Benefits of MySQL Enterprise Edition

MySQL Enterprise Edition
Achieve the Highest Levels of Performance & Security
Olivier Dasini
MySQL Cloud Principal Solutions Architect EMEA
[email protected]
Blogs : www.dasini.net/blog/en
: www.dasini.net/blog/fr
Linkedin : www.linkedin.com/in/olivier-dasini
Twitter : @freshdaz

View Slide

Safe harbor statement
The following is intended to outline our general product direction. It is intended for information
purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any
material, code, or functionality, and should not be relied upon in making purchasing decisions. The
development, release, timing, and pricing of any features or functionality described for Oracle’s
products may change and remains at the sole discretion of Oracle Corporation.
© 2022 Oracle MySQL

View Slide

3 © 2022 Oracle MySQL
Me, Myself & I

MySQL Geek
 Addicted to MySQL for 15+ years
 Playing with databases for 20+ years

MySQL Writer, Blogger and Speaker
 Also former : DBA, Consultant, Architect, Trainer, ...

MySQL Cloud Principal Solutions Architect EMEA at Oracle

Stay up to date!
 Blog: www.dasini.net/blog/en
 Linkedin: www.linkedin.com/in/olivier-dasini/
 Twitter: @freshdaz
3
Olivier DASINI
© 2022 Oracle MySQL

View Slide

Case Studies

View Slide

Case Studies
 SQUARE ENIX reduced database backup time with MySQL Enterprise Edition to 1/6th to offer
superb game environment for users worldwide
– https://www.mysql.com/why-mysql/case-studies/square-enix-reduced-database-backup-time-mysql-enterprise-editionl/
 The BBC ensures World-class broadcasting service
– https://www.mysql.com/why-mysql/case-studies/bbc-broadcasting-mysql-enterprise-edition.html
 BBC Ensures High Availability with MySQL
– https://www.youtube.com/watch?v=q33Gfc5AdTs
https://www.mysql.com/why-mysql/case-studies/

View Slide

The world’s most popular open source database

View Slide

Some Of Our Customers
 MySQL powers the most demanding Web, E-commerce, SaaS and Online Transaction Processing
(OLTP) applications
 It is a fully integrated transaction-safe, ACID compliant database with full commit, rollback, crash
recovery and row level locking capabilities
 MySQL delivers the ease of use, scalability, and performance to power:
Reliability, high-performance, and ease of use

View Slide

Innovating & Evolving

View Slide

Our Server Usability Guidelines
« As well adding new features, our goal in the server team is to make MySQL easier to use.
We try to design features with the goal of making a net improvement on usability. »

View Slide

MySQL 8.0 Enables Modern Web Applications
Scalable & Stable
Better handling of high
contention, improved security,
and minimizing downtime
Data Driven
Optimizing services with real
time data analysis
Developer First
Hybrid data model and data
access APIs for flexibility for
developers
Mobile Friendly
Ready for location based
services. Handling Emoji
and Unicode characters
24
x
7
at Scale

View Slide

Innovating And Evolving
 MySQL JSON Document Store
– SQL + NoSQL = MySQL
– Combining Relational & Document
Stores Workloads
 HA & DR made easy
– MySQL InnoDB Cluster
– MySQL InnoDB ReplicaSet
– MySQL InnoDB ClusterSet
 MySQL Shell
– Interface for Development and
Administration of MySQL
 MySQL Operator for Kubernetes
– Manage MySQL InnoDB Cluster inside
a Kubernetes Cluster
– Provide MySQL Official Docker Images
 Performance / Scalability
 Reliability
 Geo Spatial (GIS)
 Security
 ...

View Slide

Security Improvements (summary)
 AES 256 Encryption now the default
 Password rotation policies
 Password history (not reuse old ones)
 Deployment: enable secure unattended
install by default
– Random password set on install
– Remove anonymous accounts
– Deployment without test account, schema,
demo files
 Easier instance initialization and setup:
mysqld --initialize
 New detection and support for systemd
 MySQL Roles
– Improving MySQL Access Controls
 SSL
– Enabled by default
– Auto-detection of existing keys and certs
– Auto generation of keys and certs when
needed
– New helper utility: mysql_ssl_rsa_setup
– New --require_secure_transport option to
prevent insecure communications
– Added SSL support to binary log clients
 Extended Proxy User Support
– Added Built-in Authentication Plugins support
for Proxy Users
– Allows multiple users to share a single set of
managed privileges
 File, Tablespace & Log Encryption
– AES 256 logs & tablespaces encryption at rest

View Slide

14 © 2022 Oracle MySQL https://www.youtube.com/watch?v=CtRIc6Hsia8

View Slide

Oracle Premier
Lifetime Support
Oracle Product
Certifications/Integrations
MySQL Enterprise
High Availability
MySQL Enterprise
Security
MySQL Enterprise
Scalability
MySQL Enterprise
Backup
MySQL Enterprise
Monitor/Query Analyzer
MySQL Enterprise
Audit
Highest Levels of MySQL Security, Manageability and Reliability

View Slide

Management Tools
Advanced Features Support
• Authentication
• Audit
• Encryption / TDE
• Firewall
• Data Masking
• High Availability
• Monitoring
• Backup
• Development
• Administration
• Migration
• Technical Support
• Consultative Support
• Oracle Certifications
Reduce the risk, complexity and cost

View Slide

MySQL Enterprise Monitor
17 © 2022 Oracle MySQL https://www.mysql.com/products/enterprise/monitor.html

View Slide

 See a central view of the complete MySQL env
 Real-time MySQL performance and availability monitoring
 Visually find & fix problem queries with the Query Analyzer
 Alerts through email or text message
 Disk monitoring for capacity planning
 Replications monitoring
 Role based access controls
 Cloud friendly architecture
– No agents required
– Policy driven configuration
– Easy integration with DevOps tools
A DBA’s assistant: Visualize problems and tuning opportunities.

View Slide

MySQL Enterprise Monitor – Best Practice Advisors
 Enforce MySQL best practices
 14 Advisor categories
 250+ Advisors
 Threshold-based alerts
– Exponential moving averages
– Rate change detection
 Expert problem resolution advice
Provide a set of rules designed to enforce MySQL best practices
“I definitely recommend the MySQL Enterprise Monitor to DBAs who don't have a ton of
MySQL experience. It makes monitoring MySQL security, performance and availability very
easy to understand and to act on.”
Sandi Barr
Sr. Software Engineer
Schneider Electric

View Slide

 Easily ensure all your MySQL assets are hardened and secure
– Identify vulnerabilities
 Manage MySQL Enterprise Firewall
– Protect MySQL assets from SQL injection attacks and other common threats
 Manage MySQL Enterprise Audit
– Ensure regulatory compliance & Know what happened when things go wrong
 Change monitoring and tracking
– Configuration Management & Tuning Advice
 Backup policy enforcement
 Centralized user management
Security
A DBA’s assistant : Notify problems and tuning opportunities

View Slide

MySQL Enterprise Monitor – Query Analyzer
 Real-time query performance
 Visual correlation graphs
 Find & fix expensive queries
 Detailed query statistics
 Query Response Time index (QRTi)
– "Quality of Service" (QoS) measurement for each query
– QoS measurement for a server, group, or every instance
– Single metric for query performance
Visual Query Analysis for troubleshooting
“With the MySQL Query Analyzer, we were able to identify and analyze
problematic SQL code, and triple our database performance.
More importantly, we were able to accomplish this in three days,
rather than taking weeks.”
Keith Souhrada
Software Development Engineer
Big Fish Games

View Slide

MySQL Enterprise Monitor – Replication Dashboard
 Source/Replica and Group Replication
 Auto-discovers replication topology
– High level overviews of all instances
– User centric views on individual sets
 Performance monitoring
 Replication advisors
 Best practice replication advice
Display detailed instrumentation available & the current configuration

View Slide

MySQL Enterprise Monitor – NDB Cluster Support
 Auto discovery and grouping of NDB processes
– ndbapi
– ndb_mgmd
– ndbd/ndbmtd
 Visual cluster topology
 New reports and graphs
 New advisors
Visibility into the performance, availability, and health of the cluster

View Slide

MySQL Enterprise Monitor – Backup Dashboard
 Monitor backup usage and health
– Across your entire datacenter
 Drill into backup job details
– Allowing for easy backup recovery
 Supports all backup types
 Alerting on significant events
– Poor backup performance
– Backup job failures
– Out of date backups
Provide key visibility into critical backup activities

