0

A company has a database with user's passwords encrypted. An attacker compromised the password encryption now it needs to be changed.

In this situation does the company needs to change the encryption key or Is there another way to prevent it.

Note: The services active at all times.

4
  • You can't prevent an event that has already occurred. Is this a home work ? – elsadek Mar 16 at 15:25
  • Welcome to Security SE! @RudraSarkar, Could you please provide a bit more info? (Related Links?) maybe something to provide a bit more context? so we can help you more :) – William Martens Mar 16 at 15:27
  • Not homework actually I am curious to know what I can do in this situation. – Rudra Sarkar Mar 16 at 15:28
  • Well, @WilliamMartens Can we change the password encryption while all the services are running. – Rudra Sarkar Mar 16 at 15:31
1

As a fundamental of security engineering/incident management, if your system is compromised, You must rebuild your system. Because now attacker has enough details about your system. Even if you change encryption key, algorithm, password he still be able to attack again. Because you don't know how he compromise password.

If you change password or key, still he will be able to access it because i assume that you have no idea about attack. What you know is result.

Identify vulnerability and try to resolve that particular issue.

Therefore rebuilding your system is required with additional security controls. Don't try to achieve security by obscurity.

6
  • Nice explain @Infra will you suggest to me a book for learning the fundamental of security engineering? – Rudra Sarkar Mar 16 at 15:56
  • @RudraSarkar I used CISSP official Guide. In addition to that many other books available in amazon and publicly as well. – Infra Mar 16 at 15:58
  • Which book do you prefer to read I mean specific if you suggest? – Rudra Sarkar Mar 16 at 16:02
  • CISSP official Guide – Infra Mar 16 at 16:03
  • Understood! Thank you for your answer. – Rudra Sarkar Mar 16 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.