1

I currently have a requirement to store bank account information (transit numbers/account numbers/routing numbers) and I need to know how best to store them and retrieve them from the database.

I'm currently using Amazon's RDS to store the data, and I've turned on the AES-256 encryption at rest feature. I believe this encrypts the data on the volume, but I don't know if it's enough to secure the bank accounts.

My current line of thought is that I should keep a secret on the server and whenever writing the bank account I should AES-256 encrypt it with the secret and save that encryption on the entity. Whenever retrieving that entity I'll have to decrypt it manually using the secret (serverside).

My thinking is if the Database is ever compromised (even with the RDS encryption) they wont get bank account information. I should also note that the database should be locked down only allow connections coming from the server the code is running on. Maybe in my case, this is overkill?

My main questions are:

  • Is this a good method to use store bank accounts?
  • Is this necessary if I'm using AWS RDS's encryption feature or is it overkill?
Improve this question

1 Answer 1

Reset to default
0

No. If your secret is on the same server you are encrypting the data on, you are making a mistake. It should be separate and physically secure, preferably on an encrypted USB drive. If you need to encrypt data while you are not around, I would suggest encrypting it with a public key and then decrypting it later, separately. However, if neither of these is an option, I suppose security by obscurity is still an option (however meager it might be)....

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .