MariaDB starting with 10.1
Encryption of tables and tablespaces was added in MariaDB 10.1
Nearly everyone owns data of immense value: customer data, construction plans, recipes, product designs and other information. These data are stored in clear text on your storage media. Everyone with file system access is able to read and modify the data. If this data falls into the wrong hands (criminals or competitors) this may result in serious consequences.
With encryption you protect Data At Rest (see the Wikipedia article). That way, the database files are protected against unauthorized access.
When does encryption help to protect your data?
Encryption helps in case of threats against the database files:
- An attacker gains access to the system and copies the database files to avoid the MariaDB authorization check.
- MariaDB is operated by a service provider who should not gain access to the sensitive data.
When is encryption no help?
Encryption provides no additional protection against threats caused by authorized database users. Specifically, SQL injections aren’t prevented.
What to encrypt?
All data that is not supposed to fall into possible attackers hands should be encrypted. Especially information, subject to strict data protection regulations, is to be protected by encryption (e.g. in the healthcare sector: patient records). Additionally data being of interest for criminals should be protected. Data which should be encrypted are:
- Personal related information
- Customer details
- Financial and credit card data
- Public authorities data
- Construction plans and research and development results
How to handle key management?
file_key_management plugin enables the configuration of keys in a file. The key file is read at system start and no additional access is needed during runtime. The security of the encryption depends on access restriction to the key file. The key file can itself be encrypted, providing additional layer of protection.