MongoDB World 2019: Tutorial: A Journey to Magical Security Creatures’ Land
1 like199 views
The interactive presentation will use a metaphor, comparing security features to magical creatures, in that they both must be treated right. This game-based learning session will help audiences to understand the security features MongoDB has to offer and how to use them correctly.
![session.start_transaction()
order = { line_items : [ { item : 5, quantity: 6 }, …
] }
db.orders.insertOne( order, session=session );
for x in order.line_items:
db.inventory.update( { _id : x.item } ,
{ $inc : { number : -1 *
x.qty } },
session=session )
session.commit_transaction()
Code with title](https://image.slidesharecdn.com/beekmanday1900ammagicalmdbw19ella-190627211820/85/MongoDB-World-2019-Tutorial-A-Journey-to-Magical-Security-Creatures-Land-77-320.jpg)
![order = { line_items : [ { item : 5,
quantity : 6 },
… ] }
db.orders.insertOne( order );
for x in order.line_items:
db.inventory.update( { _id : x.item },
{ $inc : { number :
-1 * x.qty } })
Code comparison with title
session.start_transaction()
order = { line_items : [ { item : 5,
quantity: 6 }, … ] }
db.orders.insertOne( order, session=session
);
for x in order.line_items:
db.inventory.update( { _id : x.item } ,
{ $inc : { number : -1 * x.qty } },
session=session )
session.commit_transaction()](https://image.slidesharecdn.com/beekmanday1900ammagicalmdbw19ella-190627211820/85/MongoDB-World-2019-Tutorial-A-Journey-to-Magical-Security-Creatures-Land-78-320.jpg)
![session.start_transaction()
order = { line_items : [ { item : 5, quantity: 6 }, …
] }
db.orders.insertOne( order, session=session );
for x in order.line_items:
db.inventory.update( { _id : x.item } ,
{ $inc : { number : -1 *
x.qty } },
session=session )
session.commit_transaction()](https://image.slidesharecdn.com/beekmanday1900ammagicalmdbw19ella-190627211820/85/MongoDB-World-2019-Tutorial-A-Journey-to-Magical-Security-Creatures-Land-79-320.jpg)
Ad
More Related Content
What's hot (19)
Similar to MongoDB World 2019: Tutorial: A Journey to Magical Security Creatures’ Land (20)
Ad
More from MongoDB (20)
![MongoDB .local San Francisco 2020: Powering the new age data demands [Infosys]](https://cdn.slidesharecdn.com/ss_thumbnails/315pminfosysfinalsfoversionvocalpart1-200120221508-thumbnail.jpg?width=560&fit=bounds)
Ad
Recently uploaded (20)
MongoDB World 2019: Tutorial: A Journey to Magical Security Creatures’ Land
- 1. Ella Shurhavetsky Technical Services Engineer
- 2. A journey to magical security creatures’ land Ella Shurhavetsky, Technical Service Engineer, MongoDB
- 3. The flow Part One: The monster pack Part Two: How to stay secured
- 4. Know your benefits At the end of this presentation you will know - Your security options - When to use them
- 5. Part One: the monster pack
- 6. The monster pack Authentication SCRAM x.509 (Certificate based) LDAPS (Lightweight Directory Access Protocol Service) KERBEROS Authorization RBAC (Role Based Access Control) LDAPS (Lightweight Directory Access Protocol Service) Encryption At rest (Storage level encryption) At transit (TLS) Restricted Access IP Whitelists Auditing
- 7. The monster pack Authentication SCRAM x.509 (Certificate based) LDAPS (Lightweight Directory Access Protocol Service) KERBEROS Authorization RBAC (Role Based Access Control) LDAPS (Lightweight Directory Access Protocol Service) Encryption At rest (Storage level encryption) At transit (TLS) Restricted Access IP Whitelists Auditing
- 8. SCRAM Challenge-response mechanism for authenticating users with passwords, uses hash and salt to conceal the password MongoDB uses SHA1 and SHA256* with SCRAM mechanism against name, password and authentication database** Habitat: DB
- 9. x.509 The client can authenticate to the server, using certificates rather than username/password Server has to have a CA certificate to be able to ensure the authenticity of the client, trying to connect x.509 is a standard defining the format of public certificates Habitat: Admin DB
- 10. LDAPS LDAPS server stores users and roles (access permissions) It uses hierarchical structure Centralized repository to control resources, in case of MongoDB it’s the collections, databases, cluster, users etc. Can be used as authentication and authorization mechanism Habitat: LDAPS server, MongoDB configuration
- 11. KERBEROS Authentication protocol Uses tickets to authenticate users Avoids storing passwords locally or sending them over the internet Involves a trusted 3rd-party Built on symmetric-key cryptography Habitant: KERBEROS setup
