RWB Deploys Enterprise-Wide Database Access Control with Trino and Open Policy Agent
RWB has implemented a company-wide database access management architecture centered on Trino and Open Policy Agent (OPA), replacing ad-hoc manual grants with a centralized, auditable process.
Previously, users received full database access rather than granular table or schema permissions. Revocation depended on manual HR synchronization, new access requests took between one and 17 days, and audit trails were incomplete. The company determined that these issues would not scale with growth and required a unified solution meeting strict requirements: no anonymous or password access, minimum necessary privileges, full operation logging, and a digital record of every access request and approval.
The architecture uses Trino Coordinator and Worker nodes to handle queries, OPA to evaluate Rego policies on every request, Keycloak for OIDC authentication, Vault for secrets, Kafka for security event delivery to SOC, and Kubernetes for orchestration. Policies are generated automatically from access matrices stored in GitLab, versioned, tested via CI/CD, and deployed to S3 without service restarts. Granularity reaches column level when needed, though catalog/schema/table is the standard operating scope.
Three request flows were established: project-level access matrices processed through merge requests with automated checks, point-in-time additions to existing groups via Service Desk with two-level approval, and temporary 24–72 hour access with automatic revocation. HR integration now triggers instant access removal upon employee departure, while an independent Access Management team can revoke rights in seconds during emergencies.
All Trino traffic is streamed through an event listener to Kafka and then to SOC, where custom alerts detect enumeration, unauthorized DDL/DML, anomalous query volumes, and impersonation. Incident escalation follows a three-tier model with SOC handling L1, DevOps and Access Management covering L2, and Data Security engaged at L3. Long-term logs reside in S3 per regulatory guidance.
Results include 1,250+ PostgreSQL clusters connected, 700+ daily users, 90+ projects onboarded, and access provisioning reduced to minutes. Real-time BI dashboards track cluster health and project maturity, while 24/7 support channels and training materials assist end users.
Related articles
Kaspersky Container Security Earns FSTEC Russia Certification as Antivirus Protection Tool
Kaspersky Container Security has received official certification from FSTEC Russia under certificate number 5122 dated October 23, 2026. The product was validated as a means of antivirus protection and meets the regulator’s requirements at the fourth level of trust. It also complies with the protection profile of type B for the fourth class, designated IT.SAVZ.B4.PZ. The certification enables deployment of the solution in government information systems, personal data processing environments, critical information infrastructure facilities, and industrial control systems. Specific usage must still align with individual system requirements and the conditions stated in the certificate. The solution has been listed in the Russian software registry maintained by the Ministry of Digital Development since 2023. Primary audiences include government agencies, large enterprises, and industrial operators that rely on containerized workloads inside regulated perimeters.
Russian Lawmaker Clarifies Apple and Microsoft ORI Registry Listing Does Not Ban Products
State Duma deputy Anton Nemkin stated that the inclusion of Apple and Microsoft in Russia's ORI registry imposes standard data retention obligations without automatically prohibiting their products. The registry entry requires companies to store user information and message exchange records in Russia for three years and message content for up to six months. Nemkin emphasized that these rules apply equally to Russian and foreign digital market participants regardless of business scale or country of registration. The companies were added on October 2, 2026, while Google Meet has been listed since January 26. Although the status mandates data provision to authorized bodies in legally defined cases, the listing itself does not confirm that corporations will share Russian users' correspondence with the state. Non-compliance may trigger separate regulatory measures, but the deputy urged against exaggerating consequences through sensational headlines.
Russia Hands Out 2.2 Million Rubles in Data Leak Fines During First Half of 2026
Russian companies received 13 fines totaling 2.195 million rubles for personal data leaks between January and June 2026, according to new research from InfoWatch. This amount represents a 1.6-fold increase compared to the entire previous year, when total fines reached only 1.385 million rubles. The study shows that Russian penalties accounted for roughly 11 percent of the 115 global fines recorded during the same period. Approximately one quarter of the Russian cases involved violations caused by employee negligence. Organizations in the IT and information security, industrial, and trade sectors were fined most frequently. InfoWatch notes that turnover-based fines have not yet been applied and expects broader enforcement to begin in 2027.
Fines for Telegram Advertising May Be Delayed Beyond Transition Period
Russian authorities are reportedly considering delaying enforcement of new fines targeting advertisers in Telegram after the end of the announced transition period. According to sources cited by the Post- outlet, the government has not yet reached a clear decision on practical application of the advertising ban. Law enforcement agencies are also said to have stepped back from demanding strict punitive measures. Without official confirmation, advertisers and channel owners continue to operate under existing rules. The Federal Antimonopoly Service (FAS) had previously signaled stricter oversight starting in 2027, but current indications point to a possible extension of the status quo. Industry participants are advised to monitor developments closely as the situation remains fluid.