Protecting Uploaded Confidential Files [closed]

Question

We have a web application in Linux (App A) using PHP and Zend and another in Windows using Asp.net C# (App B). They both access the same database. App B is for internal use only while App A can be used accessed outside our network.

We got a request to allow uploading files from both applications and should also be accessible from both sides. The file will contain Personal Information so should be confidential and secured as much as possible.

We are considering on storing the files in the Database for it is easier to implement given the current situation that the apps resides in servers with different OS.

How can we at least add a layer of security (e.g encryption) to our applications so that the file will only be accessible to the approved users?

How can we protect the files from attack?

[UPDATE 2015-07-10]

We realized about the long term effect of saving the data to the database so we are thinking of saving it to a file server instead

Answer 1

There are numerous questions with answers on this site as well as Owasp guidelines that cover the risks of allowing file uploads and how to store files properly.

You may want to check the legislation that applies to your application and take necessary action to store files accordingly (encryption, access rights, data integrity, logging).

As for your idea to store files in the database I think it will cause a lot of stress (as well as storage overhead) to your server(s). It's more convenient to store files outside the web root with tight ACL (access control) and possibly encryption.

The database may be useful for storing metadata and access rights for users of the web application(s).

It's possible to share the files between servers/applications securely using standard protocols like rsync or even https.

You may also want to consider scanning uploaded files for malware and fuzzing attempts.

Find out what your requirements are, check legislation and produce an overview of how your solution should work and what precautions you are taking. Then consult an advisor/expert and revise.

Answer 2

Alasjo already provided a good answer, but I think some additional information could help you grasp the difficulties you have and how to address them.

In you question you suggested encryption. Just encrypting the uploaded data cannot be enough to secure them. Since encrypted data is useless without a mean to decrypt them, your application would have to provide a way to decrypt them. If your attacker is able to impersonate an user with rights to access the data, he could let your application decrypt it for him. This issue is even greater if everybody logged into your system can access the uploaded data.

What you really need is a good authentication process combined with good authorization (AKA rights management):

1) Authentication is to ensure that nobody is usurping the identity of a legitimate user. You can start by ensuring that your user are using difficult to guess passwords (e.g. by using zxcvbn) and NOT requiring them to change it regularly (the drawbacks are far greater then the benefits). Then you should follow OWASP's guide on authentication.

2) Authorization is to ensure that the user can only access the data they have rights to. There are many ways to define and check rights, and you should take care to separate those to concepts. Usually the RBAC model is followed, but your application might require a finer control, so choose wisely. RBAC consists in putting user in groups (or roles) and giving rights to the groups (and not to the users). In your case you might allow only the uploader and the recipient of the uploaded data to access it. The recipient can implicitly be a group. OWASP has a checklist on authorization too.

You can encrypt the uploaded data, but do not expect to gain a significant increase in security from it. Explaining how to do it properly would necessitate another answer or guide. But of course, the upload and download processes themselves must be protected using TLS.

Do not forget to follow the advices provided by Alasjo in his answer too.

Answer 3

I think Docker would be a possible solution for this. I am not an expert on Docker. So this is a concept idea solution.

I am thinking that you could create a few containers for the database and fig up. So say you build 3 containers (1-master, 1-internal and 1-webapp) with containing the same database in each. Then you could get them to be scanned before they sync to avoid conflict, malware, etc.

With the boot2docker you can deploy with Linux, MAC or Windows, which would make sense since you have Linux and Windows both accessing the database.

Docker has some tools already built in that could get you started. This way you can do whatever you want in the containers (i.e. Encrypt, ACL, etc.) So you can control each database separately, secure them independently.

Again, this is only meant as a concept suggestion.

https://www.docker.com/