New encryption capabilities in MongoDB 4.2: A deep dive into protecting sensitive workloads Agenda • A brief history of database security • Trust models: server vs. client • Encrypting data-in-use • Hands on deep dive • Q&A
A brief history of database security Against whom/what are we defending? • “hackers”? • criminal blackhats? • competitors? • activists? • unknown actors?
A brief history of database security Against whom/what are we defending? • “hackers”? • criminal blackhats? • competitors? • activists? • unknown actors? • insiders?
A brief history of database security Against whom/what are we defending? • “hackers”? • criminal blackhats? • competitors? • activists? • unknown actors? • insiders? • admins?
A brief history of database security Every sector of the global economy has been impacted • enterprise • consumer tech • retail • government • healthcare • finance …
A brief history of database security Major shifts in regulatory & privacy climate • GDPR • HIPAA • PCI DSS • NIST/FISMA • Consumer protection • State & provincial
A brief history of database security System architect & developer security challenges Meeting legal/regulatory obligations • Controls • Audit/attestation
A brief history of database security System architect & developer security challenges Meeting legal/regulatory obligations • Controls • Audit/attestation Defending real-world attacks • First Principles: C/I/A • Separation of duties • Access control • Identifying & protecting sensitive data
A brief history of database security System architects & develop security challenges Meeting legal/regulatory obligations • Controls • Audit/attestation Defending real-world attacks • First Principles: C/I/A • Separation of duties • Access control • Identifying & protecting sensitive data
Trust models: server vs. client What is the source of trust? • Traditionally, DB encryption has relied on server-side trust • This has implications, many not so obvious
Trust models: server vs. client What is the source of trust? • Traditionally, DB encryption has relied on server-side trust • This has implications, many not so obvious • With a few caveats, the database operator typically has unrestricted technical access, including: • DBAs • system admins • hosting/infrastructure providers
Trust models: server vs. client What is the source of trust? • In a server-side encryption model, a leak or breach can be catastrophic • This potentially includes: logs, backups, temp files, process memory…
Trust models: server vs. client What is the source of trust? • In a server-side encryption model, a leak or breach can be catastrophic • This potentially includes: logs, backups, temp files, process memory… • They who hold the keys controls the kingdom
Trust models: server vs. client A common pain for system architects • Most notably in healthcare, finance, and consumer tech • The benefits of managed, easily expanded compute & cloud storage have often been considered out of reach because of data confidentiality & privacy concerns.
Encrypting Data-in-Use Introducing MongoDB Client-Side Field-Level Encryption • major investment • 2 years in the making • 18+ engineers spanning core server, query, security, cloud, drivers • targeting 12+ languages • all major hardware & operating system platforms • Linux, MacOS, Windows
MongoDB Client-Side Field-Level Encryption Core design • CSFLE is enabled in drivers & integrated into shell • All encryption/decryption is done in the driver, on the client • Drivers have expanded MQL awareness for automatic encryption • Individual fields within collections can be marked as encrypted • Keys can be used on a per-field or even per-document basis
MongoDB Client-Side Field-Level Encryption Implementation • Extends existing JSON Schema with new “encrypt” property • Schema validation extended client-side • Key management services natively integrated into drivers • KMS envelope encryption used to protect field data keys • Server only sees encrypted binary data (BinData subtype-6)
MongoDB Client-Side Field-Level Encryption Cryptography • Raw key material never persisted to disk (in-memory only) • Stored field keys protected by strong symmetric encryption • Field wrapping keys secured in HSM-backed external KMS • Key service master key rotation: scheduled or on-demand • Core constructions are Post-Quantum secure • Engaged with expert cryptography teams on design & security properties, and conducted independent security assessments
Client-Side Field Level Encryption Step by Step Step 1: Identify fields to encrypt Step 2: Set JSON data types & key(s) for encrypted fields Step 3: Create a new Mongo session with encryption options
Client-Side Field Level Encryption Step by Step Step 1: Identify fields to encrypt Step 2: Set JSON data types & key(s) for encrypted fields Step 3: Create a new Mongo session with encryption options Step 4: Run your queries.
Client-Side Field Level Encryption Step by Step Step 1: Identify fields to encrypt Step 2: Set JSON data types & key(s) for encrypted fields Step 3: Create a new mongo session with encryption options Step 4: Run your queries. (That’s it)
Example: Direct query on an encrypted field encryptedDb.patients.find({"ssn": "901-01-0001" }) encryptedDb.patients.find({ "ssn": BinData(6,"ASV2YBzOhUY…" )})
MongoDB Client-Side Field-Level Encryption Recap • Run anywhere: Atlas, self-managed cloud, GovCloud, local • Targeting all supported drivers on all supported platforms • Encrypt at the collection-, field-, or document-level • Search on encrypted fields • Subdocuments, objects and aggregation pipeline support • Multiple enforcement options (client-side, server-side, or both) • Backwards compatible with existing admin & cluster tools
MongoDB Client-Side Field-Level Encryption Roadmap • Beta preview now – Java, Node.js, C# .Net, Python, Go • Server support on Atlas 4.2 clusters now • Shell update in flight • Additional language beta previews in coming weeks • 3rd party cryptography reviews & security assessments complete
kwhite
bnasslahsen
jordihofc
hayaosuzuki
tarappo
spinscale
jfg956
charmichokshi
shimap_sampo
yuya4
microcms
.jpg){kind=avatar}
hiro_torii
iselegant
philhawksworth
rmw
malarkey
jnunemaker
maltzj
frogandcode
samlambert
morganepeng
andyhume
dougneiner
marktimemedia
sugarenia