DB Security

Question 1

What are the x4 core security capabilities

Answer 1

Encryption, Authentication, Authorization, Auditing

Question 2

What is Encryption

Answer 2

Process of concealing information so it can only be accessed by authorized parties. This includes:

1) In Transit (protects data while it is being transferred across networks to prevent interception
2) At Rest (when stored in a database to safeguard against unauthorized access)
3) In-Use (Protects data during active processing or computation to ensure it remains secure while being accessed)

Question 3

What is Queryable Encryption

Answer 3

Feature allowing encrypted fields to be queried without decryption on the server, enhancing security for sensitive data operations.

Question 4

What is Authentication (Auth)

Answer 4

Verifying the identity of a user, application, or system attempting to get access to something, and ensuring they are who they claim to be (e.g. username/password, certificate, etc.).

example: Okta

Question 5

What is Authorization (Authz)

Answer 5

Determining what an authenticated user, application, or system is allowed to do, based on assigned roles and permissions.

example: RBAC

Question 6

What is Auditing

Answer 6

Process of monitoring/recording user activities while they access resources.

Question 7

Audit Log

Answer 7

A record of an event (e.g. user action, admin operation) that can be filtered, stored in BSON/JSON, or sent to syslog for analysis.

Question 8

Key Regulatory Standards

Answer 8

GDPR (General Data Protection Regulation, an EU law enforcing strict data privacy and security for personal data, requiring consent, data minimization, breach notifications

HIPAA (Health Insurance Portability and Accountability Act) - protecting sensitive patent health information

PCI-DSS (Payment Card Industry Data Security Standard - global standard for protecting cardholder data, requiring encryption, access controls, auditing, network security

CCPA (California Consumer Privacy Act, a california law granting consumer righgts over personal data, including access, deltion, opt-out of data sales, with security requirements.

FedRamp: Federal Risk and Authorization Management Program - US framework standardizing security for cloud services used by federal agencies.