2

I have an application that stores sensitive PII and financial data, and is hosted on a 3rd party server (typical web host). Anything sensitive is encrypted as it goes into the database, and I have no issue with the security of the hosting provider or the server configuration.

However as the application necessarily needs the encryption key to operate on the data, that key must be stored on the same host as the data. Although protected from public access, the question has been asked about rogue insider or 'hacker' at the host end who would presumably be able to access the key.

  • Is there any way to protect against this type of attack, or must we simply trust the hosting provider?

(For purposes of this question, lets ignore application layer risks such as injection attacks. We do what we can to prevent these, but obviously there is always some risk where the application is dealing with the decrypted data.)

  • that key must be stored on the same host as the data That's only true if the database and application are on the same host, which they arguably shouldn't be, for reasons mostly unrelated to the question at hand. – Michael - sqlbot Sep 30 '15 at 11:14
  • technically the web server is separate from the database server, however in this case both are hosted with the same service provider. So, the question really is - is there a way to protect the encryption keys from the hosting provider? – Hearth Sep 30 '15 at 21:17
0

The question is where does the encryption/decryption take place. If they are run on the third party server then there are no means you can protect the key as how and where it is being stored and how it is being used depends solely on the policies of the provider.

There is some literature on the topic and there are approaches that use a key directory to store the keys which can reside either at the provider or on a trusted third party, and upon encryption/decryption keys are being exchanged by the db provider and the trusted third party by using a master key.

The granularity of the encryption can also be specified(the encryption can be done at database, table, partition or low level. A paper that highlights the workings of such a mechanism can be found here.

  • 1
    Very interesting read, looks like as I thought, we have to trust the host. – Hearth Oct 1 '15 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.