Welcome!

Blog Feed Post

MySQL encryption in the cloud: How to do it right

MySQL encryptionMySQL encryption is one of the most common use cases we’re seeing in infrastructure clouds. Enterprises or software as a service (SaaS) vendors store sensitive or regulated data in the cloud using MySQL, and the immediate consequence is a requirement for data encryption.

Below, I’ll cover the MySQL encryption options used by our customers, analysis of pros and cons, and references to relevant knowledge base articles.

Information on additional database and encryption options supported by Porticor is available here.

MySQL Encryption: encrypting the entire database

Encryption of an entire MySQL database can be easily achieved by mounting the database store to an encrypted volume using a Porticor encryption agent or the inline Porticor Virtual Appliance.

MySQL Encryption: Entire database encryption benefits

The main benefit of encrypting an entire database is in the simplicity of the solution. There is no need to alter the code or update SQL statements. Simply attach the data store to an encrypted volume and you’re all set.

MySQL Encryption: The downside of entire database encryption

Full disk encryption might not be enough. Regulations like PCI require sensitive data to be specifically encrypted. In that case, we recommend you’d continue reading the additional database or application level encryption options mentioned below.

Entire database encryption conclusion

Mounting your database to an encrypted volume is considered a best practice and we would highly recommend doing so even if additional encryption options are used.

Database level encryption

Database level encryption with MySQL is relatively simple due to the AES_ENCRYPT / AES_DECRYPT built-in functions (important note: most modern databases like Oracle, PostgreSQL and others have similar built in functions). Calling these functions enables the encryption of specific statements according to your compliance requirements.

MySQL database level encryption benefits:

The benefits of database level encryption are many. Customers can make use of the existing MySQL encryption functions (you will not need to install an additional encryption agent), and encrypted data will not be available for the Linux admin or any super user, as it is encrypted before it is written to disk.

An important note regarding key management

It is considered best practice to generate as many encryption keys as practically possible for certain data sets. The Porticor key management API allows for such automatic creation of encryption keys. An example of MySQL integration with Porticor’s key management API is available here.

Application level encryption

Application level encryption is to be considered if the requirement is to encrypt the data before it hits the database server. This option would require some code changes (API integration as described above), but the end result is a highly secure architecture that can scale to automatically encrypt different data sets with different keys.

Many of our customers have integrated Porticor for application level encryption to protect each customer data with a unique encryption key. Further enhancements like key rotation or key revocation are obviously important and can be easily added.

Our RESTful API is described by our customers as a very easy and intuitive integration point.

MySQL Encryption: Summary

MySQL encryption is available in more than one shape and form. Identifying the relevant options is an important first step. Other MySQL encryption best practices include:

  1. Encrypt the entire volume regardless of additional MySQL or application level encryption. The performance hit is negligible and you’ll sleep better at night knowing you have more than one layer of encryption.
  2. Generate as many encryption keys as practically possible.
  3. Keep it simple as possible. Encryption doesn’t have to be complicated. Our RESTful API is an excellent example of simplifying a complicated task.

The post MySQL encryption in the cloud: How to do it right appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

Latest Stories
Due of the rise of Hadoop, many enterprises are now deploying their first small clusters of 10 to 20 servers. At this small scale, the complexity of operating the cluster looks and feels like general data center servers. It is not until the clusters scale, as they inevitably do, when the pain caused by the exponential complexity becomes apparent. We've seen this problem occur time and time again. In his session at Big Data Expo, Greg Bruno, Vice President of Engineering and co-founder of StackIQ...
The security needs of IoT environments require a strong, proven approach to maintain security, trust and privacy in their ecosystem. Assurance and protection of device identity, secure data encryption and authentication are the key security challenges organizations are trying to address when integrating IoT devices. This holds true for IoT applications in a wide range of industries, for example, healthcare, consumer devices, and manufacturing. In his session at @ThingsExpo, Lancen LaChance, vic...
"Plutora provides release and testing environment capabilities to the enterprise," explained Dalibor Siroky, Director and Co-founder of Plutora, in this SYS-CON.tv interview at @DevOpsSummit, held June 9-11, 2015, at the Javits Center in New York City.
FinTech is the sum of financial and technology, and it’s one of the fastest growing tech industries. Total global investments in FinTech almost reached $50 billion last year, but there is still a great deal of confusion over what it is and what it means – especially as it applies to retirement. Building financial startups is not simple, but with the right team, technology and an innovative approach it can be an extremely interesting domain to disrupt. FinTech heralds a financial revolution that...
In his session at DevOps Summit, Tapabrata Pal, Director of Enterprise Architecture at Capital One, will tell a story about how Capital One has embraced Agile and DevOps Security practices across the Enterprise – driven by Enterprise Architecture; bringing in Development, Operations and Information Security organizations together. Capital Ones DevOpsSec practice is based upon three "pillars" – Shift-Left, Automate Everything, Dashboard Everything. Within about three years, from 100% waterfall, C...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place June 6-8, 2017, at the Javits Center in New York City, New York, is co-located with 20th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry p...
SYS-CON Media announced today that @WebRTCSummit Blog, the largest WebRTC resource in the world, has been launched. @WebRTCSummit Blog offers top articles, news stories, and blog posts from the world's well-known experts and guarantees better exposure for its authors than any other publication. @WebRTCSummit Blog can be bookmarked ▸ Here @WebRTCSummit conference site can be bookmarked ▸ Here
SYS-CON Events announced today that Addteq will exhibit at SYS-CON's @DevOpsSummit at Cloud Expo New York, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Addteq is one of the top 10 Platinum Atlassian Experts who specialize in DevOps, custom and continuous integration, automation, plugin development, and consulting for midsize and global firms. Addteq firmly believes that automation is essential for successful software releases. Addteq centers its products an...
In his keynote at @ThingsExpo, Chris Matthieu, Director of IoT Engineering at Citrix and co-founder and CTO of Octoblu, focused on building an IoT platform and company. He provided a behind-the-scenes look at Octoblu’s platform, business, and pivots along the way (including the Citrix acquisition of Octoblu).
SYS-CON Events announced today that IoT Now has been named “Media Sponsor” of SYS-CON's 20th International Cloud Expo, which will take place on June 6–8, 2017, at the Javits Center in New York City, NY. IoT Now explores the evolving opportunities and challenges facing CSPs, and it passes on some lessons learned from those who have taken the first steps in next-gen IoT services.
You think you know what’s in your data. But do you? Most organizations are now aware of the business intelligence represented by their data. Data science stands to take this to a level you never thought of – literally. The techniques of data science, when used with the capabilities of Big Data technologies, can make connections you had not yet imagined, helping you discover new insights and ask new questions of your data. In his session at @ThingsExpo, Sarbjit Sarkaria, data science team lead ...
SYS-CON Events announced today that WineSOFT will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Based in Seoul and Irvine, WineSOFT is an innovative software house focusing on internet infrastructure solutions. The venture started as a bootstrap start-up in 2010 by focusing on making the internet faster and more powerful. WineSOFT’s knowledge is based on the expertise of TCP/IP, VPN, SSL, peer-to-peer, mob...
The Internet of Things can drive efficiency for airlines and airports. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Sudip Majumder, senior director of development at Oracle, discussed the technical details of the connected airline baggage and related social media solutions. These IoT applications will enhance travelers' journey experience and drive efficiency for the airlines and the airports.
For organizations that have amassed large sums of software complexity, taking a microservices approach is the first step toward DevOps and continuous improvement / development. Integrating system-level analysis with microservices makes it easier to change and add functionality to applications at any time without the increase of risk. Before you start big transformation projects or a cloud migration, make sure these changes won’t take down your entire organization.
Big Data, cloud, analytics, contextual information, wearable tech, sensors, mobility, and WebRTC: together, these advances have created a perfect storm of technologies that are disrupting and transforming classic communications models and ecosystems. In his session at @ThingsExpo, Erik Perotti, Senior Manager of New Ventures on Plantronics’ Innovation team, provided an overview of this technological shift, including associated business and consumer communications impacts, and opportunities it m...