I have a use case where I need to encrypt a piece of PII information in a database, which then can be decrypted and accessed by multiple user roles in an application (e.g the user it belongs to, customer service, engineering, etc.. ).
What is an industry standard strategy for these sort of things?
UPDATE: PLEASE READ BEFORE POSTING: In addition to posting feedback for my idea below(which I really appreciate) please also propose a strategy. I believe it would be very helpful to anyone trying to encrypt any shared resource nowadays.
Here is what I have in mind at the moment which will hopefully describe what I refer to better:
Full Disclosure: The information below is also meant to get an opinion or a peer review on my current strategy I came up with
As part of a defense-in-layers strategy my criteria is to have at least 3 factors to the encryption/decryption strategy that way if any 2 pieces are compromised the data can't still be decrypted.
The 3 factors: The Software accessing the information, A DB with encrypted data(DB1), A DB with the encryption keys(DB2).
The Encryption Strategy:
- Data gets inputted into the software
- A, let's say, 128bit Key is generated
- Data gets encrypted with that key
- Encrypted Data is stored into the DB (presented as DB1 in the 3 factors above)
- The 128b key gets encrypted with a Master Key hardcoded in the software
- Encrypted 128b key gets stored into the other DB (presented as DB2 in the 3 factors above)
The Decryption Strategy is the reverse..
The point is that the software holds the master key(Factor 1), DB1 has the encrypted data(Factor 2) and DB2 holds the encrypted encryption keys(yay for word repetition..also Factor 3) which can only be decrypted with the master key.
In my head if any of these get exposed, it's useless information that doesn't reveal the encrypted PII.
Btw this assumes solid encryption algorithms such as AES (..most likely AES only given that DES, 3DES and Blowfish are deprecated).
Update i realize i didn't make myself clear on the point of where these 3 factors will rezide. All 3 will be in different hosting environments on 3 different servers We're talking about a large scale strategy(which could work small scale as well) where DBs are inherently separate hardware entities. In my mind that was the assumption to begin with.
Update 2 A lot of the feedback here rightfully suggests that the software is the achile's heel here. This is my big canandrum too. I can't think of any software strategy where if the software is compromised the data is not at risk, given that the software always has an open connection into the DB and contains all the business logic to view/handle that data. Even implementing mydiamo in the software, that still means the data gets compromised if someone takes control of the software.