21–30 of 80 posts
Nice! I've been using a plugin [1] for Prisma that does something similar, but this sounds much more comprehensive. [1] https://github.com/47ng/prisma-field-encryption
I suppose its more about ensuring the data sitting around in the DB isn't exposed to random employees or hackers yeah?
What's the risk to your business of other data security companies (like BigID) offering this kind of functionality?
Of course BigID could build their own technical controls for customers to install, but I'm seeing more partnerships happening in the space - Cyera and Wiz recently announced a tighter product integration [1].
There's also problems of offering a solution over SaaS. We believe a proxy must run in our customers' network for low latency, as well as the added security of data isolated to a VPC.
[1] https://www.prnewswire.com/news-releases/cyera-and-wiz-partn...
Have you thought about solving the problem from a different direction? Providing a read-only, sanitized clone of the database that can be accessed outside of the core application code? Seems like that could kill more birds with the same stone?
I suppose your company in theory could read all the incoming data? Could engineers at my company decrypt the data? Or are the keys not available to us? I suppose its more about ensuring the data sitting around in the DB isn't exposed to random employees or hackers yeah?
The proxy layer is self-hosted, the UI can be self-hosted and the keys are your own AWS KMS keys.
Have you thought about solving the problem from a different direction? Providing a read-only, sanitized clone of the database that can be accessed outside of the core application code? Seems like that could kill more birds with the same stone?
That's exactly what we're doing at https://www.snaplet.dev , I would love to chat with the founders about offering generated production accurate snapshots for developers to code against for users of their proxy!
I suppose your company in theory could read all the incoming data? Could engineers at my company decrypt the data? Or are the keys not available to us? I suppose its more about ensuring the data sitting around in the DB isn't exposed to random employees or hackers yeah?
Whether engineers can access the keys and decrypt data depends on your setup. The engine can use either AWS KMS or Vault for top-level key management, so if an engineer has full permissions over those then they could get the keys out. We can also host the keys in our infrastructure and sync them over to the engine if you're comfortable with that tradeoff.