Building protected databases using mandatory access control in PostgreSQL
Role-based access control (RBAC) is one of the main mechanisms used for access control in many DBMS, including PostgreSQL. This model is a sub-type of traditional discretionary access control with its restrictions. In addition to DAC, many operating systems also use mandatory access control (MAC) based on security labels. This additional security mechanism is obligatory for protecting information that demands higher levels of security. Naturally, we would like to use MAC within DBMS when working in OS with mandatory access control switched on.
In this talk, we'll give an overview of existing MAC implementations in DBMS, as well as share our approach to using security mechanisms provided by SELinux, the sepgsql extension for PostgreSQL, and the standard mechanism of row-level security (RLS), which has been available in PostgreSQL starting from version 9.5.
In our presentation, we will use the "Airlines" demo database provided by the Postgres Professional company to show how to protect sensitive information and personal data, compare different ways of storing security labels, and assess performance of our solution.
Слайды
Видео
Другие доклады
-
22 мин
Нина Белявская Служба движения ГУП "Мосгортранс"Road public transport in Moscow analysis: from PostGIS to MobilityDB
Moscow public transport vehicles when moving report their coordinates via GLONASS. Collected data is used for various analyses including timetable development, bottlenecks detection and planning the bus lanes. Until recently we used the PostGIS extension for this purpose but now we are switching to a new PG extension — MobilityDB — designed especially for geodata time series processing. I have compared the table size and the performance of our solution without and with MobilityDB and happy to present the results.
-
45 мин
Alexander Korotkov Postgres ProfessionalWhat's new in PostgreSQL 13?
PostgreSQL 13 Feature Freeze is scheduled for April 2020. Two more commitfests are still accepting new patches. What we can say about PostgreSQL 13. It's possible that rotation rule will work so that new release wouldn't have as many new features as PostgreSQL 12 have. If even it is do, that would be good evolutionary release with a lot of medium feature and infrastructure changes, which prepares postgres for new leap. In this talk I will overview expected novelties in PostgreSQL 13. It would be more or less accurate, since there would be only one commitfest left, which results are possible to forecast.
-
45 мин
Олег Правдин LingualeoReal case of smooth MySQL → PG migration of highloaded project (20+M users)
A brief story how MySQL → PG migration could increase company efficiency tenfold times:
- Program code has been reduced 50 times, with optimization of backend team (from 15 to 3 engineers)
- Software development of new features has become measuring in days, not in months
- Infrastructure costs per 1M users have been reduced 20 times
- Database structure and technical documentation were simplified significantly, from 100K high-dependent tables to just 20 simple tables
- New security level because of total forbidden on external SQL commands to the database
- Quick analytics aggregation on multiple parameters, without external analytics systems
- The last, but not the least: the main business was keeping alive during migration
-
180 мин
Anton Doroshkevich ИнфоСофтPostgreSQL configuration master class for 1C
You will have a fascinating journey through PostgreSQL settings. We will talk about that with 1C not so or on the contrary so that under it it is necessary to adjust specially DBMS. We will discuss approaches to testing the speed of 1C. Consider the various options for backup schemes and fault tolerance. In the process, we will compare the speed of 1C on PostgreSQL configured by default with the speed of 1C configured for PostgreSQL. Also, we will create a replica of PostgreSQL, and switch to it the 1C Server "live", see what users will see 1C during this operation. And a separate block will be devoted to Postgres Pro Enterprise Edition, how the use of its advantages affects the speed of 1C.