Is it safe to store data of small company in MySQL database on webhost?

Question

A small company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what products bought) and some small notes. The data is stored at the computer in the office of the company. The company does not use any cloud service for anything. Backups are manually created and saved in a different location. A computer administrator arranges this.

The company has a website and webhosting, and a webmail. Emails are received and stored at the webhosting account (so where website and email runs). Up to now, the 'only' data on the webhost is:

• The website (with images, webpages and data for a content management system, like news articles, etc.). This is stored in a MySQL database like on almost every webhosting.
• The email is hosted there.

All other data like quotations to customers, invoices, and contact information is stored on a computer. Until now there was no reason to save this to some online server or something. Although this data regularly appears in email messages, that are on the webserver.

Now the company wants employees to be able to remotely load and edit that offline data from a phone or a laptop. This automatically means that offline data should be accessed via internet, which means it must be stored at some server to make it accessible via internet. Most data like contact info and addresses can be stored in tables in the MySQL database on the webhost. The person who manages the website has a very good ICT background and could create some API-like access point to load customer details (of course with a secure authenticaion mechanism). This has a lot of possibilities for the future too.

The security risks (threats) I'm concerned about, are:

• The webhosting leaking data (but that would mean also all email and website data is leaked).
• The API authentication mechanism for accessing the data remotely, must be 99.9% secure.
• Keeping as most data offline as workable, feels safer than storing it on a webserver. How do other organisations manage this when the need arises to access data via internet?

Could someone assess the mentioned security risks and help us decide what to do? We mainly wonder how other organisations would handle this. It has something to do with company growth. Does someone have experience with this situation?

Answer 1

The decisive factors here are isolation and the principle of least privilege. If the account used for the website has access to the database containing the customer records, any compromise on the website is automatically a compromise on the customer records, too. Furthermore, the data could be isolated on a separate server or even a separate network, and accessed using different credentials or different type of authentication.

Securing the data, especially personally identifiable information (PII), isn't only preventing unauthorized access, but also being able to audit who has accessed which data and when. If e.g. the API logs this information, direct access to the database must be limited in order to keep the audit records trustworthy.

This automatically means that offline data should be accessed via internet

I assume by Internet you mean it would have to be either a web application, web based API or at least a connection that is made directly over the internet. This isn't automatically true: you could have additional layers e.g. you could require that the website/API/database can only be accessed through a VPN tunnel.

Answer 2

In general, as mentioned by above, databases should not be co-located on the same hosts as web services, but should be protected behind additional firewalls. This is especially true if they contain PII data or any sensitive data not intended for public release. The database itself should not be directly accessible from the Internet, but only through the web service, and all data access should be fully audited.