NoSQL security: "back to principles"

AviD

Feb 20, 2012 13:37

and while we're on the topic of non-sequiturs - any you blokes have experience with any NoSQL?

Jeff Ferland

@AviD Yes

AviD

Feb 20, 2012 14:04

@JeffFerland oo, really?

specifically looking at cassandra, though possible to switch to others

actually after some google strolling, I'm starting to turn up a little bit of info

i guess a q for the rest wouldnt be wrong.

Jeff Ferland

@AviD Speak your mind, sir.

AviD

but do you happen to have some kind of hardening doc / guidelines / etc?

@JeffFerland not yet sure what my mind is. trying to figure out what we need for it

not really much security stuff for nosqls out there...

even we only have a single q so far

Jeff Ferland

@AviD I have to say, usually one switches the order :)

Restrict to systems that need it, use auth, layer with SSL if performance allows (and connections persist... renegotiating the asymetric part is bad!), and watch your input if building queries.

AviD

@JeffFerland heh. of course.

Jeff Ferland

:)

AviD

Feb 20, 2012 14:09

what I meant was, my client is going to be using it as part of his system, and I don't yet know enough about it to have the specific recommendations.

learning, though....

Jeff Ferland

Ahhhh

AviD

@JeffFerland so as it turns out, not all of them support auth - N or Z

Jeff Ferland

@AviD Yeah, there's a lot of performance focus with NoSQL systems, which gives up a lot of control. Not that Memcache is a database, but some play like that... no auth, no logging. If you can send a packet and know a key, you can get an answer.

AviD

SSL - is internal (i.e. gossip intra-node) important to have over SSL (if that part of the network is restricted)?

any specific input (heh) on input validation for nosql?

@JeffFerland right. So, what is done? what CAN be done?

Jeff Ferland

@AviD Depends on architecture and goals. Not necessary, but defense in depth and such.

AviD

Feb 20, 2012 14:12

Cassandra had a minimal plugin for authN/Z, but it turns out its a low-security sample only.

it is pluggable, though - so I may just have to tell them to tailor a plugin for it.

@JeffFerland any other specific, non-generic advice?

so far you havent said anything I dont know :)

Jeff Ferland

@AviD Well, you could do mutual machine auth through stunnel or write a proxy app (or plugin) to handle auth and pass queries on

AviD

though validating my perspective surely helps too

@JeffFerland urggh, thats even worse. and probably would kill the performance

Jeff Ferland

@AviD Maybe, maybe not. Symmetric crypto is fast, so as long as you're not renegotiating your connections, you should get plenty of throughput.

AviD

I meant a proxy app

but as I mentioned, Cassandra at least supports a plugin architecture for AuthN/Z

Jeff Ferland

If it's financially worth it, the best thing would be to write that plugin.

I think that's an unlikely case.

Just from instinct, anyway.

AviD

Feb 20, 2012 14:17

@JeffFerland really? thinking authz should be handled by the app / perimeter?

Jeff Ferland

@AviD Edit for clarity / expand? Interpreted your question in a few ways.

AviD

@JeffFerland you said you think its unlikely that its worth writing an auth plugin. what would be a better solution for auth (N/Z) ?

Jeff Ferland

@AviD I just mean in terms of financial cost / hours to develop. It's the best method, but I don't think it's the cheapest. Everybody's cost-sensitive and all that.

AviD

@JeffFerland okay, but what other option would you suggest?

I dont think the proxy app would be less expensive, especially if you want to tune for performance.

Jeff Ferland

@AviD If it does fit into the system architecture, app / perimiter auth and restricting access to db to server instances would be an easy pattern.

AviD

Feb 20, 2012 14:23

ah, right - basically going back to restricting the network.

Jeff Ferland

@AviD Yup. That's the cheap one.

AviD

but, what if (and this is my scenario) we need internal segregation?

e.g. 2 users can access the db, but with different access?

Jeff Ferland

Generally, there is no RBAC / object level security. So if you're talking different keyspaces (tables in SQL land), then yes. Otherwise, creek + paddle.

Good crash course slide set: slideshare.net/Dataversity/wed-1200-penchikalasrini2color

AviD

@JeffFerland right, thats pretty much the impression I got. And, the only way to implement that, would be some form of plugin.

