4 ms·
I feel like this is security theater (like most modern IT security), a marketing checkbox or a certification requirement but doesn't protect against actually re
by Traubenfuchs 3y ago
I feel like this is security theater (like most modern IT security), a marketing checkbox or a certification requirement but doesn't protect against actually realistic attacks.
Are there any publicly available case reports of where an encrypted database protected data?
- TheDong 3y agoI think it depends on the situation, but there's some legitimate defense-in-depth benefits here. I've personally run across "dump.sql" files before in public s3 buckets, and as I understand it, this would help in that case.
- Traubenfuchs 3y ago> "dump.sql" files before in public s3 buckets That kind of sounds like something half of the companies I worked for would end up eventually doing, fair point.
- deleted 3y ago[deleted]
- dandraper 3y agoThe security properties become much more interesting when the data remains encrypted when it leaves the database. For example, an ETL process doesn't necessarily need to know what data is, just the structure. Transferring data between systems can remain encrypted the whole time.
- hn_throwaway_99 3y agoIt's not just theft, it can make DB management much easier. For example, since our sensitive DB fields are encrypted, relevant developers can get full read only access to the DB for debugging/analysis purposes without needing to worry about leaked PII. Similarly, we can log all of our DB queries, including fields, because the sensitive fields are encrypted. This has huge operational benefits, and for compliance reasons is usually the best way to solve this problem. You can do things like limit access to columns by DB roles, but that is much more fraught, and it doesn't give you the logging benefits.