I work for a hotel. The hotel stores a MySQL database online. This database only contains a Reference ID, number of nights and so on, but no private data. No names, no personal information on guests. So if it fully leaks, it doesn't matter as much.
Then I have a new laptop (Windows 10), with Bitdefender and Zone Alarm. This laptop does not have any other software installed other than Microsoft Office nor is it used for anything else but one purpose.
The laptop has a .xls with customer names, phone numbers, email addresses in cleartext. A small Visual Basic program I wrote sends a feedback email (via SMTP) to each guest after their stay.
Now my questions are as follows:
Is this setup safer than storing encrypted versions of their emails and phone numbers in the MySQL database?
Since the IP of the laptop leaks when an email is sent via SMTP (an attacker would know the local IP) is there a risk of somebody attacking the laptop via the internet?
Would it be safer to deploy the .xls and the macro on a Windows based server?
How safe is this type of setup, what would your thoughts and advice be?
Keep in mind that I do have to be able to retrieve the emails and phone numbers on the laptop in order to send the emails.