2

I am currently working on a project that will collect a lot of customer sensitive data. DOB, SSN, credit history, and other personal data.

This data is all used by a website which generates documents in PDF form which contains the personal data. Obviously if the customers' usernames and passwords are compromised their individual information is at risk, but what can I do to protect the database from being compromised?

Should I be encrypting the pdf documents and other information in the database? Will that cause significant performance problems as the number of users scale up?

Is it enough to keep the database server on a private network which the public web server accesses?

I am using MySQL

1
  • one thing to remember is that if the webserver is compromised, the attacker will most likely have all the same access the webserver user (ie. www-data) had (or more), hence, they would be able to read config files with database passwords, and access the mysql server wherever it is located.
    – Brent
    May 20, 2009 at 21:13

2 Answers 2

6

Here is a link to what are called the "PCI Best Practices"

http://www.appsecinc.com/solutions/pci/index.shtml

PCI is the standard to which companies who accept credit cards must adhere, and they are generally good practices to follow.

Some of the key points are:

  • Physical security around the server needs to be excellent
  • All the data coming in and out of the server should be encrypted
  • The server should be behind a firewall and only accessible from a limited number of machines
  • Use an encrypted file system, and for very sensitive data, encrypt the individual pieces of data within the database
  • Limit remote access to only the minimum number of sysadmins necessary

If you read some of the docs on that site, it should give you additional information.

1
0

You should certainly have the database behind a firewall, only accessible to the web server. Why expose it more than is needed?

As for encryption... that would be good as long as your access requirements don't make it useless. Ideally you could store the SQL data encrypted to a key you know, and any produced documents would be encrypted to the client's key.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .