MySQL Secured by SG​

ONE-CLICK DEPLOYMENT | ENCRYPT DATA TRANSPARENTLY
ELIMINATE CONFIGURATION MISTAKES | ACHIEVE COMPLIANCE EASILY

The MySQL Secured by SG is a ready-to-deploy, Shielded MySQL instance for Google Cloud Platform users who are looking for an additional layer of data security.
MySQL

MySQL SECURED BY SG​

BENEFITS
  • Encrypt MySQL Data Transparently
  • Reduce OS Attacks With JeOS
  • Protect MySQL Data Against Malicious “root’ User
  • Generate Tamper-Resistant Logs
  • Use VM With Built-in Security

> Virtual Appliance

The MySQL Secured by SG is a ready-to-deploy MySQL server instance for Google customers who are looking for an additional layer of data security.

The instance encrypts the MySQL data, controls access so that a malicious “root” can’t access MySQL data, and generates tamper-resistant logs.

You control your own data encryption key while we make sure that it is available when you need it.

This self protecting MySQL server instance uses advanced security techniques such as Secure Boot, vTPM, UEFI firmware, integrity monitoring at the virtualization layer and transparent encryption, extended access controls, tamper-resistant logs at the data layer in order to protect the MySQL data against unauthorized access.

 

Enterprise-grade Data Security and Compliance

Main Features

Transparent Encryption

The MySQL data is transparently encrypted at the file-system layer before it hits the disk. This in-kernel is quick. You are in control of your data encryption key while we help you store it in our managed key locker so it is available when you need it.

Reduced Attack Surface

The instance uses a trimmed down version of the OS thereby reducing the attack surface significantly. The total footprint that includes the OS, MySQL server and our security software is around 850MB.

Protection Against Unauthorized Users

Advanced access controls makes it difficult for unauthorized users, including the “root” user, from accessing the protected data sets in clear-text.

Tamper-resistant Logs

Every Server General operation is logged at four different locations in order to nullify log tampering attempts. All privileged operations conducted by the MySQL Secured by SG administrators are logged within and outside of the administrative domain of our customers. This feature provides non-repudiation and is heavily relied upon by auditors. In fact each Server General command is stored at four different locations.

Based On Open-Source

MySQL Secured By SG uses standard encryption functionality embedded within the mainstream Linux kernel. This functionality is based on a stackable file system that was developed by Erez Zadok, CTO, Server General Inc.

CIS Compliant MySQL Server

The MySQL server installed on the instance complies with security recommendations made by the Center of Internet Security (CIS).

Download Sheet

Virtual Instance Security

The instance uses "Secure Boot" to make sure that only authenticated software is installed at the OS layer.

Integrity Monitoring

Remote attacks, privilege escalation and insider attacks are prevented with help of integrity monitoring.

Role-Based Management

Many solutions cling to old security concepts that result in misplaced trust in the network/system administrator. This completely defies application’s access control logic as intended by the application vendor thereby exposing the application data to a whole host of attacks. MySQL Secured by SG segregates management responsibilities based on roles in order to safeguard data.

How Does it Work?

  • Select Instance Type
    Change machine configuration
  • Install Instance
    Install your instance
  • Run A Script
    Log in and run a shell script
    Change security officer's passphrase
    Change data administrator's passphrase
  • Check
    That your MySQL data is encrypted
    That you can still access data in clear text
  • Manage Your Instance
    Reboot
    Start the security policy after every reboot
    Rotate data encryption keys when needed
  • Application
    Your web application should be able to access the MySQL data without any changes even though the data is encrypted on the disk
  • That’s It
    Your MySQL is fully protected now.

Technology

The core components of MySQL Secured By SG are a data encryption engine, a key management engine, an access control engine, and a reporting engine. Each component performs a critical function in securing sensitive information and collectively they provide active countermeasures against various types of attack vectors.

A high-performance Data Encryption Engine is employed to provide strong encryption for all writes, and decryption for all reads. The application server data is encrypted at the file-system layer using the AES algorithm. This in- kernel data encryption is quick, transparent and you control the data encryption keys while we help you manage them.

Data encryption  protects against theft of media, data images – even if intruders are able to obtain physical or electronic copies of data. The stolen data would be unusable without the decryption keys. Any probing of files would only yield blocks of ciphertext. 

The Key Management Engine allows our customers to control their own encryption keys at all times. The encryption keys are stored in one or more key lockers deployed within the Server General global key management infrastructure. The encryption keys are themselves wrapped in another layer of encryption using a master key (a passphrase) that is only known to the data owner. This way only cipher blobs are stored in key lockers preventing other parties from deciphering them. The key management system allows customers to generate strong keys, rotate them on-demand, revoke any key at any time and store them in a secure location. Our security staff ensures their availability.

The Access Control Engine provides industrial strength identification and authentication mechanism that results in reduction of the ‘trust domain’. Only authorized Server General administrators are able to access administrative functions: this one measure reduces the risk posed by rogue systems administrators (or any other entity that has progressed beyond perimeter security). The access control engine allows only authorized users to access the protected data sets.

The Logging Engine logs every administrative operation related to Server General. The logs are stored at four different locations - on the host server and remotely within our cloud infrastructure. These logs provide crucial information during a security audit. In case of a regular server, an external or a malicious internal user may gain unauthorized access to the sensitive data – then perform acts to conceal the breach by removing or editing audit logs. However, this is not possible with Server General, as logs are stored outside the administrative domain of the compromised entity.

Data Security

VM Security​

START TODAY

MySQL Secured by SG