Data is the lifeblood of mission critical applications, and HPE NonStop customers rely on the powerful capabilities of NonStop SQL to store, analyze, and manage that data. NonStop customers need to ensure their SQL databases are well-organized, use efficient queries, and run at peak performance.
To do that, database managers need powerful management tools and highly-privileged access rights. However, providing privileged access poses serious risks. With privileged access comes increased risk of threats from malicious insiders (one of the most difficult to detect and resolve security threats), catastrophic user error, and compromised credentials.
Secure NonStop SQL Database Management
SQLXPress from XYPRO is the most functional graphical database management solution for NonStop SQL coupled with strong security protections.
SQLXPress includes a comprehensive set of security controls, including:
- Multi-factor Authentication
- Auditing
- Access Control
- Session Encryption
- Code Integrity
- SQL Injection Protection
Multi-factor Authentication
The SQLXPress client login dialogue supports PCI DSS 3.2 multi-factor authentication (MFA) requirements by prompting the user for a second factor. Used in conjunction with XYGATE User Authentication (XUA), which is already present on your HPE NonStop server, means you’re up-to-date not only with the very latest in PCI 3.2 MFA compliance requirements but also with the advice of every security expert out there. Multi-factor authentication is a requirement for secure systems.
Auditing
The SQLXPress Security Administrator configures the level of audit data that is collected by the audit subsystem.
The audit subsystem records the actions of SQLXPress users in an audit trail and contains detailed information on each user action, including date and time, user logon name, PC device identification, SQL statement text, SQL parameter values, outcome details, and much more.
Audit trail data is extracted to an SQL database for reporting purposes. A rich set of audit reports is available, from activity summary reports down to individual actions. Reports can be filtered by time of day, user, device, and SQL object name.
Audit data is essential information for security administrators. It allows them to monitor the use of SQLXPress, and be able to answer questions like:
- Who accessed or changed data?
- When was it changed?
- From which device was it changed?
- Who tried to perform an unauthorized command?
Audit data is also useful for troubleshooting. To exchange diagnostic information with other departments, the Security Administrator can grant audit report access to other users on an individual, audited basis.
Every HPE NonStop server is delivered with XYGATE Merged Audit (XMA). Additionally, an XMA plugin integrates the SQLXPress audit data directly into the XMA database, enabling sophisticated audit reporting and alerting capabilities for all NonStop SQL activity. Now just deliver that audit data to your enterprise SIEM such as SPLUNK or QRADAR, incorporating NonStop database security into your overall enterprise security program
Access Control
NonStop SQL supports access control “out of the box”. SQLXPress augments these standard access control features by providing a more granular level of control over the actions users are permitted to perform, and the SQL objects they are permitted to access from within SQLXPress.
Role-based Access Control
Like all XYGATE software, SQLXPress supports a role-based access control model:
- Roles are granted permissions to perform activities
- Users are assigned to roles
- Users acquire the permissions that have been granted to their roles
- Roles may be restricted to an “environment” (an environment is a collection of specific SQL objects)
- When a user attempts to perform an activity, an authorization check is performed
Access control configuration is easily customized to suit the needs of the organization.
Separation of Duties
SQLXPress supports the principle that the Security Administrator is responsible for the configuration and management of the SQLXPress security subsystem, including audit and access control.
There is a special Security Manager Windows client program for use only by the Security Administrator. The typical SQLXPress user is not granted access to most functions in the Security Manager client and the Security Administrator is not allowed to use the other SQLXPress client programs.
To really appreciate SQLXPress access control let’s look at some use cases:
Use Case 1: Command Lockdown
NonStop SQL permits the owner of an SQL object, like a table, or a view, to perform any DDL or utility operation on the object. SQLXPress access control refines this so that restrictions can be applied to individual operations.
Many commands, like Update Statistics, or Split Partition, are performed as part of the routine duties of a DBA. The DBA should have permission to perform them on an ongoing basis.
However, there are some operations like Purge Data, Drop Table, or Disable Trigger, that are not required for the normal operation of the database, and can have disastrous consequences if performed inadvertently.
SQLXPress access control allows these potentially dangerous commands to be “locked down” during normal use. When the DBA needs to perform a locked-down command, the Security Administrator temporarily grants permission for the command. When the command has been completed, the security administrator revokes permission.
Use Case 2: Data Access Restrictions
NonStop SQL permits the owner of a table to view and change the data stored in the table. SQLXPress access control can be used to limit the owner’s access to data while still permitting the owner to manage the table.
SQLXPress security controls mean the owner can be prevented from changing data and can even be prevented from viewing data at all.
Use Case 3: Database Visibility Restrictions
SQL metadata is a rich source of information about the databases on the system. It includes details on table names, column names, security settings, data validation rules, and much more. Most organizations will want to limit access to SQL metadata to authorized users only.
However, with NonStop SQL/MX, SQL metadata is secured for public read access. This means that any SQL/MX user can view information about all the databases on the system. In SQL/MP, metadata is secured per catalog.
To enable database visibility restrictions, the SQLXPress access control feature allows the Security Administrator to define one or more “environments” on a system. An environment provides a restricted view of the SQL objects on a system. Only objects that have been registered in an environment are made visible to the user.
The Security Administrator can restrict the SQL objects that are made visible to a user by assigning him a role for an environment. The user must open an environment in order to use SQLXPress, and can only work with the SQL objects that are registered in that environment.
Furthermore, a user can be granted roles for more than one environment, and even granted a different role in each of those environments. For example, user DEV.JOHN can be granted the role of Senior DBA in the DEV_ATM environment, and the role Guest in the QA_ATM environment.
Summary
With the most comprehensive set of features and full support of both NonStop SQL/MX and SQL/MP, SQLXPress is the leading solution for managing NonStop SQL databases. SQLXPress users describe it as “indispensable” and “We never knew what we were missing without SQLXPress. We’ll never go back!” SQLXPress is ideal for database administrators, software developers, technical support personnel, and any other users who work with NonStop SQL databases.
HPE NonStop SQL databases typically store highly sensitive and private information. In an increasingly security-conscious world, customers expect their database engines and database management tools to provide comprehensive security–and SQLXPress delivers.
For more information about XYPRO’s Secure Database Solutions please visit: https://xypro.com/products/secure-database-management/ or contact [email protected].
