Your Server Is Secure. But Is Your Data?

When we talk about cybersecurity, we usually talk about protecting the things around our data.

• We secure the network.
• We configure firewalls.
• We patch the operating system.
• We protect user accounts with strong passwords and multi-factor authentication.
• We limit access to servers.

All of those things are important. But there’s another layer of security that I think deserves a lot more attention: Security at the data itself.

Think about the traditional approach like protecting a building.

You put a fence around the property. You lock the exterior doors. You install an alarm system. You give employees keys only to the areas they need.

That’s good security.

But what happens after someone gets inside? The same question applies to our computer systems.

A firewall protects the network, but once someone has legitimate—or compromised—access to a server, the firewall may have already been bypassed.

Operating-system permissions protect files and processes, but an application frequently needs permission to access the database.

Application authentication protects users, but applications can have vulnerabilities. That’s why we should also be thinking about security where the information actually lives.

For a database, that can mean things such as:

• Encrypting sensitive information
• Limiting which database accounts can access particular data
• Separating application privileges from administrative privileges
• Auditing who accessed or changed sensitive information
• Protecting encryption keys separately from the encrypted data
• Restricting access at the row, column, or field level when appropriate
• Masking sensitive information when the full value isn’t necessary

The idea is simple:

Don’t rely on a single locked door between an attacker and your data.

If someone compromises a website, they shouldn’t automatically gain unrestricted access to everything in its database.

If someone gains access to a server account, that shouldn’t necessarily give them access to every customer’s information.

And even someone administering the infrastructure may not always need the ability to read the underlying sensitive data.

Security should exist in layers:

Network → Operating System → Application → Database → Data

Each layer assumes that, someday, another layer might fail.

That’s an important change in how we think about cybersecurity.

Instead of asking:

“How do we keep people out of our systems?”

We also need to ask:

“If someone gets in, how much can they actually see?”

There will probably never be a perfectly secure server, network, application, or operating system. Vulnerabilities will continue to be discovered, credentials will occasionally be compromised, and people will continue to make mistakes.

But a failure at one layer doesn’t have to become a failure of the entire system.

Protect the network. Protect the server. Protect the application. But don’t forget to protect the thing all of those systems exist to serve: the data.

Here at Spyderserve Web Services, we use these techniques and more to protect your website and other web applications to protect your data and reputation.  We would love to have a discussion on how this would help your business.