Right back where I started :)

Jeff Ferland

@AviD Thanks for taking the ride with me? :)

AviD

Feb 20, 2012 14:30

@JeffFerland heh. In any event, having my impressions validated by your experience is definitely helpful :)

Scott Pack

@RoryAlsop Same here. And when it has been the police bringing evidence to us for examination, they've never brought the monitor, though I don't know if it was seized.

@Iszi To be fair, I allowed for the possibility that you hired an actor.

AviD

probably will need to pop up a q for some of the details later, but good to know there is someone that could answer

besides, you should at least get the rep for that :)

@ScottPack ah, the equivalent of a CAPTCHA proxy :D

@JeffFerland what about storage encryption?

all I could find is comms encryption

Rory Alsop

for info:

4

Q: Can I encrypt data in a way that it can't be copied or edited?

I want to share my 500 GB hard drive with a friend but I want to encrypt it in a way that all data can be read normally but cannot be copied or edited in any way. Is that possible?

have flagged for migration here - if we get it, was planning on merging with our existing one:

13

Q: Are there DRM techniques to effectively prevent pirating?

Note: I was forwarded here from Skeptics.SE by AviD. I simply copied the entire body of the question but acknowledge that it may need some tweaking to fit properly with this site. Any edits or comments to that effect are welcome. Neal's Note: I've edited it to distinguish it from that question. ...

access-control drm

Scott Pack

@AviD Ah, yes, here we go. twitter.com/#!/packscott/status/109697800677244928

@RoryAlsop Sounds pretty reasonable

Jeff Ferland

@AviD Repat the same circle from above. Plugins, layering (encrypt partition with OS), app... trust the machine.

AviD

Feb 20, 2012 14:37

@JeffFerland so, nothing built in.

@RoryAlsop I always find it weird when I see my name on posts of which I have zero recollection.

funny when I'm reading a post and want to upvote it, and realize that I wrote it.

5

even funnier when I want to downvote.

Rory Alsop

@AviD hahahaha - I get that occasionally. I blame old age, and a full brain

AviD

@RoryAlsop funny, I blame old age and an empty brain

Jeff Ferland

@AviD You've got it.

AviD

have you seen this q, @Jeff?

9

Q: How to secure a MongoDB instance?

Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.

hardening databases mongodb

which nosql have you experienced?

Jeff Ferland

@AviD Yeah, I think I remember that one. Don't see anything I can really add to it.

AviD

Feb 20, 2012 14:43

@JeffFerland well, the accepted answer seems very generic, and not really applying to the specific technology

e.g. the two main bullets re authn/z

Jeff Ferland

@AviD Mongo and Cassandra.

AviD

@JeffFerland excellent. In general, you have any comparison notes?

subjectively, of course.

Jeff Ferland

A few quick metrics:

Setup: both are pretty easy, though Mongo is more brain-dead simple.

Arch: Cassandra is pretty much key->value, or "flat hash" storage that does really well at eventually propagating to many machines. Mongo allow hierarchies and has more play with indexing.

AviD

@JeffFerland interesting

Jeff Ferland

General feeling: coin flip unless your architecture in your head already fits one or the other. I like the nested structure of mongo, but I'm also partial to just about every Apache data project (Hadoop and such).

AviD

Feb 20, 2012 14:50

@JeffFerland and security feeling?

Jeff Ferland

@AviD Equally minimalist. Either one would take modification to establish the usual practices we'd recommend for app design. They weighted performance more than anything else.

AviD

@JeffFerland thanks

Jeff Ferland

Maybe a nudge to Cassandra for the API exposure.

AviD

question is, should we be changing our "usual practices for app design", for nosql products/philosophy?

Jeff Ferland

@AviD I call it a back-to-basics thing. Risk, exposure, cost, etc. If you're aware and you accept the risk in trade for performance, then OK. Otherwise, find the more expensive solution whether it be in programming time or slower traditional SQL systems.

AviD

Feb 20, 2012 14:54

@JeffFerland heh. fair enough.

Jeff Ferland

I personally think the proxy thing can give very fast performance... can be deployed on every server node with low overhead... auth + log + pass onward while being non-blocking.

AviD

so you're saying, ignore the technical details we've learned, relearned, and can spout in our sleep, regarding securing DB's - go back to principles, and build up the technical details all over.

2

Jeff Ferland

@AviD Yes! Good rephrase.

AviD

great, so we're in agreement.

The DMZ

Participants