Securing PostgreSQL
summary
Patches and patching policy matter: subscribe to PGSQL announce, apply security updates immediately, and make someone responsible. Network rules are concrete: never expose port 5432, place DBs in a VPC behind bastion host + VPN, and lock hosts with iptables/security groups. Authentication: use MFA and centralized auth (LDAP/Kerberos), rotate secrets (PCI-style 90 days), and use a password manager. Data protection: prefer per-column AES-256 encryption with strict key management (don’t bake keys into code) and require TLS 1.2 for client connections.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:01Securing the Host
- 2:58Linux Vulnerabilities
- 3:26Minimizing Attack Surfaces
- 9:50Physical Data Center Security
- 10:18Secure Authentication
- 11:04Configuring PostgreSQL
- 11:18Database Access Control
- 20:54Data Encryption Overview
- 26:01Logging Best Practices
- 26:34Row-Level Security
- 30:30Application Security
- 38:05Cultivating Security Culture
- 40:18Additional Q&A
related talks
35mSecuring PostgreSQL From External Attack
07mAll about Postgres security
32mEnhancing Security in PostgreSQL
50mPostgreSQL Security. How Do We Think?
38mPostgreSQL and DevSecOps: Ensuring database security
54mConfiguration and Authentication
28mFrom Dev to Prod: Securing Postgres the Right Way
40mPostgreSQL Security for Application Developers