prest

Least-privilege permissions

• Database user accounts: Create separate database accounts for the prest connector with only the specific tables and operations it needs—never use admin/root credentials. Example: if prest only reads customer data, don't give it write access to financial records.
• ACL (Access Control List) configuration: Explicitly define who can access which API endpoints and data. Avoid "allow everything" defaults; instead, whitelist only the specific users or applications that need each resource.
• Row-level restrictions: When exposing customer or sensitive data, configure prest to automatically filter results by user identity—so each user only sees their own records, not the entire database.
• API key rotation: Change authentication keys regularly (monthly minimum) and revoke old ones immediately when team members leave or roles change.

Network isolation

• Firewall rules: Restrict prest's database connection to a private network segment; block public internet access to the database unless absolutely required for remote offices (then use a VPN).
• Environment variable protection: Store database passwords in a secrets management system (e.g., AWS Secrets Manager, HashiCorp Vault) rather than plain text files or logs; never commit credentials to version control.
• HTTPS enforcement: Require encrypted connections (TLS/SSL) for all API calls to prest; disable unencrypted HTTP.
• Separate service accounts: Run prest under a dedicated operating system user account with minimal system-level permissions, isolated from other applications.

Monitoring

• Query logging: Enable database query logs to detect unusual access patterns, large bulk exports, or unexpected SQL commands that could signal an attack.
• Failed login alerts: Set up automatic notifications when authentication attempts fail repeatedly or at odd times—sign of someone probing for unauthorized access.
• Data access audit trail: Log who accessed which API endpoints and when; review these logs weekly for suspicious activity.
• Performance baselines: Track normal data transfer volumes and response times; sudden spikes in downloads or slow queries may indicate data theft in progress.

Red flags to watch for

• Unmaintained dependencies: Check that prest receives security updates regularly. If the project has no new releases for 6+ months, evaluate switching to alternatives or conducting a security audit before proceeding.
• Exposed credentials in logs or error messages: If passwords or API keys appear in application output or system logs, treat as a breach and rotate them immediately.
• Overly broad API responses: If a single API call returns thousands of customer records without filtering, access controls are likely misconfigured—restrict immediately.
• Unexplained database growth or missing data: Unauthorized copying or deletion of records may indicate a compromised connection; trigger an incident investigation and review access logs.