To make MySQL compliant with government compliance requirements, we need to start from four aspects: permission control, encrypted transmission, audit logs and system reinforcement. 1. Strengthen user permission management, follow the principle of minimum permissions, avoid using root remote connections, and regularly clean invalid accounts; 2. Enable SSL/TLS encryption transmission, use transparent data to encrypt and encrypt backup files; 3. Turn on audit logs and regularly review, use audit plug-ins and log archives; 4. Close non-essential ports, update patches in a timely manner, use dedicated accounts to run services, and conduct security tests regularly.

MySQL is a common data storage solution for many government agencies and regulated industries, but to make it meet government compliance requirements, such as domestic level protection, GDPR, NIST or other data security specifications, it needs to start from multiple aspects. The focus is on permission control, encrypted transmission, audit logs and system hardening .

1. Strengthen user permission management

Although the default permission system of MySQL is flexible, the default configuration is often not secure enough. Government compliance requires strict control over data access, so permission management must be refined.

• Minimum permission principle : Each user only allocates the minimum permissions required to complete their tasks. For example, a read-only application should not have UPDATE or DELETE permissions.
• Avoid using root users to remotely connect : root users have too high permissions, so they should be restricted from logging in locally, or create a dedicated management account.
• Regularly clean up invalid accounts : Delete users who are no longer in use, especially those of test accounts or those of resigned employees.

For example, creating a read-only account can be done like this:

 CREATE USER 'readonly_user'@'%' IDENTIFIED BY 'StrongPassword123!';
GRANT SELECT ON database_name.* TO 'readonly_user'@'%';
FLUSH PRIVILEGES;

2. Data transmission and storage encryption

Government compliance often requires that data must be encrypted during transmission and storage. MySQL provides multiple encryption mechanisms, but these features are not usually enabled by default installation.

• Enable SSL/TLS encrypted connections : Ensure that communication between the client and the MySQL server is not eavesdropped. SSL support can be enabled in the configuration file my.cnf and forced to use it when connecting.
• Use Transparent Data Encryption (TDE) : If you are using a TDE-enabled storage engine (such as some distributions of InnoDB), the data files should be encrypted.
• Backup files should also be encrypted : Backup data is a common target for attackers, and backup files should be protected using encryption tools.

For example, enable SSL in the configuration file:

 [mysqld]
ssl-ca=/path/to/ca.pem
ssl-cert=/path/to/server-cert.pem
ssl-key=/path/to/server-key.pem

3. Enable and periodically review audit logs

Government compliance usually requires that all database operations be recorded so that they can be tracked in the event of a security incident. MySQL provides a variety of logging features, but may not be enabled by default.

• Turn on General Query Log and Slow Query Log : Recording all SQL operations is helpful for post-event analysis.
• Use audit plug-ins : such as MySQL Enterprise Audit (commercial version) or open source plug-ins such as McAfee's RDS-Audit-Plugin, which provide a finer-grained operation record.
• Regularly export and archive logs : The logs should be kept for a certain period of time and stored in a safe location to prevent tampering.

If you are using community version of MySQL, you can consider enabling common logs using the following method:

 [mysqld]
general_log = 1
general_log_file = /var/log/mysql/general.log

4. System-level security reinforcement

The security configuration of MySQL itself is only part of the overall security, and the operating system and network environment are equally important.

• Close unnecessary ports : MySQL uses port 3306 by default, and access sources should be restricted through the firewall, allowing only necessary IP connections.
• Update MySQL version and system patches : Timely fixing known vulnerabilities is one of the compliance requirements.
• Run MySQL service with a dedicated account : Avoid starting MySQL with root permissions, use a low-privilege dedicated account.
• Regular security scans and penetration tests : Simulated attacks help identify potential risks.

For example, use iptables to restrict access to sources:

 iptables -A INPUT -p tcp --dport 3306 -s 192.168.1.0/24 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Basically that's it. MySQL is not something that can be achieved overnight, but as long as I put in the four aspects of permissions, encryption, auditing and system security, it can meet most regulatory requirements.

The above is the detailed content of Securing MySQL for Government Compliance. For more information, please follow other related articles on the PHP Chinese website!