I work for a healthcare company that emphasizes security, due to the sensitivity of the data that we work with. Recently, we've been doing a lot of auditing (internal and external) of our current "stack" to ensure that we're compliant with various client requirements.
One recent topic of discussion is around environment variables. We use the dotenv gem, so we're storing many of these variables in a .env file (ignored in git) on the web server. These variables include our database credentials, SMTP credentials, and various API keys.
When certain leadership learned that such credentials were stored on the web server in plain-text they expressed concern. That concern has sparked discussion around encrypting those variables. I see the merits of encryption and it would certainly be valuable for protecting our API keys and the like. However I question the value it offers for protecting the data stored on our DB server (which is ultimately the biggest concern)... what we're talking about here is a malicious user gaining access to our web server. Unless I'm missing something, that user could still open a rails console, which will load the application, handling decryption of the credentials, and allow them to query the DB using our models (Patient.all, for example). It just seems to me that if our web server is compromised we're hosed regardless of whether we encrypted those variables. Am I right about that?
Assuming that I am, how do I respond to this inquisition with something more concrete than "well, that's just how Rails works" (with regards to being able to open a connection to the DB via rails c)?