How can we protect data on my database which is MySQL form database administrator stealing it?

Will encrypting it prevent it from being stolen? If yes, how as he already has access to the database he can de-crypt it?

  • 2
    If you have a concern that the database administrator will steal your data, then you have a problem that cannot be solved with technology. – Michael - sqlbot Dec 19 '14 at 16:27
  • You could use end-to-end encryption, where only the client knows the key, but then you can't do much on the db server or app server. – Neil McGuigan Mar 21 '16 at 23:18
  • Either fire your DBA or pay them more! – Vérace Jun 27 '16 at 10:30
  • I give a one hour presentation on SQL Server, in which I go through ways of encrypting the data so that the DBA can't decrypt it. One is to use an Extensible Key management system, which I'm not sure is available for mysql. If it is, then this would be good solution for you. Another one is Always Encrypted, which is new in 2016 and is the equivalent of encrypting at the client. – Michael Keleher Jul 29 '16 at 20:56

I have an old post where I discussed an actual product I was evaluating : How to properly secure MySQL database?. The product Gazzang (now Cloudera) would basically encrypt the data and the framework requires using specific keys. Even if you copied the files, the keys not being present in the target system made everything inaccessible just from an OS standpoint.

If you do not trust a DBA with the key, you may have issue specific MySQL grants to SysAdmin/DBAs: SHUTDOWN, PROCESS, SHOW DATABASES, SUPER, REPLICATION CLIENT, and REPLICATION SLAVE. All other GRANTs would need to be given to Project Leaders and Lead Developers.

As you can tell from this answer, your question makes the leap from technology to office politics. We all wish there was some 100% automated HIPAA compilance framework around a database. Until then, you would need to scrupulously define what an operational DBA can and cannot do.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.