Suppose I'm building a service to store all the secure or sensitive information that my other applications use. Think passwords, or private SSH keys. Under the old programming paradigm of 'do one thing really, really well', I want to make this service as ironclad as possible. I'm taking the following precautions:

  1. All data is encrypted in the database (duh)
  2. Stored data is randomly assigned to one of multiple databases (even if one database were compromised, not all the data is on that one)
  3. Access to data is controlled by specific token permissions - token A does not have permission to access token B's data and vice versa, and token C is the only one with permission to write data, A and B can only read it (for example)
  4. The actual service runs on AWS, so we have their 'physical' security precautions
  5. SSH access to production is permanently disabled - when a new deployment needs to go up, a script runs on AWS that spins up a brand new server. The server has a startup script that pulls the most recent build from Bitbucket and performs the necessary setup steps
  6. There is an actual dashboard to manage tokens etc. - this dashboard is protected by two-factor authentication (I get a code on my phone that I need to enter in when I want to login, in addition to username/password)

This seems to me to be a fairly secure environment, but I can identify a couple vulnerabilities:

  1. My AWS account: If my AWS account were compromised, an attacker could easily edit the server startup script to do something malicious, or open up SSH access to the production server.
  2. My Bitbucket account: Likewise, if my Bitbucket account were compromised, an attacker could include malicious code in my project build, which would then be pulled by the server next time it deployed.

These are the obvious vulnerabilities - nonetheless, I'm not sure how to protect that avenue of attack. I'm also worried about not knowing what I don't know - are there any attack vectors I haven't considered, or flaws in my planned setup?

  • Why not use what AWS does really well? aws.amazon.com/secrets-manager – schroeder Nov 30 '18 at 15:27
  • I didn't even know that was a thing, I'll look into it! Thanks! I may want to continue forward with this project simply for the fun/learning angle, however. – CGriffin Nov 30 '18 at 15:39
  • For 1. you could use two-factor authentication on AWS and for 2. you could require signing your code with a certificate and configure the application server such that only signed code will run – AndyMac Nov 30 '18 at 16:03
  • I'm curious, are you doing this to build your own online password manager, for yourself? – reed Nov 30 '18 at 21:55
  • Sort of. In the course of building multiple other web applications, I've repeatedly found myself needing to store sensitive data - passwords from a password manager, private SSH keys from an application that needs to SSH into servers, API credentials from automated deployments. So I figured I'd build a central solution to do that so I wouldn't need to keep reinventing the wheel. – CGriffin Dec 1 '18 at 0:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.