---
title: "Security Operations"
---

# HeliosDB Security Operations

Use this guide for operational security checks, incident handling, access review, and audit readiness.

## Access Review

Review privileged access regularly:

- Database superusers and administrative roles.
- Service accounts and automation tokens.
- SSH, Kubernetes, and cloud IAM access.
- Break-glass credentials and rotation records.

```sql
SELECT rolname, rolsuper, rolcreaterole, rolcreatedb
FROM pg_roles
ORDER BY rolname;
```

## Secret Rotation

Rotate credentials when:

- A user changes role or leaves the team.
- A secret is suspected to be exposed.
- A dependency or deployment pipeline changes.
- The regular rotation window arrives.

Rotation steps:

1. Create the replacement secret.
2. Deploy to dependent services.
3. Validate authentication.
4. Revoke the old secret.
5. Record the rotation.

## Audit Checks

Check audit trails for:

- Privilege changes.
- Failed authentication spikes.
- DDL changes.
- Access to sensitive tables.
- Disabled alerts or monitoring gaps.

## Security Incident Response

For suspected unauthorized access:

1. Treat as a high-severity incident.
2. Preserve logs and audit records.
3. Disable affected credentials.
4. Identify affected data and systems.
5. Rotate secrets after containment.
6. Document impact and follow-up actions.

## Hardening Checklist

- TLS is enabled for client and replication traffic.
- Administrative access is least privilege.
- Audit logging is enabled and retained.
- Backups are encrypted.
- Public endpoints are intentionally exposed.
- Alerting covers authentication failures and privilege changes.