I'm trying to design the best strategy to achieve the following goals:

  1. Securing data-on-the-wire between my server and MongoHQ.
  2. Encrypting all data-at-rest with MongoHQ (possibly key values as well).

And this is my current working strategy:

  1. Use a VPN tunnel to connect to MongoHQ using the mongodb protocol. I don't believe the mongodb protocol supports SSL yet (or ever will?) so I believe this is my only option unless I want to use the REST API (which I don't).
  2. I'm running a node/express stack, so I believe my 'best' option to achieve the encryption/decription goal is to use a module like node-cryptojs-aes or crypto-wrapper to handle all encryption and decryption in the application layer, then store the encrypted data to MongoHQ.

Note: I would be using bcrypt to hash and salt passwords.

The questions I have are:

  1. Is the VPN/tunnel solution a good one for establishing a secure connection over mongodb protocol?
  2. Should I bother encrypting the keys in my documents? I suppose this is subjective, but is there an established best practice?
  3. Is AES the right tool to use when encrypting all the data in the DB? Is there an alternative that could offer better performance and/or security?

Thanks in advance for any help.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.