1

I need to store some sensitive user data in an SQL database and am looking into how to best secure it. From what I've read here, the obvious way to do this would be to encrypt the data using the user's password. But I still need the Administrator to be able to access and potentially modify this data which would not be possible with this method. Is there anything else I can do or do I have to resort to storing everything in plain text?

What would be the best way to secure user data from attackers while still allowing the admin to access it?

|improve this question
  • You need to refine your question, as it depends what you want to secure against. A good start is to encrypt the drive where the data is stored or enable encryption on the database engine, this will prevent someone who steals the drive or data files from reading the data (obviously, you need to be careful where you store the keys to encrypt the data - probably you can use a TPM). – Augusto Apr 8 '14 at 9:19
  • Thanks for the repy. I guess I'm not trying to defend against a particular threat but rather looking into my options of additional layers of security. At the core I would be handing out OAuth tokens that allow access to the user data through a RESTful API, over HTTPS of course. – Armar Apr 8 '14 at 9:26
1

i am not a pro but im working on a problem like this and i think you can use encryption with RSA and use a public key to encrypt data and then save it on database and when admin wants to read data , with a private key start to decrypt with a safe private key. and you may do this on top of hashing data with strong salts. obviousley you should keep private keys in a safe place.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.