View Slide

MySQL Enterprise Backup
25 © 2022 Oracle MySQL https://www.mysql.com/products/enterprise/backup.html

View Slide

MySQL Enterprise Backup
 Online, non-locking backup and recovery
– Complete MySQL instance backup (data and config)
– Full & Partial backup and restore
 Direct Cloud storage backups (OCI, S3, etc.)
 Incremental backups & Point-in-time recovery
 Advanced compressed and Strong encryption: AES 256
 Backup to tape (SBT)
 Backup validation
 Optimistic backups
 Cross-Platform (Windows, Linux, Unix)
 Certified with Oracle Secure Backup, NetBackup, Tivoli, ...
Ensure availability of end-user data

View Slide

MySQL Enterprise Audit
27 © 2022 Oracle MySQL https://www.mysql.com/products/enterprise/audit.html

View Slide

Help implement stronger security controls & satisfy regulatory compliance
1. DBA Enables Audit Plugin
• Defines Filters and Options
• Who, What, Where, When, How
Audit File
(XML or JSON format)
2. User Connects from a Host
• Authenticates
• Runs Queries
• Alters Tables, etc.
3. DBA Reviews Local Audit Events
• MySQL Workbench EE
• Or other JSON/XML viewer
4. IT Sec Archives to Audit Vault
• Globally Assesses Audit Trail
www.dasini.net/blog/2018/04/04/mysql-security-mysql-enterprise-audit/

View Slide

Help implement stronger security controls & satisfy regulatory compliance
 Out-of-the-box logging of connections, logins, and query
 Auditing for Security & Compliance
– GDPR, PCI DSS, Sarbanes-Oxley, HIPAA, FIPS, ...
 You see who has done what - connections, logins, and queries (works with firewall)
 Secure SQL Access to audit events
 Simple to fine grained policies for filtering, and log rotation
 Dynamically enabled, disabled: no server restart
 Send data to a remote server / audit data vault
– Oracle Audit Vault, Splunk, etc.
– Custom Settings
●
XML and JSON audit stream formatting options
●
Compression & Encryption
●
Remote Read Only SQL statement access
Adds regulatory compliance to
MySQL applications
(GDPR, HIPAA, PCI DSS, etc.)
Adds regulatory compliance to
MySQL applications
(GDPR, HIPAA, PCI DSS, etc.)
www.dasini.net/blog/2018/04/04/mysql-security-mysql-enterprise-audit/

View Slide

MySQL Enterprise TDE
T
Transparent D
Data E
Encryption
30 © 2022 Oracle MySQL https://www.mysql.com/products/enterprise/tde.html

View Slide

MySQL Enterprise Transparent Data Encryption (TDE)
Protects against Attacks on Database Files
MySQL Database
Encrypted
Tablespace Files
Undo/Redo logs
Shared Tablespaces
Binary & Relay logs
Protected
Key
Hacker /
Dishonest OS User
Accesses
Files Directly
Information
Access Blocked
By Encryption
Keyring plugin - used to retrieve
keys from Key Stores over
Standardized KMIP protocol
www.dasini.net/blog/2018/04/10/mysql-security-mysql-enterprise-transparent-data-encryption/

View Slide

 Data at Rest Encryption
– [System | General | Data Dictionary] Tablespaces, Undo/Redo & Binary/Relay logs, Storage, OS File system
– Policy to enforce table encryption
– Strong Encryption – AES 256
 Transparent to applications and users
– No application code, schema or data type changes
 Transparent to DBAs
– Keys are hidden from DBAs, no configuration changes
 Requires Key Management
– Protection, rotation, storage, recovery
Protects against Attacks on Database Files
www.dasini.net/blog/2018/04/10/mysql-security-mysql-enterprise-transparent-data-encryption/

View Slide

 KMIP – Key Management Interoperability
Protocol (Oasis Standard)
– Keys are protected and secure
 KMIP mode tested with the following products
– Oracle Key Vault (OKV)
– Oracle Cloud Infrastructure Vault
– HashiCorp Vault
– Thales Enterprise Key Management
– Fornetix Key Orchestration Appliance
– Townsend Alliance Key Manager
 Enables customers to meet regulatory
requirements
KMIP Compliant
 Additional Options
– Key Ring File
– Encrypted Key Ring File
Also
– Oracle Cloud Infrastructure Vault (OCI)
– Cloud Key Services (AWS)
 https://dev.mysql.com/doc/refman/8.0/en/keyring.html

