Securing DSE Graph

• Object permission management

  Limit access to graph keyspaces, excluding cached data, to roles that have been granted access permissions. Permission management also secures tables that are used to store graph data.

• Transparent data encryption

  Data at rest in Cassandra tables can be encrypted, including DSE Graph index encryption which are built using Cassandra tables. Cached data is not encrypted. Encryption occurs on the Cassandra side and impacts performance slightly.

• Client-to-node encryption
  You can use SSL to encrypt access to graph data and client-to-node encryption on a DSE Graph node.

  • Enable SSL client-to-node encryption on the DSE Graph node by setting the client_encryption_options in the cassandra.yaml file.
  • Install JCE to ensure support for all encryption algorithms.

    Some of the cipher suites in the default set of server_encryption_options in cassandra.yaml are included only in the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files. To ensure support for all encryption algorithms, install the JCE Unlimited Strength Jurisdiction Policy Files.

• Use Kerberos authentication for DSE Graph in production.

  You can authenticate DSE Graph users through Kerberos authentication using Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO). To use Kerberos authentication and SSL encryption with the Gremlin console, remote.yaml must be modified to include the following:

  hosts: [hostname-because-it's-kerberos]
  username: null
  password: null
  jaasEntry: DseClient 
  # protocol is the the same as the service_principal set in dse.yaml
  protocol: your_dse_principal 
  connectionPool: {enableSsl: true}

  A password set to null is ignored in the remote.yaml.

• graphname (name of the graph created that is the keyspace)
• graphname_pvt (keyspace holding partitioned vertex tables)
• graphname_system (keyspace for stored shared information)

GRANT <permission type> ON KEYSPACE <graphname> TO <rolename>;
GRANT <permission type> ON KEYSPACE <graphname_pvt> TO <rolename>;
GRANT <permission type> ON KEYSPACE <graphname_system> TO <rolename>;

username: realuser
password: password
connectionPool: {enableSsl: false}