I currently have a requirement to store bank account information (transit numbers/account numbers/routing numbers) and I need to know how best to store them and retrieve them from the database.
I'm currently using Amazon's RDS to store the data, and I've turned on the AES-256 encryption at rest feature. I believe this encrypts the data on the volume, but I don't know if it's enough to secure the bank accounts.
My current line of thought is that I should keep a secret on the server and whenever writing the bank account I should AES-256 encrypt it with the secret and save that encryption on the entity. Whenever retrieving that entity I'll have to decrypt it manually using the secret (serverside).
My thinking is if the Database is ever compromised (even with the RDS encryption) they wont get bank account information. I should also note that the database should be locked down only allow connections coming from the server the code is running on. Maybe in my case, this is overkill?
My main questions are:
- Is this a good method to use store bank accounts?
- Is this necessary if I'm using AWS RDS's encryption feature or is it overkill?