View Slide

At Rest Encryption Covers
 InnoDB Tables and Tablespace
– File Per Table Tablespace or General (Multi-Table) Tablespace
 MySQL System Tablespace
– Data Dictionary Tables
 Binlog Encryption
 MySQL Enteprise Audit Logs
 MySQL Enterprise Backup Files
 Note: DBAs can optionally force Table Encryption
– i.e. Users can only create encrypted tables

View Slide

MySQL Enterprise Firewall
35 © 2022 Oracle MySQL https://www.mysql.com/products/enterprise/firewall.html

View Slide

Guard against cyber security threats
 Block SQL Injection Attacks
– Allow: SQL Statements that match Allowlist
– Block: SQL statements that are not on Allowlist
 Intrusion Detection System
– Detect: SQL statements that are not on Allowlist
●
SQL Statements execute and alert administrators
Select * from employee where id=22
Select * from employee where id=22 or 1=1
or 1=1 Block
✖
Allow
✔
AllowList
Applications
Detect & Alert
Intrusion Detection
Rule
www.dasini.net/blog/2018/04/16/mysql-security-mysql-enterprise-firewall/

View Slide

 Real Time Protection
– Queries checked against Allowlist and Firewall Rules
 Blocks SQL Injection Attacks
– Block Out of Policy Transactions
 Intrusion Detection
– Detect and Alert on Out of Policy Transactions
 Automated Allowlist
– Learning mode for creation of approved list of SQL command patterns on a per user basis
 Custom Rules – using Powerful JSON definitions
 Transparent
– No changes to application required
MySQL Enterprise Firewall monitoring
using MySQL Enterprise Monitor
www.dasini.net/blog/2018/04/16/mysql-security-mysql-enterprise-firewall/

View Slide

MySQL Enterprise Firewal
 Combined Firewall/Audit Rules
– Create more general allow/deny firewall rules using JSON syntax – using abort=on
Example - block execution of specific
 SQL statements (insert, update, delete)
 For a specific table (finances.bank_account)
Test rules
 By writing to audit log
 If data as expected change to firewall
– add “abort”

View Slide

MySQL Enterprise
Data Masking & De-Identification
https://www.mysql.com/products/enterprise/masking.html

View Slide

MySQL Enterprise Masking & De-Identification
Help protect sensitive data from unauthorized uses

View Slide

 Data Masking
– String masking
– Dictionary based replacement
– Specific masking
●
SSN
●
Payment card : Strict/Relaxed
 Random Data Generator
– Random number within a range
– Email
– Payment card (Luhn check compliant)
– SSN
– Dictionary based generation
www.dasini.net/blog/2019/03/19/mysql-security-mysql-enterprise-data-masking-and-de-identification/

View Slide

 Data Masking and De-identification helps database customers improve security
 Accelerates compliance for
– Government – GDPR, CHHS
– Financial - PCI
– Healthcare – HIPAA, Clinic Trials Data
 Reduce IT costs by simplifying sanitizing production data
– Transforming sensitive data for use in analytics, testing, development, and more
www.dasini.net/blog/2019/03/19/mysql-security-mysql-enterprise-data-masking-and-de-identification/

View Slide

MySQL Enterprise Encryption
43 © 2022 Oracle MySQL https://www.mysql.com/products/enterprise/encryption.html

View Slide

Industry standard functionality for asymmetric encryption

View Slide

 Set of encryption functions based on the OpenSSL library
that expose OpenSSL capabilities at the SQL level
 MySQL encryption functions
– Symmetric encryption AES256 (All Editions)
– Public-key / asymmetric cryptography – RSA
 Key management functions
– Generate public and private keys
– Key exchange methods: DH
 Sign and verify data functions
– Cryptographic hashing for digital signing, verification, & validation – RSA,DSA
Industry standard functionality for asymmetric encryption

View Slide

MySQL Enterprise Authentication
46 © 2022 Oracle MySQL https://www.mysql.com/products/enterprise/security.html

View Slide

Ready to use external authentication modules to easily integrate existing security infrastructures

