0

So I will be accepting some sensitive information via a html form, I will be using PHP to store the information. All this has been set up, tested etc. The form works in 4 "steps", each step is its own unique html form on a separate php page (step1.php, step2.php, step3.php, step4.php).

My issue is now we are starting to store some sensitive information (SS numbers, phone numbers, work history, etc) it is only stored by us through the duration of the form steps once they submit at step4 all information is sent to a secure environment and stored safely there (the remote server is not under my control) and removed from our environment.

The data is getting stored in PHP sessions, which stores the data in tmp files all temp files are auto removed every 30 min just in case a sessions never completed all information is still removed.

So it comes to the real question now that you have all the information, should I be encrypting this data? I dont know much about crypto and standards.

2
  • These temp files are removed (overwritten) or just OS-deleted? Dumpster diving is an effective hacking strategy, and virtual dumpster diving (examining deleted but not overwritten files) is probably even more effective. Consider the catastrophic consequences of being fingered as the start point of 100 identity thefts, to you and to the victims. If people entrust you with the kind of information you list in the question, it is incumbent on you to protect that information at least as vigorously as they would. Juggle nitro if you like, but never store sensitive customer info in the clear.
    – WDS
    Commented Sep 27, 2015 at 22:36
  • Thank you for your input. I was just doing a OS-delete. I changed my system to overwrite those bytes of data several times now. Hopefully overwriting the files (10x times in this case with random data) is enough to prevent this type of attack.
    – AZer0
    Commented Sep 28, 2015 at 12:41

2 Answers 2

0

You have few options to handle sensitive information

  1. collect the data and return it to client for each step (through hidden form data) to ensure that neither server or client is storing the data at any time.
  2. Store the data on client side (using cookie, local storage, etc) and then clean up the same once the process is completed. This will ensure that you do not keep any data on server side.
  3. Store the data on server side for the duration of transaction i.e. session data must be deleted as soon as the transaction is completed.

If you want to store the data on server side, encryption is definitely recommended. Based on your description, it looks like you are NOT planning for failover. Keeping that in mind, you can

  1. Use tmpfs (RAM Disk) to store session data files which will avoid writing the data to disk (cleaning disk as indicated by others can be tough).
  2. Generate a long encryption key at startup and store it in $Global. Use that key to encrypt and decrypt the data before storing and after retrieving data from session.
  3. In case you are using shared session infrastructure (like memcached), you will have to come up with a more complicated setup to ensure that your encryption key is appropriately shared with and adequately protected by all the servers that are part of infrastructure. In addition to that additional protocols will be needed for refreshing the keys.
1
  • Thank you! This is exactly what I was wondering about. You were correct to assume not worrying about failover, I would rather loose the data forever then have it stored unsafely.
    – AZer0
    Commented Sep 28, 2015 at 12:39
0

If someone gains access to your system while its running then even if you encrypt your data the attacker can simply use the same key to decrypt it. So in that case no security is added.

However, if an attacker is able to get physical access to the server and steals the storage medium then having the data encrypted would deny him access if the password is only stored in memory (and randomly created at bootup). You would have to be careful though that any files you store are stored immediately in encrypted form and never touch the harddrive because in that case they might still be recoverable.

1
  • Thank you! I didnt even think about the fact that if they gain access to the server they will have access to the key.
    – AZer0
    Commented Sep 28, 2015 at 12:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .