Store sensitive decryptable data in database

Question

I'm building a web application which configures and interconnects other applications through web services.

In all the data I have to save for each applications, there are some that are quite sensitive : the credentials.

Unfortunately, most of these applications do not provide dedicated API keys or token for this kind of usage, which means I have to store login, passwords of a technical users. And in some cases, client authentication certificates with their passwords.

These data must be accessible to users (as long as they have the permissions) in "clear text" because they can be updated. They also have to be in "clear text" to the server because we can reconfigure every application at any time with the data we want.

What are the options to protect the best we can these data ? Obviously storing them in "clear text" in the database doesn't seem like a secure option despite being convenient.

Answer 1

If you ever need access to your users' plain-text credentials, then your system is fundamentally broken from a security perspective.

Passing over this, to make momentary use of plain text credentials, the process is like this: You store the credentials properly encrypted as you normally would, and inaccessible to anyone including yourself. Then,

• The user enters the credentials, and you confirm that they are correct using the encrypted hashes
• If they are correct, you perform your action and then discard the plain-text credentials

This requires an active involvement of the user, but anything less than this is beyond insecure. If there is a mechanism to decrypt user passwords at will, then the passwords are also accessible to anyone who can access this mechanism, both from within your company, and potentially from without. It is then possible for an attacker to single-handedly decrypt your whole database of credentials into plain-text.

Answer 2

Thanks, that's what I feared. It's not possible to have a master key to decrypt data because operations are managed asynchronously (rabbitmq messages), and that is at that moment that the data must be read by the workers.

A part of that data can be viewed by the end user administrator (user X has role y in app z) and the other part can be not accessible to the user and force him to re enter credentials if he wants to update them.

Is this a more plausible scenario ? Only the internal system could process the encrypted data, it would be write only for the users