My team is outsourcing some of its IT management, including the administrative role.

Since our income is based on data we store in the DB, I would like to avoid sharing access to it with the untrusted team abroad.

My resolution for this issue is to create separate encryption micro-service, managed by a trusted core person, which will encrypt the sensitive data.

The problems I can see with such solution are:

  1. External encryption over the network might significantly slow down each process.
  2. Separated server might crash and decrease uptime of the service since there is no dedicated IT manager.
  3. High traffic might be limited and reduce core service functionality.

My question is, is there a better solution for such a problem? Are there any 3rd party trusted services might help me find solution?

  • Clarification: are you worried about the outsourced IT people wiresharking the db traffic, or about them making queries directly to the db? – Mike Ounsworth Nov 6 '16 at 15:30
  • the main consideration is data reselling – Sergey Malych Nov 6 '16 at 15:39
  • I understand that, but if the IT people have root access to the server the DB is running on then they can just copy the DB files, why would adding a micro-service do any good? That's why I wanted to clarify if you're only worried about data in transit, or also worried about data at rest. – Mike Ounsworth Nov 6 '16 at 15:41
  • lot of missing details here, or you are looking for an abstract 'solution' ? – elsadek Nov 6 '16 at 16:37
  • 2
    Put another way, before you can talk about how to secure your network, you have to enumerate the risks. So have you made a list of all the ways that they could access the data? Once you have that list it should be obvious what you need to secure. Without knowing the details of your network, it's very hard to suggest a general solution. – Mike Ounsworth Nov 6 '16 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.