Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Comparing ways of distributing and securely storing and querying structured and schemaless data.

Currently I am using MongoDB, but am looking into (Postgres|MySQL)&CryptDB, Cassandra and others.

What do I need to keep in mind, for securely storing and expressively querying [potentially] massive data?

share|improve this question
    
It depends what you mean by secure. Who is the adversary? –  mikeazo May 11 at 21:34
    
External hackers, data-centre owners (worst case scenario: ensuring privacy and integrity in the untrusted cloud) and authorised non-administrative users. –  A T May 12 at 6:17

1 Answer 1

up vote 0 down vote accepted

Sticking with MongoDB, and will setup:

  • 256-bit encryption of database filesystem (GridFS)
  • TLS between database servers and applications servers
  • TLS between application servers and consumers
  • User authentication on the application servers (scrypt for password, expiring tokens for login, x509 certs required for generating+using client_id, client_secret)
  • User authentication on the database servers
  • Internal message-passing queue
    • Two-time use username+password should be generated and stored in encrypted database.
    • Password used to encrypt message payload, username added into header.
    • Popping message hits database for password, which is then used to decrypt payload.

Frontends consuming my RESTful API can add another level of security: encrypting data before it hits my application and database servers. HIPAA and other compliance will also be checked before opening for beta testing.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.