Level: Technical

Abstract:

New systems are always interesting targets since their security model couldn’t mature yet. NoSQL databases are no exception and had some bad press about their security. But how does their protection actually look like? We will take a look at three widely used systems and their unique approaches:

• MongoDB: Widely criticized for publicly accessible databases and a common victim of ransomware. Actually, it provides an elaborate authentication and authorization system, which we will cover from a historic perspective and put an emphasis on the current state.
• Redis: Security through obscurity or how you can rename commands. And it features a unique tradeoff for binding to publicly accessible interfaces.
• Elasticsearch: Groovy scripting has been a constant headache, but the new, custom-built scripting language Painless tries to take the pain away literally.

Slides: https://speakerdeck.com/xeraa/nosql-means-no-security

Bio:

Philipp Krenn lives to demo interesting technology. Having worked as a web, infrastructure, and database engineer for over ten years, Philipp is now working as a developer advocate at Elastic — the company behind the Elastic Stack consisting of Elasticsearch, Kibana, Beats, and Logstash. Based in Vienna, Austria, he is constantly traveling Europe and beyond to speak and discuss open source software, search, databases, infrastructure, and security.

Blog:

https://xeraa.net

Posted on Friday, February 21st, 2020 at 8:07 pm in talks | rss feed for comments| Both comments and pings are currently closed.