S 4.72 Database encryption

Initiation responsibility: Head of IT, IT Security Officer

Implementation responsibility: Application Developer

Depending on the type of information stored in a database and the requirements resulting for the confidentiality and integrity of this information, it may be necessary to encrypt this data. Encryption in this context can be categorised into online and offline encryption:

• In online encryption, the data is encrypted and decrypted during live operations without the corresponding users noticing it. Tools that encrypt the entire hard disk at the operating system level or only encrypt the application data of the database can be used for encryption.
• In offline encryption, the data is only encrypted after it has been processed and is only decrypted again just before it is accessed for further processing. Encryption and decryption are generally performed using tools that are not integrated into the database system, and such tools can be particularly useful when backing up or transmitting data. In this case, it must be ensured that there is enough space available on the hard disk, since the encryption and decryption can only be performed successfully when there is enough space on the hard disk for the original version and the encrypted version of the database.

Furthermore, it is possible to continue storing the data as plain text in the database, but to encrypt the transmission of the data when the data is accessed over a network. This can be accomplished using the Secure Network Services of the Oracle SQL*Net product family, for example.

It is best to specify which data is to be encrypted using which methods when selecting the standard database software package (see S 2.124 Selection of suitable database software). During selection, the requirements for the encryption of data resources should be compared to the corresponding features offered by the database software packages. As a minimum requirement, it should be ensured in all cases that the passwords for the user IDs of the database are stored in encrypted form.

If the encryption requirements are not fulfilled by any of the standard database software packages available on the market, then the use of additional products to close the corresponding security gaps should be examined. If there are no add-on products available for this purpose, then a concept for the implementation of an encryption strategy should be created and implemented in the company or government agency.

Review questions:

• If required by the database information, are adequate procedures for encryption provided and used by the database or add-on products?