- 12. The monster pack Authentication SCRAM x.509 (Certificate based) LDAPS (Lightweight Directory Access Protocol Service) KERBEROS Authorization RBAC (Role Based Access Control) LDAPS (Lightweight Directory Access Protocol Service) Encryption At rest (Storage level encryption) At transit (TLS) Restricted Access IP Whitelists Auditing
- 13. RBAC (Role Based Access Control) Authorization mechanism Within an organization, roles are created for various job functions Permission to perform certain actions on certain resources are assigned to a specific role Habitat: DB
- 14. LDAPS LDAPS server stores users and roles (access permissions) It uses hierarchical structure Centralized repository to control resources, in case of MongoDB it’s the collections, databases, cluster, users etc. Can be used as authentication and authorization mechanism Habitat: LDAPS server, MongoDB configuration
- 15. The monster pack Authentication SCRAM x.509 (Certificate based) LDAPS (Lightweight Directory Access Protocol Service) KERBEROS Authorization RBAC (Role Based Access Control) LDAPS (Lightweight Directory Access Protocol Service) Encryption At rest (Storage level encryption) At transit (TLS) Restricted Access IP Whitelists Auditing
- 16. Encryption at rest (Storage level encryption) Protects data by encrypting it with AES256-CBC* Stores encrypted data on disc Habitat: Storage
- 17. Encryption at transit (TLS) Communication security over computer network The secure connection is established using symmetric cryptography One time private key(shared secret) for each session Habitat: Network, cert store
- 18. The monster pack Authentication SCRAM x.509 (Certificate based) LDAPS (Lightweight Directory Access Protocol Service) KERBEROS Authorization RBAC (Role Based Access Control) LDAPS (Lightweight Directory Access Protocol Service) Encryption At rest (Storage level encryption) At transit (TLS) Restricted Access IP Whitelists Auditing
- 19. IP Whitelists IP whitelisting allows you to create lists of trusted IP addresses from which your users can access your domains IP whitelist is a security feature often used for limiting and controlling access only from trusted sources Habitat: Configuration
- 20. The monster pack Authentication SCRAM x.509 (Certificate based) LDAPS (Lightweight Directory Access Protocol Service) KERBEROS Authorization RBAC (Role Based Access Control) LDAPS (Lightweight Directory Access Protocol Service) Encryption At rest (Storage level encryption) At transit (TLS) Restricted Access IP Whitelists Auditing
- 21. Auditing Auditing allows administrators to track and log user activity on a MongoDB server Output can be file or console Once enabled, can record: -Schema (DDL) -Replica set and sharded cluster -Authentication and authorization -CRUD operations Habitant: Console or syslog or JSON/BSON file
- 24. The monster pack Authentication SCRAM x.509 (Certificate based) LDAPS (Lightweight Directory Access Protocol Service) KERBEROS Authorization RBAC (Role Based Access Control) LDAPS (Lightweight Directory Access Protocol Service) Encryption At rest (Storage level encryption) At transit (TLS) Restricted Access IP Whitelists Auditing
- 25. Part two: How to stay secured
- 26. Note: All the cases described based on real events, which took place in city of Monstropolis...
- 27. Scenario 1 - Roz (security chief) Roz is a head chief officer of security at “Monsters Inc.” The organization stores personal information about every single monster within the company. This information is highly sensitive and has to be protected from any unrestricted access. For example, there are pictures of all monsters going wild at the last corporate party. Company’s SysAdmin decided to move from paper files to MongoDB and store all the personal information and compromising photos in the database. It is highly important that the data will stay protected and secured. Roz has unlimited resources for this job. What kind of security setup would you advise in this case?
- 29. Recommended setup - KERBEROS + LDAP for authentication and authorization - Encryption at rest to protect data, using KMIP - TLS for encrypted traffic - Optional: Auditing
- 30. Scenario 2 - Mike and Sully After Mike and Sully figured out that much more energy can be drained from children’s laugh, they started a blog, writing all pranks and jokes that makes kids laugh. Blog’s data is stored in MongoDB Atlas solution. It does not have sensitive information, since the blog is already public. Mike and Sully don’t have more money to spend, so they can’t afford any additional service or a system administrator. What kind of security setup would you advice for Mike and Sully?
