DigitalOcean offers managed databases. From what I can understand, the advantages are:
- You don't have to worry about management tasks such as set-up, updates (including security updates), and backups.
- They store and move the data encrypted.
- Certain redundancy options.
What I'm trying to understand is: From a security standpoint, compare these managed databases to simply using SQLite as the database, on the same machine (droplet) as the application. I know one difference is the fact that SQLite doesn't store data encrypted, unless you encrypt/unencrypt it manually. So suppose in this example that we do encrypt data before writing to SQLite and unencrypt it when reading, using symmetric encryption with a secret key.
I'm trying to understand if this SQLite application is less secure than the managed database version. In both cases, it seems that the risk is that an attacker would gain access to the droplet running the application. In the managed database case, the attacker might be able to gain access to the database connection string, at which point they could run their own queries against the database. In the SQLite case, the attacker could download the entire database, and if they knew the encryption key they could read the data.
In both cases it seems like the vulnerability is the same: attacker accessing the machine and accessing a secret string.
Am I missing something?