1

Context

I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in reports.

The problem is that I really want to secure the datas stored, meaning that I want my datas to be read-able only by the user and the server (Because it's exposed using a RESTful API, to server an angularjs application).

Data is stored in a graphdb called neo4j

Already thought

  • Storing an encryption key in each user node

    • Problem is that if someone steals my database, they just have to find the algorithm used to encrypt and they can get every flaw of every website.
  • Encrypt data sent by user with it's password (clear) on client side, so the server doesn't know the key since he is only storing the hashed password.

    • Problem is that the server will not be able to store encrypted data if he doesn't know the encryption key.

How can I achieve that? I really need to secure my data at this point, meaning that even if you steal the database, it's impossible to get data out of it, unless you are... me or the developper who created the encryption system.

  • Have you tried letting users download the report and then deleting the data from the server? – Deer Hunter Dec 1 '15 at 18:17
  • I did not have this idea, but the problem with this is that I need to store the scan data, so destroying it is not an option – Supamiu Dec 1 '15 at 18:36
1

One of the main cryptography principle is Kerckhoffs's principle: "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge".

So the option with special key for every user sounds reasonable. Selected algorithm and key length should be strong enough to protect data in case when database is stolen. Recommendations for selecting algorithm and key length can be found in OWASP guide https://www.owasp.org/index.php/Guide_to_Cryptography

The main issue in that case would be how to protect user keys from stealing and implement appropriate key management. The following items should be taken into account during implementation process:

  • Key storage: file or HSM (like SafeNet)
  • Frequency of key rotation (e.g. change keys once a year)
  • Master key (a key from storage with other keys) protection
  • What a detailed answer ! thank you for this, you helped to create a useful app for a lot of people, at least I hope. – Supamiu Dec 1 '15 at 18:39
  • So, you suggest me to store keys everywhere but in the database? – Supamiu Dec 2 '15 at 8:31
  • Yeah, encrypted data and keys should be stored separately. – Salamander Dec 2 '15 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.