P.K. SHARMA

Cyber security intelligence, AI governance, practitioner analysis

Cloud and subscribed services

Managed database (RDS): what it is and how it is attacked

A database the cloud provider runs, where the data and the settings are yours but the machine is never touched.

Also known as

  • RDS
  • Azure SQL
  • Cloud SQL
  • database as a service
  • DBaaS

Typing any of them into the editor finds this object.

Why it matters on a security diagram

It usually holds the data an incident is actually about, and it can be reached two ways: the ordinary database sign-in, and the platform's own controls, which can copy it or open it up without ever connecting to it.

How it gets attacked, and what reduces it

How it gets attacked

  • Left reachable from the internet when it only ever needed to answer one application
  • Copies taken for safekeeping and then shared or moved somewhere with weaker controls
  • Reads of the data not recorded, so the size of a loss cannot be established afterwards

What reduces it

  • Reach it through a private service link and switch off the public address separately
  • Apply the live controls to snapshots and copies, which are the same data
  • Switch on read logging before you need it

Where it sits

Group
Cloud and subscribed services · Things that only exist because somebody else runs the platform underneath them.
Whose side, by default
Ours · Belongs to the organisation the diagram is about.
Catalogue identifier
managed-database

Reviewed . CC BY 4.0.

Others in cloud and subscribed services

The cloud and subscribed services group lists all 12 of them side by side.

Managed database on your own diagram

Open the editor, press N, and type RDS. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.

Open the diagram maker