Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Securely store sensitive data in the DB?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 50 posts

Re: Ask HN: Securely store sensitive data in the DB?

#21

Post by kintamanimatt »

Spearchucker wrote: post #18
patio11 wrote: post #5

Any system which allows you to locally decrypt information, for the purpose of doing anything for the user, should be assumed to allow an attacker who roots the box to locally decrypt information. That's the unfortunate harsh technical reality. If you have compliance reasons motivating this need for encryption, you'll find that e.g. HIPAA and PCI-DSS ignore technical reality, in favor of requiring that you encrypt in…

An HSM will hep. Also, no mention was made of architecture. If this is a web app then putting a network and application firewall between the web application and database will allow you to observe traffic and then block or refer requests that attempt to access volumes or types of data that don't match typical usage patterns. Even better would be a dedicated DB API secured as required, and not allow the web application…

HSM = hardware security module, for those that aren't familiar.

http://en.wikipedia.org/wiki/Hardware_security_module

Re: Ask HN: Securely store sensitive data in the DB?

#22

Post by kintamanimatt »

harrytuttle wrote: post #20

We keep encryption keys for sensitive data in active directory and have a front end firewall, web servers, midplane application firewall, back end service layer cluster, internal firewall before anyone front facing can get at the info. The decrypted data is never passed to the web layer. To gain access, someone will have to root two separate active directory domains after breaking into multiple low privilege accounts…

After all, the primary objective isn't to create an impenetrable system, but one that's exceptionally difficult to penetrate.

Re: Ask HN: Securely store sensitive data in the DB?

#23

Post by michaelt »

bndr wrote: post #16
michaelt wrote: post #15

1. If at all possible, don't store credit card numbers in your database. A payment gateway will take care of this for you - you have an iframe the user uses to submit their credit card details straight to the payment gateway, and the payment gateway gives you back a token you can use to charge and refund at your convenience (locked to your merchant account so not useful to attackers). DataCash and Chase Paymentech ar…

How do payment gateways store CC information? For example if I am a payment gateway, how do I securely store CC data?

You're very clever, young man, very clever, but it's payment gateways all the way down.

Re: Ask HN: Securely store sensitive data in the DB?

#24

Post by orofino »

patio11 wrote: post #5

Any system which allows you to locally decrypt information, for the purpose of doing anything for the user, should be assumed to allow an attacker who roots the box to locally decrypt information. That's the unfortunate harsh technical reality. If you have compliance reasons motivating this need for encryption, you'll find that e.g. HIPAA and PCI-DSS ignore technical reality, in favor of requiring that you encrypt in…

To expand on this a bit, absolute security for encryption just doesn't exist. If you wanted your data 100% secure, put it in a database, disconnect the DB from your network, put it in a locked room, guarded by biometric locks and security guards. Even in that scenario, the data is vulnerable, but why even bother discussing that point, as the data is worthless if you can't access it.

With that reality in mind, I was responsible for PCI for a large part of the infrastructure at a Level 1 Merchant, meaning a yearly audit had to be passed. Ultimately, our solutions boiled down to restricting access to an external (read different machine/network segment), firewalled host that did the decryption. In some cases this was an appliance that was purchased (this helps with compliance, but they're expensive, and they're a nightmare if they become a performance bottleneck as they're a black box you know little about). In other cases we used a web service we built that worked similarly (auditors will pick this apart because it isn't a "standard" solution).

In all cases here is a high level of how they work: encrypted data is passed to the service, which pulls the encryption key out of memory, decrypts the data, and sends it back to the requesting host. The encryption key is stored in (at least) two pieces, each piece is encrypted with a key encrypting key, key encrypting keys are know to very few employees, no single employee holds both key encrypting keys. The encryption keys is only assembled in its entirety while in memory.

Again, there are problems to this, as patio11 intimates, compliance includes much theater a times, but this is reality, and it does provide benefit over other solution, in this case, at least three layers of security must be compromised before you could decrypt everything.

