Workflowlogo
Search

Security Documentation

Cloud Security Services

Nobus cloud provides comprehensive cloud security services designed to protect your data, applications, and infrastructure from evolving cyber threats.

With a focus on protecting sensitive information and ensuring compliance with industry standards, our solutions are tailored to meet the unique needs of your organization. We leverage state-of-the-art technologies and best practices to ensure a secure environment for your business operations.

Shared Responsibility Model

Provider (Nobus)

Security OF the Cloud

Our key responsibilities include protecting physical data centers and network systems, implementing encryption for data at rest and in transit, and managing access using multi-factor authentication (MFA) and role-based access control (RBAC).

  • • IDS/IPS deployment
  • • Incident response planning
  • • Regulatory compliance (GDPR, ISO 27001, PCI DSS)
  • • Standard SLA security measures
Customer (You)

Security IN the Cloud

Cloud users have several important responsibilities, including protecting data by encrypting sensitive information before uploading, managing access through strong password policies, and securely configuring cloud resources.

  • • Data Encryption & Management
  • • MFA enforcement for users
  • • Monitoring suspicious activity
  • • Compliance within the environment

Key Features

1. Data Protection

In Transit: Data transmitted between your systems and our platform is secured with TLS (Transport Layer Security).

2. Access Control
  • Identity Management: Robust policies to manage user identities.
  • MFA: Enhanced security with two-step verification.
3. Threat Detection
  • IDS: Continuous monitoring of network traffic for threats.
  • SIEM: Real-time analysis of security data.
4. Compliance & Governance
  • Regulatory: Adherence to standards like GDPR, PCI-DSS, and ISO 27001.
  • Policy Management: Customizable governance policies.
5. Network Security
  • Cloud Firewalls: Protect against unauthorized access and DDoS.
  • VPN Solutions: Secure remote access to sensitive data.
6. Incident Response
  • Plans: Tailored strategies to address breaches.
  • Backup: Solutions ensuring business continuity.

Regular Security Audits: We perform periodic security assessments to identify vulnerabilities and ensure compliance with industry standards.

Database Authentication with Nobus Managed Databases

Nobus Managed Database Service supports several ways to authenticate database users to ensure your data remains secure and accessible only to authorized personnel.

On this page

Password, Kerberos, and IAM database authentication use different methods of authenticating to the database. Therefore, a specific user can log in to a database using only one authentication method.

For PostgreSQL, use only one of the following role settings:

  • To use IAM authentication, assign the rds_iam role to the user.

  • To use Kerberos authentication, assign the rds_ad role to the user.

  • To use Password authentication, do not assign either role to the user.

Important

We strongly recommend that you do not use the master user directly in your applications. Instead, adhere to the best practice of using a database user created with the minimal privileges required for your application.

Password Authentication

With password authentication, your database performs all administration of user accounts. You create users with SQL statements such as CREATE USER.

CREATE USER 'user_name' IDENTIFIED BY 'your_password';

Database authentication might be easier to administer using password authentication when you have small user communities. Integrating aNobus Secrets Manager can enhance security by automatically rotating passwords.

IAM Database Authentication

You can authenticate to your DB instance using Nobus Identity and Access Management (IAM). With this method, you don't need to use a traditional password; instead, you use a short-lived authentication token.

Kerberos Authentication

Nobus supports external authentication of database users using Kerberos and Microsoft Active Directory. This provides the benefits of single sign-on (SSO) and centralized management of database credentials.

Currently, Kerberos authentication is not supported for MariaDB DB instances on the Nobus Cloud.

Password Management for Nobus Managed Databases

Learn how Nobus manages administrative passwords for your database clusters and how to access your credentials directly from the management dashboard.

On this page

Overview

Nobus Managed Database Service simplifies credential management by generating and storing administrative passwords for your clusters during creation. Unlike complex environments requiring external Secrets Managers, Nobus provides a centralized, easy-to-access method to retrieve your connection details.

Note

Nobus currently manages passwords at the account level. While fine-grained role-based access control (RBAC) and automated secret rotation via a secondary manager are not utilized, security is maintained through encrypted console access and internal hardware-level isolation.

Viewing Database Credentials

You can view the master username, hostname, and password for any running database cluster at any time.

1
Access the Dashboard

Log in to the Nobus Management Dashboard using your account credentials.

2
Select your Database

Navigate to the Database Services section and click on the specific cluster you wish to manage.

3
Reveal Credentials

Under the Configuration or Details tab, locate the credentials section. Click the Show icon to reveal your password.

Dashboard Credentials UI View

Security Best Practices

Application Security

Never hard-code passwords in your source code. Use environment variables in your deployment settings to store credentials securely.

Account Protection

Since credentials are visible via the console, ensure Multi-Factor Authentication (MFA) is enabled on your primary Nobus account.

Data protection in Nobus RDS

Shared Responsibility Model

The Nobus shared responsibility model applies to data protection in Nobus Relational Database Service. Nobus is responsible for protecting the global infrastructure that runs all of the Nobus Cloud. You are responsible for maintaining control over your content hosted on this infrastructure, including security configuration and management tasks.

Security Recommendations

Multi-factor Authentication

Use MFA with each account to prevent unauthorized access.

Secure Communication

Use SSL/TLS 1.2 or 1.3 to communicate with Nobus resources.

Activity Logging

Set up API and user activity logging with Nobus CloudTrail.

FIPS Endpoints

Use FIPS-validated cryptographic modules for command line access.

Important:We strongly recommend that you never put confidential or sensitive information, such as your customers' email addresses, into tags or free-form text fields such as a Name field. Any data entered into these fields may be used for billing or diagnostic logs.

Protecting data using encryption

At Nobus, security is a top priority. You can enable encryption for your database resources to protect data at rest, and you can also encrypt active connections to your DB instances to secure data in transit.

Documentation Topics

Encrypting Nobus RDS resources

Learn how to enable encryption at rest for your DB instances and clusters.

Nobus KMS key management

Manage the cryptographic keys used to protect your database resources.

SSL/TLS for Connections

Secure your data in transit by encrypting connections to your database.

Rotating SSL/TLS Certificates

Maintain security by regularly updating your database certificates.

Standard Security Compliance

Nobus encryption leverages industry-standard AES-256 algorithms. Always ensure your applications are configured to require SSL connections for maximum data integrity.

Encrypting Nobus RDS resources

Nobus RDS can encrypt your database instances at rest. Data encrypted includes the underlying storage, logs, automated backups, read replicas, and snapshots.

Uses industry-standard AES-256 encryption algorithm.

Transparent decryption with minimal impact on performance.

Note: Data in transit between source and read replicas is automatically encrypted, even across regions.

Key Management Overview

Nobus RDS uses the Nobus Key Management Service (KMS) to handle encryption. You can choose between Nobus-managed keys or create your own customer-managed keys.

Key Selection: You must choose your KMS key during instance creation. You cannot change the key after the instance is created.

Snapshots: When copying an encrypted snapshot, you can specify a different KMS key for the target.

Read Replicas: Replicas in the same region must use the same key as the primary instance.

Cross-Account: Snapshots encrypted with AWS managed keys cannot be shared directly; use customer-managed keys for sharing.

Important: Key Accessibility

If Nobus RDS loses access to the KMS key (e.g., if the key is disabled), the instance enters an inaccessible-encryption-credentials-recoverable state.

  • You have 7 days to restore key access before the state becomes terminal.
  • We strongly recommend enabling automated backups for all encrypted instances.

Verifying Encryption Status

Nobus Console
  1. Sign in to the Nobus RDS Console.
  2. Navigate to Databases and select your instance name.
  3. Under the Configuration tab, locate the Storage section.
  4. The Encryption field will display either Enabled or Not enabled.
Command Line (CLI)

Run the following command to query the encryption status:

nobus rds describe-db-instances --db-instance-identifier mydb --query "*[].{StorageEncrypted:StorageEncrypted}" --output text

Limitations

1

Encryption must be enabled at creation time.

2

You cannot turn off encryption on an existing instance.

3

Snapshots must use the same KMS key as the parent instance.

4

Unencrypted backups cannot be restored to an encrypted instance.

© 2026 Nobus Cloud. All rights reserved. Built for high-performance cloud environments.

Nobus KMS key management

Nobus RDS automatically integrates with Nobus Key Management Service (KMS) to handle encryption. The service utilizes envelope encryption to protect your data with high-performance security.

Nobus RDS uses envelope encryption to protect the master keys themselves, ensuring your data remains secure even in complex multi-tenant environments.

Supported Key Types

Customer Managed Keys

Provides full control over the KMS key, including creation, rotation, policies, and deletion.

Nobus Managed Keys

Default keys created in your account by Nobus (identified as nobus/rds). These are maintained automatically by the platform.

Authorizing Customer Managed Keys

To create an RDS resource using a customer-managed key, the IAM user must have explicit permissions to call the following operations:

  • kms:CreateGrant

    Allows RDS to use the key for cryptographic operations on your behalf.

  • kms:DescribeKey

    Allows the service to identify the key properties and status.

Nobus RDS Encryption Context

Nobus KMS uses an encryption context—additional authenticated data (AAD)—to ensure data integrity. This context is logged in your Nobus CloudTrail audit logs to help you track key usage.

Example: DB Instance ID Context

{ "nobus:rds:db-id": "db-CQYSMDPBRZ7BPMH7Y3RTDG5QY" }

Example: Multi-Resource Context (DB + EBS)

{
  "nobus:rds:db-id": "db-BRG7VYS3SVIFQW7234EJQOM5RQ",
  "nobus:ebs:id": "vol-ad8c6542"
}

Security Tip: Least Privilege

Do not allow full access to kms:CreateGrant. Instead, use the kms:ViaService condition to ensure the key is only used when the request originates from rds.nobus.io.

Built for security-conscious enterprises. © 2026 Nobus Cloud Services.

Using SSL/TLS to encrypt a connection

Secure Socket Layer (SSL) and Transport Layer Security (TLS) provide a critical layer of security by encrypting data as it moves between your application and your Nobus RDS database.

Data Encryption

Encrypts all traffic in transit between the client and the server.

Identity Verification

Validates that you are connecting to a trusted Nobus DB server.

Implementation Process

01

Choose a Certificate Authority

Select the CA (e.g., RSA 2048) that signs your DB server certificate.

02

Download the Bundle

Download the PEM or PKCS7 bundle for your specific Nobus Region.

03

Configure DB Engine

Implement the engine-specific logic to require SSL in your connection string.

Engine-Specific Guides

PostgreSQL
MySQL
MariaDB
Microsoft SQL Server
Oracle

Certificate Bundles

Download the standard root certificate bundles to register the Nobus CA in your application trust store.

Bundle TypeFormatAction
Global BundlePEMDownload
Global BundlePKCS7 (p7b)Download

Supported Certificate Authorities

CA IdentifierAlgorithm
nobus-ca-rsa2048-g1RSA 2048 / SHA256
nobus-ca-rsa4096-g1RSA 4096 / SHA384
nobus-ca-ecc384-g1ECC 384 / SHA384

Nobus RDS Proxy Note

If you are using Nobus RDS Proxy, the proxy handles the TLS termination using certificates from the Nobus Certificate Manager. You do not need to download these bundles for proxy connections.

Built for high-performance secure environments. © 2026 Nobus Cloud.

Rotating your SSL/TLS certificate

Mandatory Security Update

Nobus RDS Certificate Authority certificates (rds-ca-2019) expired in August 2024. To avoid connectivity interruptions, all instances must be updated to the new CA identifiers:nobus-ca-rsa2048-g1,nobus-ca-rsa4096-g1, ornobus-ca-ecc384-g1.

Available Update Methods

Instance Modification

Immediately update the CA by manually modifying the DB instance configuration.

Maintenance Window

Schedule the update to occur automatically during your next defined maintenance window.

How to Update

1

Sign in to the Nobus RDS Console.

2

Select 'Databases' and choose the instance you wish to update.

3

Click 'Modify' and navigate to the Connectivity section.

4

Change the Certificate Authority setting to the new version (e.g., rsa2048-g1).

5

Choose 'Continue' and select 'Apply Immediately' to trigger rotation.

Automatic Server Rotation

If your engine supports rotation without restart, Nobus automatically handles the process during your maintenance window once the new CA is registered.

Rotation Supported

Certificate valid for 12 months. No downtime required.

Rotation Not Supported

Manual update required. Certificate valid for 36 months.

Trust Store Import Script

Use this shell script to import the Nobus certificate bundle into your Java trust store (JDK required).

# Create certs directory
mydir=tmp/certs
mkdir -p "${mydir}"

# Download bundle
curl -sS "https://truststore.nobus.io/global/global-bundle.pem" > ${mydir}/global-bundle.pem

# Import into Keytool
keytool -import -file ${mydir}/global-bundle.pem -alias "nobus-root-ca" -storepass changeit

Secure cloud operations by Nobus. © 2026 Nobus Cloud Services.

Internetwork traffic privacy

Nobus ensures that your data remains private and protected as it moves across networks. Connections are secured both between Nobus RDS and your on-premises applications, as well as between RDS and other Nobus Cloud resources within the same region.

Private Connectivity Options

To establish a secure bridge between your private network and the Nobus Cloud, you have two primary options:

Site-to-Site VPN

Create an encrypted tunnel between your data center and your Nobus Virtual Private Cloud (VPC).

View VPN Guide

Nobus FastTransit

Establish a dedicated, high-speed physical network connection bypassing the public internet.

View FastTransit Guide

Encryption Requirements

All network-based API operations for Nobus RDS require modern cryptographic standards to ensure traffic privacy.

  • Transport Layer Security (TLS)

    We require TLS 1.2 at minimum and strongly recommend upgrading to TLS 1.3.

  • Perfect Forward Secrecy (PFS)

    Clients must support cipher suites like DHE or ECDHE to ensure session keys aren't compromised.

Request Signing

Every request to Nobus RDS must be digitally signed using your Access Key ID andSecret Access Key associated with your IAM principal. You may also use the Nobus Security Token Service (STS) to generate temporary, short-lived credentials.

Traffic flowing between Availability Zones (AZs) is automatically encrypted at the physical layer before leaving Nobus secured facilities.

Built for high-performance privacy. © 2026 Nobus Cloud Services.

Advanced Cybersecurity Services

We offer robust cybersecurity solutions to protect your business from a variety of threats. Offerings include FortiGate Firewall, Sophos XG Firewall, and Acronis Cyber Protect. Each solution is designed to enhance your security posture, ensuring your data and applications are safe from cyber threats. We also provide comprehensive support to assist you whenever needed.

Sophos XG Firewall

Sophos XG Firewall brings a fresh new approach to the way you manage your firewall, respond to threats, and monitor what’s happening on your network.

It provides all the latest advanced technology you need to protect your network from ransomware and advanced threats including top- rated IPS, Advanced Threat Protection, Cloud Sandboxing and full AI-powered threat analysis, Dual AV, Web and App Control, Email Protection and a full-featured Web GUI.

Some key features include:

  • Synchronized Security: Automatically responds to threats based on real-time data from endpoints.
  • Advanced Threat Protection: Detects and mitigates sophisticated threats using machine learning and artificial intelligence.
  • Central Management: Unified management console for monitoring and managing network security.
  • User Awareness: Provides insights and reports on user activity to enhance security policies.
SET UP

If the following minimum server requirements are not met, XG Firewall will go into failsafe mode:

  • Two vCPU
  • 4 GB vRAM
  • 2 vNIC. ( warning! the Network maximum transmission unit (MTU) for Nobus is 1458 )
  • DiskI with code name Security-Sophos-XG-Firewall-DiskI: Minimum 30 GB
  • DiskII with code name Security-Sophos-XG-Firewall-DiskII: Minimum 80 GB

For optimal XG Firewall performance, configure vCPU and vRAM according to the license you have purchased. Do not exceed the maximum number of vCPUs specified in the license.

