MySQL Enterprise Audit and Security Objectives

The provided content discusses API to enable standard security measures for MySQL database management system. It highlights general factors that affect security, including choosing good passwords and generating unnecessary privileges to users. The document also covers network security of MySQL and system, emphasizing the importance of satisfying regulatory compliance and strong security controls. Additionally, it touches on MySQL Database Auditing, which provides policy-based auditing solutions to meet regulatory requirements. Furthermore, it outlines security objectives, environmental security objectives, and security requirements for MySQL database management system, including functional and assurance security requirements.

Security Target Document for MySQL

Title: Security target document for Mysql
Student Name:
Student Id:
Subject:

Table of Contents:
1. Introduction
2. Target of Evaluation
2.1 Overview
2.2 Description
2.3 Mysql Database security Management
2.4 Mysql database Auditing
3. Security Problems
3.1 Threats about TOE
3.2 Assumptions about TOE
3.3 Organization Security Polices
4. Security Objectives
4.1 Target of Evaluation security objectives
4.2 Environmental Security objectives for mysql
5. Security Requirements
5.1 Functional Requirements
5.2 Assurance Requirements
6. Target of Evaluation Summary
6.1 Security Functionality
6.2 Assurance evaluation
7. References

1. Introduction:
This report is based on the Mysql database management system in context of CybSec
organization. There are provided security target document for Mysql database management
system which will be used for a company CybSec which is planning to request common criteria
certification for its web-based system. The entire security target document is based on the
Mysql database management system and there are also included further terms with respect to
the Mysql database such as Target of evaluation for document which includes the overview of
the system, description, and Mysql database security management. Moreover, the security
target document includes many related topics such as security objectives (Target of evolution
security objectives, Environmental security objectives), security requirements (Functional
Security requirements and assurance security requirements) and Target of evaluation summary
with appropriate references. Thus all these things are described as follows in the report with a
proper security target document for Mysql database management system.
2. Target of Evaluation:
The target of evaluation process includes the details of any particular product testing
with respect to its security properties. There are described multiple things in this
phase of the document such as overview, description, Mysql database security
Management, and MySql database Auditing. These terms are described with respect
to the target of security evolution for Mysql database management system. Thus this
target of evolution is described as follows in detail.
2.1 Overview:
MySQL is the most popular open source database. It enables the cost effective
delivery of reliable and high-performance web-based and embedded database
applications. Implementation of MySQL database for any organization is very easy
but it is very important to consider security issues while installation of MySQL
database and working on it. While considering database security implementation of
database vault became considerable. Vault comes with a variety of integrations to
different systems. Vaults are integrated with MySQL as secret backend. A secret
backend can provide secrets. It means that Vault can create and revoke users for
databases on demand.
2.2 Description:
Organizations of all sizes commonly adopting MySQL database because it empower
them to build applications which are faster and handle highly diverse types of data.
To enhance security to access database and management database credentials and
roles Vaults are implements to enhance and ensure security audits. It is encrypted
file in the MySQL workbench data directory. The Vault provides a convenient secure

storage for password used to access MySQL server. The Metadata of MySQL
database includes the roles introduced by the database vaults.
MySQL Database Vaults provides.
 Access control functionality that allows to group database schema, roles and
objects, define common rules that controls and allow user to how users can
execute database SQL queries.
 Define and use factors that can be evaluate as part of the rules.
 Audit capabilities related to management activities of MySQL database
Vaults.
To create database credentials, role should be setup first. Roles control the permission
context for database credentials generation. A role defines the permissions and max lease
time for the credentials. The lease is in Vault-speak the duration the credentials are valid.
Vaults revoke credentials from database system once they are expired. In addition it extends
the auditing functionality with specific auditing and specific audit functions related to the
additional access control functionality. There are further additions to the management
functionality with new roles defined by database Vault and management functionality for
managing the additional access control and audit functions.
2.3 MySQL Database Security Management:
In account of security with in MySQL database installation and managing credentials
with respect to roles and vaults the wide range of topics comes in consideration and
how they affect the security of your MySQL server.
 Access control and security within the database system. It includes the users
and databases granted with access to the databases, stored programs and
views.
 Features offered by security related plugins. Plugins for authenticating clients
to connect to MySQL database. Password validation plugin for implementing
password strength policies. MySQL Enterprise Audit, Implemented using a
server plugin, uses the open MySQL Audit API to enable standard.
 General factors that affect security. These include choosing good passwords
and generating unnecessary privileges to users.
 Network security of MySQL and system. It states that the security of
database
2.4 MySQL Database Auditing
MySQL Enterprise Audit provides policy-based auditing solution that provides
satisfy regulatory compliances and strong security controls. As secured data is
collected, stored and used online, it becomes strong and essential component of any
security strategy. To defense against the misuse of information, Sarbanes-Oxley

popular compliance regulations including HIPAA and the PCI Data Security Standard
require organization to attack access to information. MySQL Audit provided DBAs
tools to add to their new and existing application by enabling following these:
 Audit files are encrypted using AES encryption and can also share and
Decrypt using encryption key.
 Perform forensic analysis and data’s validity to confirm data integrity.
 Select option between JSOM or XML
 Files can be zipped and reduce the size up to 10 times which can save the
disk space and performance.
3. Security objectives
This phase of the security target document for CybSec organization described
different objectives of security for Mysql data base management system. There are
defined target of evaluation security objectives and environmental security
objectives for Mysql. Thus, these objectives are described as follows:
3.1 Target of Evaluation security objectives
The Mysql data base management system has different security objectives to
maintain a proper secure database for CybSec organization. The security
objective for any database provides the details about reasons to achieve security
objectives for any database. There are described some security objectives for
Mysql database management system.
 The Mysql database has objective of application security.
 The main objective of security can be backup of important previous data
from database.
 The integrity controls also a security objective of Mysql database
management system.
 To provide atomicity for database can be a security objective for Mysql
database management system.
Thus these are the target of evolution security objective for Mysql
database.
3.2 Environmental Security objectives for Mysql
The Mysql database also has many environmental security objectives which are
related to the external environment of database management system. Some of
the environmental security objectives for Mysql database management system
are described as follows:
 The access control of database management system is one of the major
objectives of Environmental security objective of Mysql.

 Auditing and authentication are also other environmental security
objectives for Mysql database management system.
 The encryption to maintain the secure data by changing its form is also
one of the good environmental security objectives of Mysql database
management system.
Thus these are some of the environmental security objectives for Mysql
database management system.
4. Security Requirements
This phase of the security target document contains details about the security
requirements for Mysql database. This also includes the functional and assurance
security requirements for Mysql database in context of CybSec Company. Thus the
main ideas regarding this security are described as follows:
4.1 Functional Requirements
The Mysql database has a lot of functional security requirements which are
described as follows to implement properly secure database management
system for CybSec organization. Thus the functional requirements for database
management system are described as follows:
 The database management system need audit data generation and user
or group identity association for better security functionality.
 The Mysql database must have a proper security management policy.
 The Mysql database must have proper data base protection functionality.
 The database management system must have proper security audit.
Thus these are the security functional requirements for Mysql database.
4.2 Assurance Requirements
The assurance security requirements in the complete security target of Mysql
database management system plays a major role in to achieve proper security by
tool. The Mysql database must have a proper server managing the security for
entire company. There are also many assurance requirements for secure
database are described as follows:
 The Mysql database management system should be robust in nature.
 The database management system should have proper secure operating
system to deal with different types of tasks.
 The Mysql database must be connected with a secure server.
Thus these are the Assurance security requirements for Mysql database
for CybSec.
5. Target of Evaluation Summary

This phase of the document is used to provide the general overall idea about the
target of evaluation summary. This used to describe the general understanding about
the development of target of evaluation. There are described the implementation of
target of evaluation with the help of security functions and assurance security
specifications which are also described as follows in a details view.
5.1 Security Functionality
The target of evaluation summary specification is described the details here that
how target of evaluation is connected with the Mysql database management
system. The Mysql database is meeting with the evolution of target with respect to
the society because it contains proper secure server with the better operating
system and other functional and assurance requirements.
5.2 Assurance evaluation
This phase of the document is used to provide a high-level description about the
developer process to achieve the security for Mysql database management system.
The target of security is evaluated for Mysql database management system in
different areas such as identification and authentication, database resource quotes,
access control, privileges and roles and about the auditing of the database
management system.
Thus this is the complete summary about the target of evaluation for database
management system in terms of security functionality and assurance evaluation .
6. References
Common criteria Reforms: “Better Security Products Through Increased Cooperation
with industry”.
Beznosov, Konstantin and Kruchten, Philippe, Towards Agile Security Assurance,
Wayrynen, J. Boden, M. and Bostrom, Security Engineering and eXtreme
programming.
Common criteria for information Technology Security evaluation, Part 1: Introduction
and general model, Sep 2012, CCMB-2012-09-002.
Common criteria for information Technology Security evaluation, Part 3: Scurity
assurance criteria for information technology evaluation CCMB-2012-09-003.
http://www.mysql.com/
Common criteria evaluation and validation scheme, validation report, Red hat
enterprise Linux, version 5.
Common criteria for information technology security evaluation version- 3.1
Urlocker, M. Zack 2005, Google runs MySQL.
Calbum, Thomas 2007, “Google Releases Improved MySql”

Callaghan, Mark, 2010, “Master-slave replication”
Sobel, Jason 2007, “database blog” Retrieved 2017
Steven J. Vaughan-Nichols 2013, “WebScale SQL: MySQL”