January 2024 Summaries

The Center for Internet Security (CIS) has collaborated with Yugabyte to create a benchmark for the YugabyteDB database, which provides globally recognized and consensus-driven best practices for security configuration, implementation, and management. This benchmark is tailored for system and application administrators, security specialists, auditors, help desk personnel, and platform deployment personnel involved in developing, deploying, assessing, or securing solutions using YugabyteDB. The CIS Benchmark offers expert cybersecurity guidelines, cost-effective threat prevention, regulatory compliance confidence, and continuous improvement, aligning with major security frameworks such as NIST Cybersecurity Framework, HIPAA, PCI DSS, and ISO 27001. It is available for free download in PDF format, providing a comprehensive roadmap to robust security and compliance for businesses operating in regulated industries.

We evaluated several security tools, including Wazuh, Crowdstrike Falcon, Datadog Agent, OSQuery, CrowdSec, Qualys, Tenable Nessus, and Security Onion. We selected Wazuh as our SIEM/SOAR solution due to its server-client architecture, agentless integration capabilities, and comprehensive monitoring features. We deployed Wazuh on a Kubernetes-based infrastructure using Google Cloud technologies and integrated it with cloud service providers' auditing services. The deployment involved integrating available auditing services from cloud service providers into Wazuh, embedding agents directly into production database nodes, and developing custom data sources for our applications. Our results show that Wazuh has performed well in terms of performance impact on YugabyteDB nodes, with minimal CPU impact and no significant impact on SQL/CQL query latency/ops/second.

At Yugabyte, our mission is to build the most secure DBaaS available. We began researching how to best secure the infrastructure supporting our fully managed version of YugabyteDB Aeon, and concluded that external 3rd party solutions would not meet our needs. Our essential requirements included deploying a security layer over critical infrastructure, aligning with industry best practices and complying with top certification frameworks, and covering key pieces of infrastructure such as the SaaS infrastructure behind YugabyteDB. When developing any large solution, costs can be substantial, so we factored in subscription costs, storage costs, and data transfer costs to estimate pricing. We also calculated storage requirements using a formula that takes into account cloud native audit logs, SIEM agents installed on machines, and log retention days. However, finding the right SIEM tool proved difficult due to challenges such as lack of cloud native integration, limited Kubernetes support, and adapting to an evolving software landscape. After evaluating many solutions, we finalized our SIEM/SOAR tool of choice, which will be detailed in a future blog post.

The Evolving Strategies in Streaming. The Future of Free Trials.` Free trials are a key marketing tactic for subscription streaming services, allowing users to try out popular content and potentially convert into long-term subscribers. However, the effectiveness of free trials is nuanced, with research suggesting that exposure to the entire content library and advanced features is crucial for conversions. Social sharing also plays a significant role in increasing redemption rates. Despite this, some streaming platforms have modified their approach by introducing "batch" releases and leveraging live content across all owned platforms. These changes aim to maximize audience engagement and manage production costs. The synergy between systems and live content is critical, as peak traffic during live events can overwhelm authentication and authorization systems, leading to downtime and lost conversions. To future-proof these systems, streaming services are adopting distributed, high-performance databases like YugabyteDB, which provides the necessary reliability, resilience, and scalability for tier zero and tier one systems.

YugabyteDB's change data capture (CDC) is a log reader-based capture that operates with the write-ahead logging format of its database. It aggregates transaction changes in micro-batches, provides timeline consistency for both row- and shard-based views, supports JSON and Avro formats, adheres to Kafka's semantics of at least-once delivery, offers adjustable retention settings on either side, facilitates cloud and on-premise change delivery, and provides transactionally consistent CDC as a new feature. The technology is used by companies to stream data into YugabyteDB, reducing reliance on costly mainframe systems and cutting costs, while also improving performance and reliability. It enables real-time decision-making for streaming data, supports various downstream sources such as Kafka, Elasticsearch, Snowflake, and Amazon S3, and offers a "fall forward" approach during migrations.

Streaming data has become increasingly important due to its relevance in disaster recovery, microservices application development, and near-real-time analytics and decision support. Streaming data architectures have evolved to support this need, with notable developments such as the Lambda architecture pattern and the Kappa architecture. YugabyteDB aligns well with streaming data processes by providing a distributed, high-performance architecture that can handle high-throughput transactional workloads and provide change data capture capabilities. This separation of concerns enables users to enjoy both transactional efficiency and analytical decision-making within a resilient streaming architecture.