New answers tagged

3

Look at the chain of custody. At the point of origin, you have a client; the client has a computer with a secret document, a ZIP program on it, and a secret password. At the point of receipt, you will accept the ZIP file, decrypt it with the secret password, and process it. We can assume that you and your clients are equally susceptible to attack at the ...


3

There are always risk, the ones you are asking about have more to do with physical access and physical loss of the media. As many others have mentioned encryption is going to play a big part in helping with your solution. I'd recommend taking a step back and looking at the specific risks that concern your business and this data in particular then creating ...


3

While everyone else has suggested a hardware solution, I'll suggest a software solution (though I don't mean to imply that it's any better or worse than using an HSM - that you'll have to decide on your own based on your own needs). This solution is a kernel patch which encrypts processes. RamCrypt is a project which encrypts the majority of the memory of ...


1

It depends. Other posters suggest an HSM. This can be a good solution for a limited set of purposes where you temporarily need access to a key, it's erased from active memory after, and the key to the HSM itself isn't stored in memory long-term. It sounds like you need the secret to be active in memory all the time, and not stored in an HSM most of the ...


1

First of all you need to understand what threats and vulnerabilities you protect from and measure your security level against identified risks (e.g., it's useless to have an ability to encrypt sensitive data if you don't have such data). So you need to complete the following steps: Identify risks and possible threat vectors. NIST SP 800-53 with its risk ...


1

Fundamentally, there is nothing that can solve this issue in the absolute. You're running into the DRM problem, which is that you need plaintext access to some data on a system in order to fulfill some functionality, but you're also placing that system under the control of a party which is untrusted. The best you can do is make it incredibly difficult for ...


5

I answered a similar question here. For a normal hardware solution, a hardware security module (HSM) does this. For software, .NET offers the Secure String mechanism to encrypt and protect sensitive data in RAM. Other platforms may offer something similar. For an AWS solution, Amazon offers CloudHSM to do pretty much what you are asking for, I think. ...


1

I'm not sure if I get you right. But at some point the plain secret has to be in some sort of memory (most likely the RAM). If the attacker can read the memory at that point and if he is able to find the secret he can decrypt the data afterwards. I think theoretically there can't be a way (maybe with some special security module that contains your program ...


0

This is a key issue with using cloud services. Since you do not own the equipment you cannot simply run your own penetration testing without the cloud provider giving consent, and most likely support. Therefore you will likely have to use softer, more qualitative measures. Ensure that if you are deploying your own software via a cloud provider to operate ...


0

You can run a nessus scan on the system.(http://www.tenable.com/products/nessus-vulnerability-scanner) Also, it is a good practice to have a rest api testing framework. It would help you automate and audit the software against known vulnerabilities.



Top 50 recent answers are included