Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We create PDF files as relevant to a customer's e-mail communication. These PDF's contain some personal information, specific to the client. The client is emailed a link to the PDF. The link to the PDF contains a 40 byte unique string specific to this communication to ensure uniqueness and to avoid guessing.

Is there any best practice concerning this approach, may the PDF-files be placed on the webserver directly, or should additional steps be taken in order to prevent harvesting or any other attack on our customers privacy?

Would there be an additional security gain in storing the PDF's in a database, instead of placing them directly on the file-system of the webserver (assuming it is properly secured)?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

My suggestion would be as follows:

  • Store the PDFs on a LUKS partition (or GPG full-disk / TrueCrypt full-disk), so that theft of the physical disks should not yield the data.
  • Run a secondary HTTP server whose sole job it is to serve these files. Configure your file permissions such that only that HTTP server can read the PDFs. This provides minimum attack surface for data theft, and prevents the main HTTP server from reading the files.
  • Set up single sign-on or something similar to authenticate between the two servers.
  • Only serve the files over HTTPS, with SSL 2.0 and older disabled, preferably with AES-GCM set as the preferred cipher.

Storing them in the database wouldn't make much sense, since access to the disk would still yield the files.

share|improve this answer
add comment

Regardless of the length and complexity of the unique string, a file name can be guessed or a compromised communication link may be intercepted to learn the file names.

Why aren't you utilizing a method like scp, if all you are doing is to make pdf files available to your client ? This way, you can either force the user(recipient) to enter a password or have a pre-authorized ssh key, to retrieve his/her files ? Since either way, the end user have a unique piece of identifying information, access can be limited to those, who has the right ID information. Hence making the whole scheme more secure.

Just a thought...

share|improve this answer
1  
SCP is hardly a good fit for client usability, especially if they're non-technical. –  Polynomial May 23 '13 at 10:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.