I help maintain a webserver that users use. They store data on our server. Most of the data is not sensitive, but some of it is highly sensitive. So, it seems like we want to encrypt it so that if someone compromises our server, they will only find encrypted data. However, to serve up the data to users on the website, the code is essentially like (pseudocode)
encryptedFile=getEncryptedFile(); decryptedFile=decrypt(encryptedFile); serve up decrypted file
So, if our server is compromised, what is to stop the bad actor from finding this code and just running the decryption algorithm on their own? It seems like I am missing some step on how to prevent an attacker from finding the decryption key even if the server is compromised.
Essentially it boils down to: If I as a sysadmin creating the decryption system for the website can encrypt/decrypt files, what is to stop the hacker who compromises my server with root level access from the doing the same thing?