agora inbox for pgsql-sql@postgresql.org
help / color / mirror / Atom feedFrom: Tomas Vondra <tomas.vondra@2ndquadrant.com>
To: ROS Didier <didier.ros@edf.fr>
To: folarte@peoplecall.com <folarte@peoplecall.com>
Cc: pavel.stehule@gmail.com <pavel.stehule@gmail.com>
Cc: pgsql-sql@lists.postgresql.org <pgsql-sql@lists.postgresql.org>
Cc: pgsql-performance@lists.postgresql.org <pgsql-performance@lists.postgresql.org>
Cc: pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
Subject: Re: Why the index is not used ?
Date: Mon, 8 Oct 2018 22:00:15 +0200
Message-ID: <f6ab9c6e-323f-8e2e-fd71-8f019045ff2b@2ndquadrant.com> (raw)
In-Reply-To: <28893ac2b3df41a89ba4266bad6e43ce@PCYINTPEXMU001.NEOPROD.EDF.FR>
References: <dd1702f0a1b74ce79ca1e380ea4e63ee@PCYINTPEXMU001.NEOPROD.EDF.FR>
<CAFj8pRAQ1Ctv5dkO1UuehXfws83czzZXpyv=rkmb_86agPt-PQ@mail.gmail.com>
<74090066a33740ea8fc442cc70f8afa2@PCYINTPEXMU001.NEOPROD.EDF.FR>
<CA+bJJbxJuM4RQ=qMwQOF4Gep+y4w6a0Ym_ta7e_NBZH0p1sC2w@mail.gmail.com>
<3a14f7f8fbda4e868b663b31e8c5fa16@PCYINTPEXMU001.NEOPROD.EDF.FR>
<88005798-8b90-3535-cc1c-a915a9e12d17@2ndquadrant.com>
<28893ac2b3df41a89ba4266bad6e43ce@PCYINTPEXMU001.NEOPROD.EDF.FR>
Hi,
On 10/08/2018 04:10 PM, ROS Didier wrote:
> Hi Tomas
>
> Thank you for your answer and recommendation which is very
> interesting. I'm going to study the PCI DSS document right now.
>
> * Here are my answer to your question :
>
> />>/
> /What is your threat model?/
> /<</
> we want to prevent access to sensitive data for everyone except those
> who have the encryption key.
> in case of files theft, backups theft, dumps theft, we do not want
> anyone to access sensitive data.
>
The thing is - encryption is not panacea. The interesting question is
whether this improves security compared to simply using FDE and regular
access rights (which are grantable at the column level).
Using those two pieces properly may very well be a better defense than
not well designed encryption scheme - and based on this discussion, it
does not seem very polished / resilient.
regards
--
Tomas Vondra http://www.2ndQuadrant.com
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
view thread (25+ messages) latest in thread
Message-ID: <f6ab9c6e-323f-8e2e-fd71-8f019045ff2b@2ndquadrant.com>
Permalink: ../f6ab9c6e-323f-8e2e-fd71-8f019045ff2b@2ndquadrant.com/
Also on: postgresql.org/message-id/f6ab9c6e-323f-8e2e-fd71-8f019045ff2b@2ndquadrant.com
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tomas.vondra@2ndquadrant.com, didier.ros@edf.fr, folarte@peoplecall.com, pavel.stehule@gmail.com, pgsql-sql@lists.postgresql.org, pgsql-performance@lists.postgresql.org, pgsql-general@lists.postgresql.org
Subject: Re: Why the index is not used ?
In-Reply-To: <f6ab9c6e-323f-8e2e-fd71-8f019045ff2b@2ndquadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox