Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Securely store sensitive data in the DB?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 50 posts

Re: Ask HN: Securely store sensitive data in the DB?

#11

Post by ra »

halayli wrote: post #3

use Asymmetric encryption and store the private key in an HSM. The private key never leaves the HSM device.

This, and other layers of security. There is no magic formula to keep your data safe.

If you are serious you need network security (i.e. firewalls physically separating networks), proxies, IDS etc. You also need to build your app in a security conscious way (read owasp.org).

You simply can't do this sort of thing well if you do not have infosec experience. If this data is truly sensitive you should hire someone who lives and breathes security. There are established methods and approaches. You can't get away with "use this algorithm" or "use that library".

After you've built, pen tested and deployed your app; security depends on key management and good change management practices that you simply can not skimp on.

We once built an app that uses an HSM; even though that app is in a secure and private (single occupant) data centre in the organisations own basement, they decided it was necessary to get a "shark cage" built, just so that they could tell if the server had been physically compromised.

Re: Ask HN: Securely store sensitive data in the DB?

#12

Post by ra »

raverbashing wrote: post #2

- Keep passwords in memory (so as if you start the service it prompts for the password) - Asymmetrical crypto. So for example, you encrypt your CC data upon sign-up but then to run the charges you need the private key (and this is somewhere else) - Enable SSL communication with your DB. Postgres has this, because being defeated by network sniffing is bad.

Memory is not secure. It's quite a common attack to grab keys / passwords from the memory of an executing program.

Re: Ask HN: Securely store sensitive data in the DB?

#13

Post by brasetvik »

There's a book series "Translucent Databases" with a lot of interesting use cases, where the assumption is that an adversary has gained access to the entire database.

I've only read the first edition, and it's some years ago, but I'd recommend giving it a quick read. :)

Re: Ask HN: Securely store sensitive data in the DB?

#14

Post by RyanZAG »

ra wrote: post #11
halayli wrote: post #3

use Asymmetric encryption and store the private key in an HSM. The private key never leaves the HSM device.

This, and other layers of security. There is no magic formula to keep your data safe. If you are serious you need network security (i.e. firewalls physically separating networks), proxies, IDS etc. You also need to build your app in a security conscious way (read owasp.org). You simply can't do this sort of thing well if you do not have infosec experience. If this data is truly sensitive you should hire someone who l…

You can't ever really tell if a server has been physically compromised. IDS/HSM/bla are only a chance at working out if it's happened. A perfect attacker could obtain access to any system and never trigger any alarms if they understand the triggers for any alarms that are in place.

Much the same as you can never tell if someone has broken into your apartment: you could tell a novice has broken in by looking for papers that are out of place or footprints/fingerprints. An expert burglar would make sure not to leave anything obvious like that. You could tell if an expert has broken in using something like IDS: set up a special trap or webcam that will detect it.

However, a perfect burglar would replace the webcam tapes, find and disable/ren-enable any traps, etc. Since most web hosting environments are so standard, it's actually a MUCH easier prospect to be a perfect hacker than a perfect burglar too.

Also, no amount of perfect security skills can keep you absolutely safe. An unknown exploit in your OS is simply out of scope for even the greatest security expert, and no amount of best practices can help if your OS/CPU/RAM/Network Card will give the intruder full access through some unknown flaw outside of your control.

Re: Ask HN: Securely store sensitive data in the DB?

#15

Post by michaelt »

1. If at all possible, don't store credit card numbers in your database. A payment gateway will take care of this for you - you have an iframe the user uses to submit their credit card details straight to the payment gateway, and the payment gateway gives you back a token you can use to charge and refund at your convenience (locked to your merchant account so not useful to attackers). DataCash and Chase Paymentech are two companies that provide this service, and I'm sure there are others too.

2. If the user forgets their password and resets it, ask them to re-enter their credit card details in case their e-mail has been hacked. (Also ask them to re-enter their details for deliveries to new postal addresses, if applicable)

So if you can't access CC data after a customer resets their password, that's no problem.