Re: Ask HN: Securely store sensitive data in the DB?

#25

Post by kintamanimatt »

girvo wrote: post #17
bndr wrote: post #16

Earlier quoted context omitted.

How do payment gateways store CC information? For example if I am a payment gateway, how do I securely store CC data?

With an expensive insurance plan.

It's not really a risk you can really protect against in any meaningful way with insurance. It's the banks that ultimately eat the loss, and they just write this off as a cost of doing business. Banks really do lose a lot of money to fraud, card losses, and other miscellaneous security issues and bad actors -- a lot more than people think.

Storing CC data can be done sufficiently securely, of course, although PCI DSS guidelines are insufficient and silly in places, and you really have to go above and beyond to make it secure enough because data breaches can threaten the status of your merchant account. If you become too costly or too risky to do business with, the bank will simply cut you off by terminating your merchant account. You may also end up on the TMF which will make it very hard to get another merchant facility in the future.

Re: Ask HN: Securely store sensitive data in the DB?

#26

Post by stevekemp »

bndr wrote: post #16
michaelt wrote: post #15

1. If at all possible, don't store credit card numbers in your database. A payment gateway will take care of this for you - you have an iframe the user uses to submit their credit card details straight to the payment gateway, and the payment gateway gives you back a token you can use to charge and refund at your convenience (locked to your merchant account so not useful to attackers). DataCash and Chase Paymentech ar…

How do payment gateways store CC information? For example if I am a payment gateway, how do I securely store CC data?

YOu have a dedicated box that stores details and is remotely contacted through an XML-RPC/JSON-HTTP API of some sort.

The API should have two methods:

* Add a new card to account. * Make payment of £xx from card NN.

The machine is locked down, runs no other services, and so cards cannot be exported/stolen from this system. You'd encrypt the filesystem and prompt for a key/passphrase at boot. Ideally you'd only login via the serial console so the only service exposed is your "add/charge" methods.

(Even allowing the remote-deletion of cards could be a security issue; obviously.)

Re: Ask HN: Securely store sensitive data in the DB?

#27

Post by stevekemp »

adamlj wrote: post #4

If you have to store CC data inhouse I would suggest storing it on a completly sepatate machine which only stores and charges cards. The only communication allowed from this box would then be Store this card, Charge the card with this token etc.

I wrote a similar comment too. In practice you find you might want to allow "delete card" or "update card" which are complications to the simple-model.

Re: Ask HN: Securely store sensitive data in the DB?

#28

Post by bndr »

stevekemp wrote: post #26
bndr wrote: post #16

Earlier quoted context omitted.

How do payment gateways store CC information? For example if I am a payment gateway, how do I securely store CC data?

YOu have a dedicated box that stores details and is remotely contacted through an XML-RPC/JSON-HTTP API of some sort. The API should have two methods: * Add a new card to account. * Make payment of £xx from card NN. The machine is locked down, runs no other services, and so cards cannot be exported/stolen from this system. You'd encrypt the filesystem and prompt for a key/passphrase at boot. Ideally you'd only login…

Exposing only the "Add new card" and "Charge Amount XX" methods actually makes sense, Thanks for the info!

Re: Ask HN: Securely store sensitive data in the DB?

#29

Post by dankohn1 »

I'm a fan of using client-side encryption so that the database only ever stores encrypted content, and therefore can be treated as out-of-scope for PCI compliance purposes.

Take a look at https://github.com/braintree/braintree.js which is a nice library for encrypting data with a public key before being uploaded.

This is a specific exception to the generally correct concept that Javascript cryptography is bad and should be avoided. http://www.matasano.com/articles/javascript-cryptography/ Of course, it's essential that the whole transaction take place over SSL.

And even then, you still need to have a set of machines that can read from the database and access the private key, and those machines must be highly secured, as well as supporting requirements like key revocation and key rotation.

Post reply on HN