-> Authentication: Password Policies, Multifactor Authentication,
External authentication, X.509
-> Authorization: Remove extra accounts, Grant minimal privilegies,
Audit userrs and privilegies
-> Configuration: Firewall, Auditing and logging, Limit network access,
Monitor Changes
-> Encryption: SSL/TLS for secure connections, Data Encryption(AES,
RSA), TDE (Transparent Data Encryption), Masking and de-identification
-> Collateral: Encrypt Backups, secure replications, Secure HA and DR

-> Hardening: Database and OS Installation, Configuration, and Maintenance

-> Build on a secure platform: OS Patched, firewall, etc.

-> Use the Secure Build: [Link]
deployment-guide/8.4/en/
-> Keep the operating system and MySQL security patches up to date
-> Follow OS vendor-specific hardening guidelines.
-> Follow Center for Internet Security (CIS) Benchmarks.

-> 5.3 Authentication

-> MySQL User Accounts

-> Within MySQL, accounts are composed of three elements:

"username@host" identifier, and a password
-> The account identifier comprises two distinct values: username and
host
- "host" is the network ID of the machine from where the MySQL
cient connects
- a host value of '%' indicates that the client can connect from
any IP address
- An identifier with no host value indicates that the client can
connect from any host.
- Examples: 'user_name' @ '%.[Link]', 'db_user' @
'[Link]'
- Example
- CREATE USER 'test'@'%' IDENTIFIED BY 'VeryComplex1!';

-> User Passwords

-> Passwords are stored in a encrypted form: Using a secure one-way

hashing algorithm implemented in a authentication plugin
-> The default authentication plugin is caching_sha2_password.
-> To change the authentication plugin: add in the [Link] configuration
file, under [mysqld] section > default_authentication_plugin=mysql_native_password
- Specify at the command line when you invoke the server: --
default_authentication_plugin=caching_sha256_password

-> User Passwords Examples:

mysql> CREATE USER 'jeffrey'@'localhost'

IDENTIFIED BY 'password_value1';

mysql> SET PASSWORD FOR jeffrey@'localhost' = 'password_value2';

mysql> SET PASSWORD = 'mypass';

mysql> CREATE fred@localhost

IDENTIFIED WITH mysql_native_password
BY 'HisPa55w0rd!';

-> 5.4 Authentication in MySQL Enterprise Edition

-> MySQL Enterprise Authentication

-> Integrates MySQL with existing security infrastructures
-> Integrates with Centralized Authentication Infrastructure
- Centralized Account Management
- Password Policy Management
- Group and Roles
-> Pluggable Authentication Modules (PAM)
- Linux PAM Standard interface (Unix, LDAP, Kerberos, others)
- FIDO interface (passwordless authentication)
- Single Sign-On (SSO) Plugin is available to access native LDAP
service for authentication
- Plugin is available to access native Windows service

-> MySQL Enterprise Authentication: Native LDAP

- Direct Connection over
- LDAP Protocol/Ports
- Authentication with: User and password or SASL (Simple authentication
and Security Layer)
- Customizable for users and groups

-> MySQL Enterprise Authentication: PAM (Pluggable authentication Module)

- Standard Interface: LDAP, Unix/Linux
- Proxy Users

-> MySQL Enterprise Authentication: Windows

- Uses same service of Windows Active Directory
- Authentication Handshake
- Creates a security context object
- Represents the identity of the windows client.

-> MySQL Role-based Authentication

- Enable group-based management of user and applications rights
- Has multiple default roles
- Can export the role in graph in GraphML

-> Example Syntax with Graph Result

- CREATE ROLE 'r1', 'admin-db1', 'admin-db2', 'admin-db1t1', 'admin-
db2t1', 'app-updater'

- CREATE USER 'app-middleware-db1'@localhost,

 'app-middleware-db2'@localhost, 'app'@localhost;

GRANT 'admin-db1', 'app-updater' to 'app-middleware-db1'@localhost;

GRANT 'r1' TO 'app-middleware-db1'@localhost WITH ADMIN OPTION;
GRANT 'admin-db2t1' TO 'admin-db1';
GRANT 'admin-db1t1' TO 'admin-db1' WITH ADMIN OPTION;
GRANT 'admin-db1t1' TO 'admin-db2', 'app'@localhost;
GRANT 'admin-db2' TO 'app-middleware-db2'@localhost;

-> 5.5 Authorization

-> MySQL Privileges

-> GRANT X privilegies on Y to Z (with grant options)

- Administrative Privilegies: Global privilegies, enabling users

to manage the server
- Database Privilegies: Privilegies specific to database(s)
* GRANT ALL PRIVILEGIES ON *.* TO 'test'@'%' WITH GRANT OPTION;

-> Fine-grained controls over user privilegies:

- creat, alter, and delete databases

- create, alter, and delete tables; create or delete indexes
- create, execute or delete stored procedures and with what
rights
- Execute INSERT, SELECT, UPDATE, DELETE queries

-> Resetting MySQL Privilegies:

- If you forget the password to administrative accounts, you are
unable to administer MySQL.
- Disable access control by launching MySQL with --skip-grant-
tables
- This option also enables --skip_networking to prevent
networked users from logging in while security
is disabled.
- When you disable access control, every user that logs in has
root privilegies.
- After resetting the password, enable the privilege system
immediately

-> Dynamic Privilegies

-> Granted by the server at runtime, or by administrators using

GRANT commands
-> Include administrative privilegies: ex> SYSTEM_USER,
BINLOG_ADMIN, SYSTEM_VARIABLES_ADMIN,
-> Can be defined and granted by plugins and components
- They grant privilegies associated with those plugins
- Ex: FIREWALL_ADMIN granted by the mysql_firewall plugin,
AUDIT_ADMIN granted by the audit_log plugin