Protecting emails in your database

Question

It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database.

Not just from hacking, but from disgruntled employees or engineers losing a laptop with a copy of the database etc.

Unlike the password, we'd need to get the original email out periodically (so a two way encryption would probably be necessary) but we also don't want emails sitting around in the clear, or accessible from admin interfaces with employees all over the world.

For example - we hire salespeople all over the world, and as part of their job they need to email customers. Also if a customer emails support we need to match their account by email. But we also don't want salespeople or customer support staff to be able to scrape a list of a million custom emails and walk out the door with it.

We can do rate limiting etc on our own site, but third party vendors (think SalesForce and the like) have customer emails also.

I'm wondering what best practices large companies have developed for this. I was thinking of doing an obfuscated email (sort of like craigslist) and using this for all employee screens and third party vendors. This email would forward to the user through some special postfix server I setup, but could be turned off if the obfuscated one got out in the wild.

Then maybe only allow sending from certain addresses (or ip's) since an email blast could still go out to all obfuscated emails before we were able to turn it off?

This could require a large whitelist though, since we work with a handful of third party vendors that email customers on our behalf.

Any help or ideas appreciated! I imagine this has been solved before at larger companies. Thanks!

Answer 1

There is a great book about this and lots of similar problems from Peter Wayner, called Translucent Databases

About this question:

• you can find customer by email if you store hashes of emails and compare them to the hash of the search query (exact matches only, sorry)

• then, a salesperson could send an email via some kind of web app or a SMTP gateway which redirects hash@yourcompany.com to customer@domain.com, performs rate limiting AND logs who performed the request

This will do a good job against accidental errors, but for more detailed scheme you should more carefully model your "attackers" and business processes, and then apply practices from the aforementioned book (or similar ones)