1

Quite new to db admin here and I have a quick question.

I am collaborating with another colleague off site and they would like me to send them a dump of our (1.5GB sql db) database via email as they need to do some testing. The database contains personal info, and I am wondering if there is a safer way to do this?

We are unable to provide remote access to the db. Rather than zip the .sql file and email it, in order to ensure privacy/confidentiality etc what would be the best way to send this db?

Any help appreciated.

  • Emailing 1.5GB??? Oh boy! If I were you, I'd snail mail it on a DVD - there's little more secure than the postal service. You could perhaps md5 (or whatever) any sensitive fields on extraction of the data from the db? Names/addresses? – Vérace Jul 17 '15 at 8:45
  • Which DBMS are you using? (And this question doesn't really have to do anything with database administration) – a_horse_with_no_name Jul 17 '15 at 8:51
  • Thanks for the dvd snail mail suggestion, however he needs the thing today so that's not going to be of any use. It's a MySQL db. I may set up a one-time dropbox link. If this question seems like it shouldn't be here then apologies and please feel free to remove it. Thanks again. – jonboy Jul 17 '15 at 8:57
  • 1
    @a_horse_with_no_name You are, of course, correct - it is a general problem of data transmission - why don't we send it to crypto? DBAs are sometimes faced with the issue of transmitting data from one system to another, be it electronically and/or physically - perfectly valid question IMHO. And, yes, it may be credit card numbers or whatever, the problem remains the same - getting bits from A to B securely. Perhaps not a "pure" DBA question, but again IMHO, of considerable relevance to any DBA. – Vérace Jul 17 '15 at 9:49
  • 1
    Of course you can put it up on Dropbox - or anywhere else. Depends on how secure you want your data to be? Do you want the NSA looking at it? Dropbox employees? I would put up an encrypted version of your mysqldump and securely transmit the key to your colleague - either face to face or over encrypted email, or have the password/key sent by courrier. It all depends on how much the data is worth to you and/or your company. Is it worth a courrier? Do I encrypt my email? Those are questions only you can answer. If your internal system is good, then go with that. – Vérace Jul 17 '15 at 10:29
2

Of course you can put it up on Dropbox - or anywhere else.

Depends on how secure you want your data to be? Do you want the NSA looking at it? Dropbox employees?

I would put up an encrypted version of your mysqldump and securely transmit the key to your colleague - either face to face or over encrypted email, or have the password/key sent by courrier.

It all depends on how much the data is worth to you and/or your company. Is it worth a courrier? Do I encrypt my email? Those are questions only you can answer. If your internal system is good, then go with that.

The key (no pun intended) question is "how much is your data worth (now and in the future)"? You should afford your data as much protection as is reasonable given its value to you/your organisation.

If you're interested in these matters, go to the source of all wisdom - Bruce Schneier. "Security is a process, not a state". Once you start thinking in these terms, then solutions will become apparent. What is your data worth now? In a day's time? A year's? What would be the result if all of this data went live on internet now? If you wish to learn more, then I suggest you go to the crypto group - you ain't seen paranoid until you've lurked there for a while! :-)

1

You should have him send you a public gpg key that he has the private key for, which you use to encrypt the dump. You can then deliver it to him using any method that is comfortable for you, and then he can decrypt it once he has received it.

If you're on Windows.. http://www.gpg4win.org/ is a great tool for that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.