-1

Just curious what do you guys use for file or database encryption? Any good programs out there or techniques employed for securing IT personal information? Main reason is the company I work for has incredible too many IT passwords, which is good and bad, but the director would like to be able to store them all on a heavily encrypted file. Options?

1
  • Generally speaking, you want to avoid open-ended or "recommend x" type questions. If you are unsure, you should read the faq as to why this type of question is generally not well accepted here.
    – MDMarra
    Nov 11, 2011 at 18:24

4 Answers 4

2

While it does not directly address the file / database encryption the title indicates I will heartily recommend the use of KeePass for storage and retrieval of IS passwords and account data. My organization recently went from an old word document system to this product and we are thrilled with the results.

Although it is designed for passwords is it has the ability to add multiple additional fields. This comes in handy for notes, multiple domains, etc. This has proven really handy for segregating our DMZ from internal network, etc. I use the Windows release but there are also releases available multiple additional platforms.

4
  • That seems very simple and lightweight, have you noticed any potential security issues with this software? This is essentially exactly what I need =) Nov 11, 2011 at 15:44
  • I second the Keepass recommendation. The main problem I've encountered with it is that it lakes internal ACLs and multiple logons. If you have several IT folks using a central Keepass database, this can lead to security issues (segregation of duties and accountability). Typically not a problem for small teams, though.
    – Stephane
    Nov 11, 2011 at 15:48
  • Ya there are only 3 of us so I don't see that being a big issue, but essentially two users cannot access this at the same time? Nov 11, 2011 at 15:50
  • @Stephane - Agreed on the ACL issue, however setting up multiple database files is a decent workaround. Nov 11, 2011 at 17:16
1

I would create my own in-house application (web, c#, java, etc.) which would store all the passwords in one database, along with who has access to use them. Then, I would provide access to these passwords by authenticating the user with the company account (I presume this exists, either by in-house method, active directory, LDAP, etc.). When authenticated to the system, it would act as intermediary between them and whatever they are authenticating to.

I know it's a bit of a pain to do things in house, but often it does exactly what the boss needs, and in my experience, if it's documented enough, will last a long time.

3
  • That sounds really good, if he allotted enough time to build an application this would be a great approach. In all reality even building this is PHP or java would not be a complicated tasks, but you know how it goes sometimes the boss just wants something now. Do you have any good sites about building apps and integrating active directory into usage rights? Really all it would be is setting the permissions on running the app right? Nov 11, 2011 at 15:47
  • Also, if that's the case would you just be creating the app to encrypt the data with the latest and greatest encryption schemes? Because if you are going to use AD to set permissions you could technically just do that on a word document though I do not think that would be very secure. Thanks for the feedback! Nov 11, 2011 at 15:49
  • The app would have a built-in authentication 'page', such as a web site, Email or IM application. As for encryption, 'Blowfish' is supposed to be the top dog. For its simplicity, I favor seccure: point-at-infinity.org/seccure Nov 11, 2011 at 16:31
0

I use GNU Privacy Guard (gpg) for file encryption. It has the advantages of being free, multiplatform, decentralised, and lightweight. You can encrypt files to the set of keys that are appropriate for the contents.

Since people are responsible for their own keys (decentralised) it also provides a handy authentication-and-encryption channel when people are apart. Although I set it up with my clients' admins primarily for encrypting the shared password files, I've often been grateful when out and about, and in receipt of an email from one of those admins asking me to (eg) reboot a server, that I can be sure that (a) it really was sent by the chap it claims to be from, (b) it hasn't been altered in transit, and (c) if the instruction was sent in error I can prove to a third-party that it wasn't my error.

As for database encryption, I'd probably encrypt the underlying disc volumes with (eg) dm_crypt and take the database out of the loop altogether.

3
  • great! GNU Privacy Guard sounds great. I am mainly looking for file encryption, but looking at the available options. Nov 11, 2011 at 15:34
  • If you already know this, forgive me for adding it, but once you have a preferred answer it's the done thing to "accept" it by clicking the tick outline next to that answer. That drives the reputation mechanism for the site, and stops the question floating back to the top of the "unanswered" lists.
    – MadHatter
    Nov 11, 2011 at 16:42
  • I did not know that as I am fairly new to this site, thank you for that... though I would like to see if there are any other options out there before I close it. I do have another one that needs to be closed though. Thanks =) Nov 11, 2011 at 16:46
0

Encrypting the database files, directory or partition helps nothing. The database software needs encrypted access and hackers use SQL connection to talk to unencrypted database.

You need to store all the relevant information in database as encrypted and fetch in encrypted mode back to the software. Inside your software you then decrypt them. Where you store this password is up to you. Some even require password on server boot, but if you store it on HDD or even on USB stick it can be read by unauthorized code.

On boot your software can wait for a browser user to input the password. Then it would be stored in memory until next boot. Depends on your software of course.

Not the answer you're looking for? Browse other questions tagged .