How to store & use sensitive data in Java

Question

I have a several Spring Boot applications that use BCryptPasswordEncoder to encrypt data I'll never need to directly use again - passwords, for example. However, I have quite a bit of sensitive data (SSN, credit cards) that I need to store securely, but will also need to use at some point. I could use something like Authorize.net (although this seems really expensive for our startup) to store the credit card info, but I still need SSN and other personal information.

My post on Stack Overflow suggested using symmetric keys, but I was hoping someone here might know a best practice, open source solution to securing data. I thought about using the db (PostgreSQL) but I heard that has issues as well.

Answer 1

For storing credit cards specifically, you need to weigh the costs of using Stripe, PayPal, or similar, or storing the cards yourself and the costs, financial and legal, should that data become compromised. QSAs have been getting tighter and tighter with all of the breaches that have been happening lately. That's a decision you'll have to make. It may be with the number of cards you have, and the frequency, you'll find it cheaper to store them yourself.

However, I would encourage you to find a QSA to talk to. PCI-DSS, as well as Visa, Mastercard, and other network operators, have their own requirements.

Answer 2

You can use Java Keystore to store the symmetric key that you can use to encrypt or decrypt the data before storing it in database. Depending up on your budget and deployment scenario, you may want to consider HSM which may be a bit costly. You may also want to look at Hashicorp Vault.

Read OWASP for other best practices you can follow.

It can be tough to get these process correct and depending on your specific vertical (e.g. payment processing, medical) you may want to balance the risk of storing and managing PII and other payment information in your infrastructure vs cost of outsourcing it to external more experienced third party who can use better security tools (like HSM) and processes to reduce the risk of data compromise.

Answer 3

You can try Bouncy Castle for securing data in Java.