I'm a computer science student looking to expand an already developed web application into using multi-tenant architecture. Considering I'm far from being a security expert, which precautions can I take to my application as secure as possible? Here's how I've been thinking to do it, most of it based on this article from msdn: http://msdn.microsoft.com/en-us/library/aa479086.aspx
This is what I used to develop the software and as I exclusively use it's ORM, I should be well protected against SQL injections. Passwords are hashed and all forms are CSRF protected. I'm thinking of somehow prohibiting users from using weak passwords, ideas? Any other precautions I should take?
Shared Database, one Schema per Tenant
I've decided to go with this solution because this still grants me good security ("moderate degree of logical data isolation") and I don't have to change my code much. A tenant can be identified solely from the subdomain, for example tenant1.website.com. I can simply tell the database to use the schema tenant1. Here I don't know if I should create a database user for each of the tenants, the article calls this as: "a combination of the impersonation and trusted subsystem approaches". Basically it creates an user for each tenant that has permissions only on that schema. Does this make sense? Where would I store the password for each user?
Symmetric encryption for sensitive data
I actually don't store any super important info like credit cards numbers, but there are a couple of fields which would be nice if they were a bit safer. Tenants will be storing reports that should not be visible to their competitors. As these fields will be text-heavy (max 70000 chars) I was thinking of using symmetric encryption (AES-128) on these fields. Is it ok if all tenants share the same key? Can I store the key in the source code?
Wildcard SSL Certificate
As all tenants will be on the same "server" (cloud: amazon ec2), with each tenant in it's own subdomain, it should be ok to use wildcard certificates, right? I'm thinking RapidSSL as our budget is very lean (edit: at the beginning probably only one instance).
Is there any other thing I've been completely forgetting?