Using Roles and Partial Revokes To Improve Security in MySQL 8.0
summary
Demonstrates that MySQL 8.0 (since 8.0.16) and Amazon Aurora MySQL 3 use partial revokes, roles and split SUPER into dynamic privileges so an app can be granted everything except the mysql system database. Shows restoring dumps no longer requires painful regex edits by using the set user id dynamic privilege. Live demos grant-all-then-revoke prevents updating mysql.user and blocks privilege escalation, and Aurora RDS applies the same role-based defaults successfully.
AI-written summary · about
chapters (12)
- 0:00Start
- 1:37Mysql Security
- 2:25Sql Injection
- 6:08Multi-Tenant Approach
- 12:57Partial Revokes Roles and Dynamic Privileges
- 14:14Restrict an Access to the Mysql
- 19:49Split of the Super Privilege
- 20:28Dynamic Privileges
- 23:25Restoring Mysql Backups
- 25:53Role-Based Authentication
- 26:11Role-Based Authentication and Dynamic Privileges
- 31:22Conclusions
related talks
19mMariaDB Roles
41mState of MySQL Security in 2021
22mAn Overview of Security Features in MySQL 5.7
53mWhy are we excited about MySQL 8?
42mData Security using Roles, Privileges and Row Level Security
44mMySQL Administration 101
55mMySQL 8.0: Not Only Good, it's GREAT
40mPostgreSQL Security for Application Developers