06 - Data Security

Question 1

Data Security

Answer 1

• Authentication - prove who you are
• Authorization - determine what you can do

Question 2

Encryption in Transit

Answer 2

• SSL/TLS is available can be mandatory

Question 3

Encryption at Rest

Answer 3

• RDS supports EBS volume encryption - KMS
• AWS or customer managed keys
• Storage, Logs, Snapshots and replicas encrypted

Question 4

Microsoft SQL and RDS Oracle support TDE

Answer 4

• TDE = Transparent data encryption
• Encryption within DB engine

Question 5

RDS Oracle also supports

Answer 5

• integration with CloudHSM

Question 6

Securing the database

Answer 6

• Normally DB contain usernames and passwords for access.
• IAM
  
  • Can be integrated with IAM for this purpose
  • IAM users and roles with policy
• Policy
  
  • Policy contains mapping local RDS user
• Tokens
  
  • Token generated to allow access to RDS
  • Tokens are only for AUTHENTICATION
  • Authorization is handled internally to the DB.