SecurityMiniFest

Security is sometimes used as a pretext for rude behaviour towards customers and users. At other times, security as a buzzword is used to scare customers into buying things they don't need. Neither of these approaches are applicable to the Security edition of MariaDB Server Fest.

Our approach is to give you as short an overview as possible, for you to take the necessary steps to secure your MariaDB Server database against real-world threats.

Our Server Fest starts with an intro by MariaDB's long-standing Mr Security – Sergei Golubchik. He has had many crucial roles within MariaDB and before that MySQL, but one of them that he has had for over 20 years is to react to incoming security@ emails. With two decades of dealing with vulnerabilities under his belt, he is the best possible starting point for the Security Server Fest. He introduces the MariaDB features that a user needs to secure their MariaDB database, but his approach is not feature-centered – rather, he teaches users to ask the right security related questions and to provide answers for them.

Our second presentation is by Seppo Jaakola of Codership, extending the security topic to Galera Cluster. It covers the added complexities provide by a cluster setup, including encryption of data at rest and data moving between the replication nodes.

The short Server Fest is concluded by a presentation which widens the scope away from a pure MariaDB-centric view. It's delivered by Jeff Hardy, a security specialist from Acronis, interviewed by Vicentiu Ciorbaru of MariaDB Foundation. Jeff's approach is one of economy: What is the cost of implementing security, what is the cost of a breach? To gain a better undertanding, Jeff asks the same questions also from the opposite side: What does an attacker have to gain, and what to lose?

With this brief three-prong approach, we hope the MariaDB Server users watching will leave the Server Fest enlightened and ready to secure their installations.

*Sergei Golubchik's presentation: *
This talk will introduce the MariaDB features that a user needs to secure their MariaDB database. Its objective is to teach users to ask the right security related questions and to provide answers for them. Some topics include:

*an introduction into security features in MariaDB Server
*how the features can be used to secure their database
*places where a user can find more information about security related issues

Seppo Jaakola's presentation:
This presentation is about securing communication in MariaDB Galera Cluster and will touch upon the following topics:

*Client-server TLS configuration
*TLS configuration for Cluster replication
*TLS configuration for SST transfers
*Complete data at rest encryption through Galera cache encryption
*Node IP allowlist for limiting new node joining into cluster


Vicentiu's and Jeff Hardy's presentation:
In this talk, Jeff Hardy will be tackling the economical aspects of security. When it comes to protecting systems from attacks, it is worthy of considering the economical impact of a breach. Both from the victim perspective as well as from the attackers’: what do I have to lose vs what do I have to gain.

With this in mind, Jeff will present a novel way of thinking about security, and provide a set of rules to follow to create a better security culture in all enterprises, big and small. During this talk Jeff will be accompanied by Vicențiu Ciorbaru, who will ask critical questions, especially when it comes to MariaDB deployments and their impact on the whole security picture.