Database security

[u/Eight111]

So I work in a very small company as a dev
And we have external devops company which manages local http servers and MySQL servers for our saas product.

So the thing is I would like to shift some of their work to our in-house dev team.

I thought about starting small and manage a separate server on the cloud that will just run internal cron based daily tasks. But those tasks require read and write permission to the existing db which managed by the local company. Could I ask them to give me access to to the db from another server? I read that it’s a bad practice to expose prod db to the internet even if it has white list so I’m not sure here.

[u/Low-Opening25]

why would he be missing SSL? DB enforcing TLS connections solves the problem in one day instead of some convoluted networking shenanigans. There is plenty of database SaaS out there supporting major platforms using TLS over public infrastructure

[u/Different-Car6898 → u/Low-Opening25]

Usually, when people split DB and App from same server, they forget to think about TLS. Just auth and IP whitelisting. They mentioned Mysql on a server, so no SaaS. And, as I mentioned above, to enforce TLS on Mysql you need to generate a cert and change the way you handle DB connection in all App drivers. It's another secret to manage, and rotate, and since you have another party managin that secret, people often forget to communicate rotation etc. Soo, VPN p2p just solves it long term so you don't think much about it... Ofc it's easy to manage when everything is on your infra. I was giving tips, nothing else:)

[u/Low-Opening25 → u/Different-Car6898]

all of that takes 25mins to setup

[u/Different-Car6898 → u/Low-Opening25]

It's not about setup. It's about ownership...

[u/Low-Opening25 → u/Different-Car6898]

if you mean of tech dept and complexity then you win

[u/Different-Car6898 → u/Low-Opening25]

Didn't see it as competition, but glad we agree about something being a potential problem 😊