Privileged access management for databases

Abstract

Despite the value of the data they hold, databases are not considered essential targets for an access management solution, and administrators often compromise on ideal security policies by sharing database account credentials with unprivileged users. We have designed and developed a secure database access solution that integrates with PrivX, a Privileged Access Management product, part of SSH Secure Communications's Zero Trust offering. This solution offers a baseline set of features for all database engines communicating over the TCP internet protocol. These features improve the administrator's session management experience and the system's security. However, the baseline does not remove the need to share credentials with end users. For database engines using the MySQL and PostgreSQL protocols, we offer a complete set of features, including credential injection, such that password sharing with users of these databases becomes unnecessary, thus removing significant risk from organisations using PrivX. The implementation works natively with all database clients communicating over TCP and secures the authentication using SSH tunnel port forwarding and connection proxying. We offer additional features like role-based access control, session recording, event auditing, monitoring and data transfer limits for all database engines. Our stakeholders explicitly request the upload and download transfer limits to limit the potential data breaches if credentials end up being exfiltrated by attackers from their users. We inject credentials in the authentication flow for the MySQL and PostgreSQL protocols by interpreting the database application-level wire protocol. We evaluate the correctness of the wire protocols' implementations by utilising different compatible database engines and running our custom-built fuzzing tool. Finally, we evaluate the solution's performance in simulated and synthetic tests and deem the 304 milliseconds of median added delay acceptable for the benefits brought by the security features.