3. Use database-level security; set up roles and accounts in your database so tables containing sensitive data only have select grants to apps and users that really need them. When a table has some columns that are sensitive and others that aren't, set up a view with the sensitive columns replaced with placeholder data and give them access to that instead.

Re: Ask HN: Securely store sensitive data in the DB?

#16

Post by bndr »

michaelt wrote: post #15

1. If at all possible, don't store credit card numbers in your database. A payment gateway will take care of this for you - you have an iframe the user uses to submit their credit card details straight to the payment gateway, and the payment gateway gives you back a token you can use to charge and refund at your convenience (locked to your merchant account so not useful to attackers). DataCash and Chase Paymentech ar…

How do payment gateways store CC information? For example if I am a payment gateway, how do I securely store CC data?

Re: Ask HN: Securely store sensitive data in the DB?

#17

Post by girvo »

bndr wrote: post #16
michaelt wrote: post #15

1. If at all possible, don't store credit card numbers in your database. A payment gateway will take care of this for you - you have an iframe the user uses to submit their credit card details straight to the payment gateway, and the payment gateway gives you back a token you can use to charge and refund at your convenience (locked to your merchant account so not useful to attackers). DataCash and Chase Paymentech ar…

How do payment gateways store CC information? For example if I am a payment gateway, how do I securely store CC data?

With an expensive insurance plan.

Re: Ask HN: Securely store sensitive data in the DB?

#18

Post by Spearchucker »

patio11 wrote: post #5

Any system which allows you to locally decrypt information, for the purpose of doing anything for the user, should be assumed to allow an attacker who roots the box to locally decrypt information. That's the unfortunate harsh technical reality. If you have compliance reasons motivating this need for encryption, you'll find that e.g. HIPAA and PCI-DSS ignore technical reality, in favor of requiring that you encrypt in…

An HSM will hep.

Also, no mention was made of architecture. If this is a web app then putting a network and application firewall between the web application and database will allow you to observe traffic and then block or refer requests that attempt to access volumes or types of data that don't match typical usage patterns. Even better would be a dedicated DB API secured as required, and not allow the web application direct access to the database. At an absolute minimum, grant the web application rights to access only required stored procedures, and deny direct access to tables and views.

If there's a client (desktop, phone, tablet or another server) then keys should be generated there, limiting the impact of disclosure should the DB be lifted.

[Edit] Forgot to add that it's always worth creating a threat model. Draw a box around each process. Enumerate the inputs and outputs that cross process boundaries. Consider how each might be attacked, and how each might be secured. There are 6 types of threat to worry about - spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

Re: Ask HN: Securely store sensitive data in the DB?

#19

Post by ceejayoz »

bndr wrote: post #16
michaelt wrote: post #15

1. If at all possible, don't store credit card numbers in your database. A payment gateway will take care of this for you - you have an iframe the user uses to submit their credit card details straight to the payment gateway, and the payment gateway gives you back a token you can use to charge and refund at your convenience (locked to your merchant account so not useful to attackers). DataCash and Chase Paymentech ar…

How do payment gateways store CC information? For example if I am a payment gateway, how do I securely store CC data?

Payment gateways have it somewhat easy - the system making the "make a payment" request doesn't ever need the actual sensitive data returned. That data can be stored on a heavily secured server that only can call out to the banks.

Re: Ask HN: Securely store sensitive data in the DB?

#20

Post by harrytuttle »

We keep encryption keys for sensitive data in active directory and have a front end firewall, web servers, midplane application firewall, back end service layer cluster, internal firewall before anyone front facing can get at the info. The decrypted data is never passed to the web layer.

To gain access, someone will have to root two separate active directory domains after breaking into multiple low privilege accounts and a database cluster.

Possible always, but we make it a hard target.

Post reply on HN