0

A company has a database with user's passwords encrypted. An attacker compromised the password encryption now it needs to be changed.

In this situation does the company needs to change the encryption key or Is there another way to prevent it.

Note: The services active at all times.

4
  • You can't prevent an event that has already occurred. Is this a home work ?
    – elsadek
    Commented Mar 16, 2021 at 15:25
  • Welcome to Security SE! @RudraSarkar, Could you please provide a bit more info? (Related Links?) maybe something to provide a bit more context? so we can help you more :) Commented Mar 16, 2021 at 15:27
  • Not homework actually I am curious to know what I can do in this situation. Commented Mar 16, 2021 at 15:28
  • Well, @WilliamMartens Can we change the password encryption while all the services are running. Commented Mar 16, 2021 at 15:31

1 Answer 1

1

As a fundamental of security engineering/incident management, if your system is compromised, You must rebuild your system. Because now attacker has enough details about your system. Even if you change encryption key, algorithm, password he still be able to attack again. Because you don't know how he compromise password.

If you change password or key, still he will be able to access it because i assume that you have no idea about attack. What you know is result.

Identify vulnerability and try to resolve that particular issue.

Therefore rebuilding your system is required with additional security controls. Don't try to achieve security by obscurity.

6
  • Nice explain @Infra will you suggest to me a book for learning the fundamental of security engineering? Commented Mar 16, 2021 at 15:56
  • @RudraSarkar I used CISSP official Guide. In addition to that many other books available in amazon and publicly as well.
    – Infra
    Commented Mar 16, 2021 at 15:58
  • Which book do you prefer to read I mean specific if you suggest? Commented Mar 16, 2021 at 16:02
  • CISSP official Guide
    – Infra
    Commented Mar 16, 2021 at 16:03
  • Understood! Thank you for your answer. Commented Mar 16, 2021 at 16:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .