1

Trying to search for answers like Database encryption or filesystem encryption? but did not found what I need.

My database contains confidential information.

What is better? To store encrypted information or to use a partition encryption?

If we store encrypted information then SQL injection or other attack will return encrypted data.

The issue that establishing of storing encrypted information can cost development time.

On the other side, establishing of an encrypted partition is not big issue. But in case of SQL injection or other attack an attacker can get plain data.

What is better way to store confidential information?

  • 2
    Why not use both? :) – Konrad Gajewski Jun 15 '15 at 12:09
  • What do you need? The question you link to has a pretty good answer! Make clear what you need more. – SPRBRN Jun 15 '15 at 12:48
  • 3
    What's your threat model? What kind of situations do you need to cover, what can you afford to cover, and what do you want to cover? Encryption at the app level "only for data that needs it" leads to data that "needs it" ending up in places it shouldn't and being unencrypted due to rules changing, developers screwing up, requirements gatherers screwing up, and/or users screwing up. Encryption at a partition level leads to anyone who can access the database being able to read everything, but if the drives are stolen, everything's encrypted. App level requires free space wiping afterwards. – Anti-weakpasswords Jun 15 '15 at 13:09
  • @Michael. Have a look at CryptonorDB. This is what I could suggest from your question (it is not clear from your question that what you need). – kingmakerking Jun 15 '15 at 16:37
6

Better for what? In general, encryption is used to prevent someone from accessing encrypted data.

Database level encryption is more complicated to implement at both administrative and application sides. However it prevents unauthorized staff from accessing the data.

Filesystem level encryption leave your database open to any staff member, who has direct filesystem access. However, it's much easier and faster to deploy and debug application using database encrypted such way.

From the application level, if an intruder is able to gain access to decrypted data level, it's irrelevant, on which level the database is encrypted.

So, database level encryption protects you from fraudulent staff, and partially from external intruders. But if you're looking for the best solution for external intruders, you should concentrate rather on application security, than on database level encryption.

  • 1
    I'll upvote this because you mentioned application security :) – sir_k Jun 15 '15 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.