- 32. Recommended setup - Whitelist IPs - SCRAM - Encryption at rest (enabled by default in MongoDB Atlas)
- 33. Scenario 3 - Randall & Henry Waternoose III After Randall was kicked out of the “Monsters Inc.”, he and Henry decided they’ll follow all Sully and Mike moves to plan a revenge. They decided to use MongoDB, to store all data, they can find. No one has physical access to the database and the setup is not connected to the network. Randall only adds more documents. Henry has more DB knowledge, so he does all the administrative work What kind of security setup would you advice to Randall and Henry?
- 35. Recommended setup - SCRAM - RBAC - Encryption at rest
- 36. Thank you for joining the party
- 37. Presenter name or subtitle here – keep it to one line or 57 characters Title of the presentation goes here – keep title to two lines maximum and/or 112 characters with spaces SocialMedia
- 38. Use this title slide layout when there are two speakers Speaker One, Title Speaker Two, Title SocialMedia SocialMedia
- 39. Use this title slide layout when there are two speakers and speaker name and title need to go on two lines Speaker One, Title and/or Company Speaker Two, Title and/or Company SocialMediaSocialMedia
- 40. Title with content slide – Keep the title to two lines maximum or 91 characters with spaces First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. § Bullet one - use Paragraph > Increase List Level to add bullet § Bullet two – click Increase List Level again for 2nd level bullet § Bullet three
- 41. Titles on one line looks so much better First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. § Bullet one - use Paragraph > Increase List Level to add bullet § Bullet two – click Increase List Level again for next level bullet § Bullet three – click Increase List Level again for next level bullet
- 42. Title with content and subtitle Subtitle First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. § Bullet one - use Paragraph > Increase List Level to add bullet § Bullet two – click Increase List Level again for 2nd level bullet § Bullet three
- 43. Title with bar chart 1 4.3 2.5 3.5 4.5 2.4 4.4 1.8 2.8 2 2 3 5 Category 1 Category 2 Category 3 Category 4 Series 1 Series 2 Series 3
- 44. Title with bar chart 2 – use green to highlight MongoDB data 4.3 2.5 3.5 4.5 2.4 4.4 1.8 2.8 2 2 3 5 Category 1 Category 2 Category 3 Category 4 Series 1 Series 2 Series 3
- 45. Title with build animation bar chart 3 150 250 200 100 100 50 200 100 250 200 100 300 CATEGORY 1 CATEGORY 2 CATEGORY 3 CATEGORY 4 Series 1 Series 2 Series 3
- 46. Title with build animation doughnut cart 35% 15%15% 15% 10% 10% 1st Qtr 2nd Qtr 3rd Qtr 4th Qtr 5th Qtr 6th Qtr
- 47. Title and table 1 Column 1 Column 2 Column 3 Column 4 Column 5 Content Content Content Content Content Content Content Content Content Content Content Content Content Content Content Content Content Content Content Content Content Content Content Content Content
- 48. Title and table 2 Column 1 Column 2 Column 3 Column 4 Row 1 Content Content Content Content Row 2 Content Content Content Content Row 3 Content Content Content Content Row 4 Content Content Content Content Row 5 Content Content Content Content
- 49. Title two content First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. § Bullet one § Bullet § Bullet First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. § Bullet one § Bullet § Bullet
- 50. Title two content with subheads Subhead First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. Subhead First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content.
- 51. Title with doughnut chart and text 35% 15%15% 15% 10% 10% 1st Qtr 2nd Qtr 3rd Qtr 4th Qtr 5th Qtr 6th Qtr First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content.
- 52. Title three content First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content.
- 53. Title three content with subheads Subhead First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. Subhead First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. Subhead First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content.
- 54. Title four content First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content.
- 55. Title four content with subheads Subhead First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. Subhead First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. Subhead First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. Subhead First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content.
- 56. Title with content and big picture First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content.
- 57. Title left content right First line of copy is not bulleted. Use bold or green font treatment to place emphasize on content. Subhead
- 58. Timeline
- 59. Screenshot Slide
- 60. Title with infographic – 1 TITLE GOES HERE This is a sample text. You simply add your own text and description here. This text is fully editable. It can be replaced with your own style. TITLE GOES HERE This is a sample text. You simply add your own text and description here. This text is fully editable. It can be replaced with your own style. TITLE GOES HERE This is a sample text. You simply add your own text and description here. This text is fully editable. It can be replaced with your own style. TITLE GOES HERE This is a sample text. You simply add your own text and description here. This text is fully editable. It can be replaced with your own style. TITLE GOES HERE This is a sample text. You simply add your own text and description here. This text is fully editable. It can be replaced with your own style. TITLE GOES HERE This is a sample text. You simply add your own text and description here. This text is fully editable. It can be replaced with your own style.
- 61. Title with build animation infographic – 2 TITLE GOES HERE This is a sample text. You simply add your own text and description here. This text is fully editable. 40% TITLE GOES HERE This is a sample text. You simply add your own text and description here. This text is fully editable. 50% TITLE GOES HERE This is a sample text. You simply add your own text and description here. This text is fully editable. 70% TITLE GOES HERE This is a sample text. You simply add your own text and description here. This text is fully editable. 50% TITLE GOES HERE This is a sample text. You simply add your own text and description here. This text is fully editable. 90%
- 62. Statement or divider – Leaf
- 63. Statement or divider – Graphite
- 66. Eliot Horowitz CTO & Co-Founder
- 67. Eliot Horowitz CTO & Co-Founder
- 68. CTO & Co-Founder CTO & Co-Founder Eliot HorowitzEliot Horowitz
- 69. CTO & Co-Founder CTO & Co-Founder CTO & Co-Founder Eliot Horowitz CTO & Co-Founder Eliot Horowitz
- 70. CTO & Co-Founder CTO & Co-Founder CTO & Co-Founder Eliot Horowitz CTO & Co-Founder Eliot Horowitz CTO & Co-Founder Eliot Horowitz
- 71. URL/Hashtag can go here.
- 72. Title – no branding
- 73. This is a quote slide with white background for your presentation. Use green bold treatment if you want to emphasize content. Attributor Name
- 74. This is a quote slide with graphite background for your presentation. Use yellow bold treatment if you want to emphasize content. Attributor Name
- 76. URL/Hashtag can go here.
- 77. session.start_transaction() order = { line_items : [ { item : 5, quantity: 6 }, … ] } db.orders.insertOne( order, session=session ); for x in order.line_items: db.inventory.update( { _id : x.item } , { $inc : { number : -1 * x.qty } }, session=session ) session.commit_transaction() Code with title
- 78. order = { line_items : [ { item : 5, quantity : 6 }, … ] } db.orders.insertOne( order ); for x in order.line_items: db.inventory.update( { _id : x.item }, { $inc : { number : -1 * x.qty } }) Code comparison with title session.start_transaction() order = { line_items : [ { item : 5, quantity: 6 }, … ] } db.orders.insertOne( order, session=session ); for x in order.line_items: db.inventory.update( { _id : x.item } , { $inc : { number : -1 * x.qty } }, session=session ) session.commit_transaction()
- 79. session.start_transaction() order = { line_items : [ { item : 5, quantity: 6 }, … ] } db.orders.insertOne( order, session=session ); for x in order.line_items: db.inventory.update( { _id : x.item } , { $inc : { number : -1 * x.qty } }, session=session ) session.commit_transaction()
- 80. Graphic Assets
- 81. MDBW19 Logos Core Logo – Full Color For use on white or very light backgrounds Core Logo – Full Color For use on white or very light backgrounds
- 82. Icons – MongoDB Charts Analytics Mobile SyncBI 2.5 FunctionsODBC Driver Functions Triggers Database / MDB) QueryAuthorizationServer MobileDocuments / MDB Zoned Sharding Query Anywhere
- 83. Icons – generic 24/7 Support API API Tools Cloud Download Cluster Commercial License Community Data Subset FlexibleFAQEnterprise Features Insight Marketing Performance Presentation Pricing Quick Start Rocket Scale Security Support Type Conversion University Use Cases User Visibility Computer Download Flexible Schema Visualization Webinar Consistency Management Integration Search White Paper Deployment Flexibility
- 84. Partner Logos – from 2018 MDBW
- 85. Statement – Leaf Background
- 86. Statement – Graphite Background