RWB Deploys Enterprise-Wide Database Access Control with Trino and Open Policy Agent
RWB has implemented a company-wide database access management architecture centered on Trino and Open Policy Agent (OPA), replacing ad-hoc manual grants with a centralized, auditable process.
Previously, users received full database access rather than granular table or schema permissions. Revocation depended on manual HR synchronization, new access requests took between one and 17 days, and audit trails were incomplete. The company determined that these issues would not scale with growth and required a unified solution meeting strict requirements: no anonymous or password access, minimum necessary privileges, full operation logging, and a digital record of every access request and approval.
The architecture uses Trino Coordinator and Worker nodes to handle queries, OPA to evaluate Rego policies on every request, Keycloak for OIDC authentication, Vault for secrets, Kafka for security event delivery to SOC, and Kubernetes for orchestration. Policies are generated automatically from access matrices stored in GitLab, versioned, tested via CI/CD, and deployed to S3 without service restarts. Granularity reaches column level when needed, though catalog/schema/table is the standard operating scope.
Three request flows were established: project-level access matrices processed through merge requests with automated checks, point-in-time additions to existing groups via Service Desk with two-level approval, and temporary 24–72 hour access with automatic revocation. HR integration now triggers instant access removal upon employee departure, while an independent Access Management team can revoke rights in seconds during emergencies.
All Trino traffic is streamed through an event listener to Kafka and then to SOC, where custom alerts detect enumeration, unauthorized DDL/DML, anomalous query volumes, and impersonation. Incident escalation follows a three-tier model with SOC handling L1, DevOps and Access Management covering L2, and Data Security engaged at L3. Long-term logs reside in S3 per regulatory guidance.
Results include 1,250+ PostgreSQL clusters connected, 700+ daily users, 90+ projects onboarded, and access provisioning reduced to minutes. Real-time BI dashboards track cluster health and project maturity, while 24/7 support channels and training materials assist end users.
Related articles
Rostelecom Calls for 'Doomsday' Data Centers to Counter Drone Attacks and Infrastructure Risks
Rostelecom executive Valery Ermakov has urged Russian companies to build geographically distributed backup data centers, dubbed 'doomsday' facilities, to ensure service recovery after site losses. The recommendation follows drone strikes that disabled three Yandex data centers in Sasovo, Kaluga, and Vladimir, disrupting both internal services and Yandex Cloud clients. Ermakov explained that previous centralized infrastructure, built for economic efficiency, is no longer viable under changed threat models that now include physical attacks previously considered unthinkable. He advocated a micro-cellular architecture with services spread across many sites connected by high-speed links, while warning that Russian backbone networks are overloaded and much fiber optic infrastructure dates back 20-30 years. Rostelecom positioned its TEA NEXT line running from Kaliningrad to Mongolia as a source of additional capacity to address potential backbone shortages. Yandex responded to the incidents by accelerating client data migration to partner cloud providers.
Russian Firms Accelerate Cybersecurity Strategy Adoption as Risk Reduction Emerges as Top Priority
A recent AM Live broadcast survey reveals that Russian small, medium, and large companies are increasingly developing information security strategies, with the share of organizations actively working on them rising from 9% to 28% year-over-year. The primary goal cited for 2027 is risk reduction and financial loss mitigation, selected by 78% of respondents compared to 55% previously. Key barriers have shifted, with insufficient source data now affecting 64% of companies and lack of top-management buy-in rising to 43%. Experts including Yaroslav Napalkov from MTS Bank and Nikolay Kazantsev from Securitm emphasized the need for risk-oriented approaches, three-year planning horizons with annual reviews, and early engagement with CEOs and stakeholders. Only 16% of firms have fully operationalized their strategies with metrics and cyber exercises, while personnel shortages remain the leading constraint at 59%.
VK Shares Rise 7.62% as Market Assesses Data Center Developments and Yandex Cloud Challenges
VK shares climbed sharply on October 12, reaching a peak increase of 7.62% to 134.2 rubles before moderating to a 6.6% gain at 132.95 rubles by evening. Analysts from Freedom Global linked the movement partly to the Ministry of Digital Development's announcement of joint measures with the Ministry of Defense to protect Russian data centers. Other observers at Finam suggested investors were pricing in potential client shifts from Yandex Cloud to competitors such as VK Cloud, which has already begun accelerated infrastructure placement for affected Yandex customers. The surge was also attributed to broader capital rotation away from the energy sector toward previously lagging technology stocks. While the confirmed price movement is clear, the exact drivers remain analytical interpretations rather than verified revenue impacts. The episode highlights how regulatory and infrastructure news can quickly influence valuations in the Russian cloud services market.
Passphrases vs. Leetspeak Passwords: Why Four Random Words Outperform P@ssw0rd!2026
The article explains why a passphrase made of four randomly selected words provides far greater resistance to offline attacks than a complex-looking password constructed with substitutions and appended symbols. It details how password strength is measured in bits of entropy rather than visual complexity, showing that four words drawn from a 50,000-word list yield approximately 62 bits while common leetspeak transformations add almost none. The piece contrasts fast legacy hashing with modern slow algorithms such as Argon2 and emphasizes the protective effect of per-password salting. It criticizes registration forms that reward predictable patterns and highlights NIST guidance favoring length over mandatory character rotation. The author recommends diceware-style generation for master passwords and password managers for everything else, noting that passkeys ultimately eliminate the need for memorizable secrets altogether.