View Slide

 Integrate with Centralized Authentication Infrastructure
– Centralized Account Management
– Password Policy Management
– Groups & Roles
 PAM (Pluggable Authentication Modules)
– Native LDAP
●
Access native LDAP service for authentication
– Windows
●
Access native Windows service - Use to Authenticate users using Windows Active Directory or to a native host
– Linux PAM Standard interface (Unix, LDAP, Kerberos, others)
Ready to use external authentication modules to easily integrate existing security infrastructures
Integrates MySQL with existing
security infrastructures
Integrates MySQL with existing
security infrastructures

View Slide

MySQL Enterprise Scalability
(Thread Pool)
49 © 2022 Oracle MySQL https://www.mysql.com/products/enterprise/scalability.html

View Slide

MySQL Enterprise Scalability
Designed to reduce overhead in managing client connections and statement execution threads
 Limit the number of concurrently executing
transactions to ensure that each has sufficient CPU and
memory resources to fulfill its task
 Provides up to 60x better scalability
 A highly scalable thread-handling model designed to
reduce overhead in managing client connections and
statement execution threads
 Improves sustained performance as user connections
grow

View Slide

MySQL Workbench EE
 Database migrations
– From Microsoft SQL Server, PostgreSQL,
Sybase ASE, Sybase SQL Anywhere, SQLite,
Microsoft Access, and more
 Manage migration projects
 Source and target selection
 Object migration
 Data migration
 MySQL version upgrades
Database Migration Wizard
for SQL Server, Sybase, SQLite, Sybase & PostgreSQL

View Slide

Oracle Enterprise Manager for MySQL
 Availability monitoring
 Performance monitoring
 Configuration monitoring
 All available metrics collected
– Allowing for custom threshold based incident
reports
 MySQL auto-detection
 Versions 13.2.4.0.0+ supports MySQL 8.0.

View Slide

MySQL Enterprise Support
 Largest MySQL engineering and support organization
 Backed by the MySQL developers
 World-class support, in 29 languages
 Hot fixes & maintenance releases
 24x7x365
 Unlimited incidents
 Consultative support
 Global scale and reach
Get immediate help for any
MySQL issue, plus expert
advice
Get immediate help for any
MySQL issue, plus expert
advice
https://www.mysql.com/fr/support/

View Slide

MySQL Enterprise Consultative Support
 Remote troubleshooting
 Replication review
 Partitioning review
 Schema review
 Query review
 Performance tuning
 ...and more
54 © 2022 Oracle MySQL https://www.mysql.com/fr/support/consultative.html
Make the Most of your Deployments

View Slide

MySQL Security Overview

View Slide

MySQL Enterprise Security
 Assess
– MySQL Enterprise Monitor
 Prevent
– MySQL Enterprise Authentication
– MySQL Enterprise Firewall
– MySQL Enterprise TDE
– MySQL Enterprise Encryption
– MySQL Enterprise Data Masking
 Detect
– MySQL Enterprise Audit
 Recover
– MySQL Enterprise HA
– MySQL Enterprise Backup

View Slide

MySQL Security Achitecture

View Slide

 MySQL Enterprise Authentication
– External Authentication Modules
●
Microsoft AD, Linux PAMs, Native LDAP
 MySQL Enterprise Encryption
– Public/Private Key Cryptography
– Asymmetric Encryption
– Digital Signatures, Data Validation
 MySQL Enterprise Firewall
– Block SQL Injection Attacks
– Intrusion Detection
 MySQL Enterprise Audit
– User Activity Auditing, Regulatory Compliance
 MySQL Enterprise Monitor
– Changes in Database Configurations, Users
Permissions, Database Schema, Passwords
 MySQL Enterprise Backup
– Securing Backups, AES 256 encryption
 MySQL Enterprise TDE
– AES 256 encryption
– Key Management
 MySQL Enterprise De-Identification
– Data Masking and Obfuscation
– Formatted Data Randomization
– Pseudonymization, Data Blocklists
– Random Data generation
Designed to provide monitoring, online backup, as well as improved security and scalability
More information available at : http://www.mysql.com/products/enterprise/

View Slide

Resources – MySQL Blogs
• The complete list of new features in MySQL 8.0
– https://mysqlserverteam.com/the-complete-list-of-new-features-in-mysql-8-0/
• MySQL Server Team’s blog
– http://mysqlserverteam.com/
• MySQL High Availability Team’s blog
– http://mysqlhighavailability.com/
• MySQL Release Engineering Blog
– https://mysqlrelease.com/
• MySQL Dev Team Blog
– https://insidemysql.com/
• MySQL Enterprise Team Blogs
– https://blogs.oracle.com/mysql/
• Lefred’s blog (MySQL Community Manager)
– http://lefred.be/
• Olivier Dasini’s blog
– www.dasini.net/blog/
– https://www.youtube.com/channel/UC12TulyJsJZHoCmby3Nm3WQ

View Slide

• MySQL Document Store
– https://dev.mysql.com/doc/x-devapi-userguide/en/
– https://github.com/mysql/mysql-connector-nodejs
– https://www.npmjs.com/package/@mysql/xdevapi
– https://dev.mysql.com/doc/refman/8.0/en/document-store.html
– https://dev.mysql.com/doc/x-devapi-userguide/en/
– https://dev.mysql.com/doc/dev/connector-nodejs/8.0/
– https://www.mysql.com/news-and-events/web-seminars/mysql-document-store-and-node-js/
• MySQL Performance by Dimitri
– http://dimitrik.free.fr/blog/archives/2018/04/mysql-performance-over-18m-qps-with-80-ga-on-2s-skylake.html
– http://dimitrik.free.fr/blog/archives/2018/04/mysql-performance-80-and-utf8-impact.html
• MySQL InnoDB Cluster
– https://mysqlserverteam.com/mysql-innodb-cluster-8-0-ga-is-available-now/
– https://mysqlserverteam.com/mysql-innodb-cluster-whats-new-in-the-8-0-ga-release/
– https://mysqlserverteam.com/mysql-innodb-cluster-8-0-a-hands-on-tutorial/

View Slide

• Common Table Expressions (CTE)
– http://mysqlserverteam.com/mysql-8-0-labs-recursive-common-table-expressions-in-mysql-ctes/
– http://mysqlserverteam.com/mysql-8-0-labs-recursive-common-table-expressions-in-mysql-ctes-part-two-how-to-generate-series/
– http://mysqlserverteam.com/mysql-8-0-labs-recursive-common-table-expressions-in-mysql-ctes-part-three-hierarchies/
– http://mysqlserverteam.com/mysql-8-0-1-recursive-common-table-expressions-in-mysql-ctes-part-four-depth-first-or-breadth-first-traversal-transitive-
closure-cycle-avoidance/
• Window Functions
– http://mysqlserverteam.com/mysql-8-0-2-introducing-window-functions/
– https://mysqlserverteam.com/row-numbering-ranking-how-to-use-less-user-variables-in-mysql-queries/
– https://fr.slideshare.net/DagHWanvik/dublin-4x3finalslideshare-80423777
• Security
– https://www.mysql.com/news-and-events/web-seminars/checking-and-hardening-mysql-8-0-security-via-sql-and-without-os-access/
– https://mysqlserverteam.com/mysql-8-0-4-new-default-authentication-plugin-caching_sha2_password/
– http://lefred.be/content/mysql-8-0-listing-roles/
– https://dev.mysql.com/doc/refman/8.0/en/password-management.html
• Upgrade from 5.7 to 8.0
– https://mysqlserverteam.com/inplace-upgrade-from-mysql-5-7-to-mysql-8-0/
– https://mysqlserverteam.com/upgrading-to-mysql-8-0-here-is-what-you-need-to-know/

View Slide

Get Started Today!
MySQL Enterprise Edition Trial Contact a MySQL Sales Rep
http://www.mysql.com/trials/ http://www.mysql.com/about/contact/

View Slide

Follow us on Social Media
63

View Slide

Merci!
Q&R
Olivier Dasini
MySQL Cloud Principal Solutions Architect EMEA
[email protected]
Blogs : www.dasini.net/blog/en
: www.dasini.net/blog/fr
Linkedin : www.linkedin.com/in/olivier-dasini
Twitter : @freshdaz

View Slide

View Slide

Benefits of MySQL Enterprise Edition

Benefits of MySQL Enterprise Edition

Olivier DASINI

More Decks by Olivier DASINI

Other Decks in Technology

Featured

Transcript