STEPS

Create Two Root Volumes (Primary and Auxiliary)

The boot source of the two volumes are; (a) Security-Sophos-XG-Firewall-DiskI: Minimum 30 GB and (b) Security-Sophos-XG-Firewall-DiskII: Minimum 80 GB images respectively.

To create these volumes, log in to the Nobus Management Console.

Goto Project > Volumes > Volumes

Click on the “ + Create Volume” button. On the new Create Volume window, provide the neccessary inputs as specified below.

  1. Volume Name
  2. Description (optional): primary volume
  3. Volume Source: Select Image
  4. Use image as a source: Choose Security-Sophos-XG-Firewall-DiskI
  5. Size: minimum 30 GB
  6. No need to specify other inputs
  7. Click on the Create Volume button below to create the volume

Repeat the steps above to create the auxiliary volume but this time;

  1. Use image as a source: Choose Security-Sophos-XG-Firewall-DiskII
  2. Size: minimum 80 GB
  3. No need to specify other inputs
  4. Click on the Create Volume button below to create the volume

After the two root volumes had finished creating, you can then proceed to creating your sophos xg firewall instance with the next step.

Contact cloud support if you need assistance.

Acronis Cyber Protect

Protect your mission critical Systems from Servers to desktops/Laptops with Nobus Cloud Backup (NCB). With NCS, Our cloud customers can now provide an extra layer of backup & Cyber security for their applications at a fractional monthly cost. On-Premise customers, and customers hosting their applications with other 3rd party cloud providers such as AWS, Azure, GCP or VMWare-Based hypervisors can now backup and protect their applications and critical user data on Nobus platform

Some key features include:

1.Advanced Backup & Recovery for various workloads (Cloud & On-premise, Nobus cloud or 3rd party cloud)

2. Ransomeware Protection for all systems

3. Forensic Backup

4. Vulnerability scan across your system

5. Antivirus Protection

6. Single view for management of all Protected workloads

7. NDPS cuts your Cyber protection costs by up to 50%, boosts your monthly recurring revenue, while delivering best in className Cyber protection for your applications and data.

To protect business-critical data, backup is not enough – customers need the integrated approach of cyber protection. Paired with Nobus Cloud Backup, the Advanced Backup pack enables our customers to extend the cloud backup capabilities required to proactively protect their data. Available in consumption-based or per-workload licensing models, you can easily minimize data loss across your infrastructure and workloads with the best-in-breed backup and recovery technology that is enhanced with cyber protection. See the Customer support documentation or download the User guide and Admin guide.

To get started with creating your Acronis Cyber Protect Instance, Select acronis-cyberprotect from image list during instance creation

Note:

Min Disk(GB) is 100 and Min RAM(MB) is 8192

Contact cloud support if you need assistance.

FortiGate Next-Generation Firewalls (NGFWs)

FortiGate Firewall network security solution provides comprehensive security features designed to protect networks from various threats.

Some key features

  • Next-Generation Firewall (NGFW):
    Combines traditional firewall capabilities with advanced features like intrusion prevention, application control, and deep packet inspection.
  • Unified Threat Management (UTM):
    Integrates multiple security functions into a single device, including antivirus, web filtering, and VPN support.
  • High Performance:
    Designed to handle high volumes of traffic with low latency.
  • Secure SD-WAN:
    Provides secure software-defined wide area network capabilities.
  • Centralized Management:
    Enables centralized control of multiple FortiGate devices.
  • Cloud Integration:
    Secures cloud environments and integrates with cloud services.
  • Threat Intelligence:
    Utilizes FortiGuard Labs for real-time threat intelligence.

Use Cases

  • Enterprise Security:
    Protecting corporate networks from cyber threats.
  • Remote Access:
    Providing secure VPN connections for remote workers.
  • Compliance:
    Helping organizations meet regulatory requirements.
  • Branch Office Security:
    Extending security to remote offices.

FortiGate Firewalls are versatile, high-performance security appliances used by organizations of all sizes to safeguard their networks against a wide range of threats while simplifying management and improving operational efficiency.

To get started with creating your FortiGate Firewall Instance, Select Security-Fortigate-FortiOS list of supported images during instance creation.

Contact our cloud support team to get started with setting up your database cluster.