1

Trying to search for answers like Database encryption or filesystem encryption? but did not found what I need.

My database contains confidential information.

What is better? To store encrypted information or to use a partition encryption?

If we store encrypted information then SQL injection or other attack will return encrypted data.

The issue that establishing of storing encrypted information can cost development time.

On the other side, establishing of an encrypted partition is not big issue. But in case of SQL injection or other attack an attacker can get plain data.

What is better way to store confidential information?

Improve this question
4
  • 2
    Why not use both? :)
    – Konrad Gajewski
    Commented Jun 15, 2015 at 12:09
  • What do you need? The question you link to has a pretty good answer! Make clear what you need more.
    – SPRBRN
    Commented Jun 15, 2015 at 12:48
  • 3
    What's your threat model? What kind of situations do you need to cover, what can you afford to cover, and what do you want to cover? Encryption at the app level "only for data that needs it" leads to data that "needs it" ending up in places it shouldn't and being unencrypted due to rules changing, developers screwing up, requirements gatherers screwing up, and/or users screwing up. Encryption at a partition level leads to anyone who can access the database being able to read everything, but if the drives are stolen, everything's encrypted. App level requires free space wiping afterwards.
    – Anti-weakpasswords
    Commented Jun 15, 2015 at 13:09
  • @Michael. Have a look at CryptonorDB. This is what I could suggest from your question (it is not clear from your question that what you need).
    – kingmakerking
    Commented Jun 15, 2015 at 16:37

1 Answer 1

Reset to default
6

Better for what? In general, encryption is used to prevent someone from accessing encrypted data.

Database level encryption is more complicated to implement at both administrative and application sides. However it prevents unauthorized staff from accessing the data.

Filesystem level encryption leave your database open to any staff member, who has direct filesystem access. However, it's much easier and faster to deploy and debug application using database encrypted such way.

From the application level, if an intruder is able to gain access to decrypted data level, it's irrelevant, on which level the database is encrypted.

So, database level encryption protects you from fraudulent staff, and partially from external intruders. But if you're looking for the best solution for external intruders, you should concentrate rather on application security, than on database level encryption.

Improve this answer
1
  • 1
    I'll upvote this because you mentioned application security :)
    – sir_k
    Commented Jun 15, 2015 at 12:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .