0

I am currently creating a database that contains sensitive data such client names, addresses, etc. I have never worked with the setting up of servers but my research tells me to either use a cloud service or to have it completely harddrive stored on my pc. How secure would it be to store it locally?

1
  • 2
    Unfortunately this is too general / opinionated of a question and possibly more related to InformationSecurity.StackExchange.com. But multiple database systems have encryption at rest, data masking/ obfuscation, and standard security authentication mechanisms available to them, regardless if you're using a cloud service or local database instance.
    – J.D.
    Jul 5, 2022 at 2:41

1 Answer 1

2

Databases - especially if they contain sensitive data:

  • Should run on dedicated servers (either bare metal or VMs)
  • Should not be directly accessible from the Internet (protected by firewall, etc.)
  • Should not run on the same host as other network services, and especially file sharing services or web/application services
  • Should not run on the same host as any other service that accesses the Internet, other than the minimal connectivity required to download patches for the OS

The configuration and securing of a database server is a highly complicated task about which many, many, many books have been written. The specifics will depend on which database engine you are using; the specific options for that database that you are licensed to use; the operating system the database will be running on; the type of application that will be accessing the database; the network architecture supporting that connectivity; the type of data being stored; high availability requirements; legal security obligations or requirements; and potentially a whole host of other factors that will need to be discussed and planned at a high level with administrators, architects, and developers before a single line of code is written.

Also note that securing the database infrastructure (storage, networking, encryption, software, OS, etc.) is entirely different than secure application design and the implementation of data security in the database using roles, masking, and other application level business rules.

Bottom line here is that if you don't already have experience doing this, you should find someone with experience to guide you through it, and not rely on this forum for all your questions. If you don't have access to someone like that, then using a cloud service that handles most of those details for you is probably the best way to go.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.