Skip to content
HeliosDB HeliosDB Full

Security Operations

HeliosDB Security Operations

Use this guide for operational security checks, incident handling, access review, and audit readiness.

Access Review

Review privileged access regularly:

  • Database superusers and administrative roles.
  • Service accounts and automation tokens.
  • SSH, Kubernetes, and cloud IAM access.
  • Break-glass credentials and rotation records.
SELECT rolname, rolsuper, rolcreaterole, rolcreatedb
FROM pg_roles
ORDER BY rolname;

Secret Rotation

Rotate credentials when:

  • A user changes role or leaves the team.
  • A secret is suspected to be exposed.
  • A dependency or deployment pipeline changes.
  • The regular rotation window arrives.

Rotation steps:

  1. Create the replacement secret.
  2. Deploy to dependent services.
  3. Validate authentication.
  4. Revoke the old secret.
  5. Record the rotation.

Audit Checks

Check audit trails for:

  • Privilege changes.
  • Failed authentication spikes.
  • DDL changes.
  • Access to sensitive tables.
  • Disabled alerts or monitoring gaps.

Security Incident Response

For suspected unauthorized access:

  1. Treat as a high-severity incident.
  2. Preserve logs and audit records.
  3. Disable affected credentials.
  4. Identify affected data and systems.
  5. Rotate secrets after containment.
  6. Document impact and follow-up actions.

Hardening Checklist

  • TLS is enabled for client and replication traffic.
  • Administrative access is least privilege.
  • Audit logging is enabled and retained.
  • Backups are encrypted.
  • Public endpoints are intentionally exposed.
  • Alerting covers authentication failures and privilege changes.