SQL Inspector - Least Privileged Permissions
needs review
L
Lamont Largie
As a company operating in the Australia region we are required to be aware of and operate under Australian laws around data privacy.Part of utilising Liongard is to better service these clients and ensure we monitor for and address issues before they become exploited in a least privileged deployment. For any Australian company a scheme exists around safeguarding and reporting Data Breaches that result in personal information is:· A device with a customer’s personal information is lost or stolen· A database with personal information is hacked· Personal information is mistakenly given to the wrong person Due to the SQL inspector within Liongard needing Sysadmin privileges, if a database hosts Personal Information, a situation exists where the data could be read by the Liongard agent, resulting in a Notifiable Data Breach. Within our network, approx. 90% of databases would fall into this category.After completing a risk assessment, the risk is too high due to low visibility on the data existing and direct hooks between a cloud service and the data itself (without 3rd party means of authenticating access to the data). We are unable to use the Liongard SQL inspector on databases hosting Personal Information until such a time that the SQL inspector is able to operate without the ability to read the data in the database and ask that development towards a Least Privileges model around this inspector be road mapped for 2022. Further information:https://www.oaic.gov.au/privacy/notifiable-data-breacheshttps://www.oaic.gov.au/privacy/notifiable-data-breaches/about-the-notifiable-data-breaches-schemehttps://www.oaic.gov.au/privacy/your-privacy-rights/your-personal-information/what-is-personal-information