Encrypting data in transit

[minestrone]

Just reverse the byte stream until is gets to the destination.

Nobody is going to know any different.

 

[original PM]

If all you need to do is to encrypt data between two nodes using https then I suggest you research TLS and certificates. Not sure your exact requirements but most web servers such as IIS, Apache, nginx, etc support TLS. If you are using a broker such as RabbitMQ this supports TLS too.

https://en.m.wikipedia.org/wiki/Transport_Layer_Security

https://www.rabbitmq.com/ssl.html

Feel free to PM me if you need more info.

Cheers for that - when I spoke to our network guys they started banging on about security in the application - but I guess there are two things to consider

1) The application talking to the database.
2) The application talking to another application.

Can you approach both of these in the same way or do they need to be considered differently?

 

[minestrone]

I would be pretty sure these would always be done differently. SQL connections can be encrypted fairly easily by configuration on most databases.

Between applications I would suggest just writing some encryption code in the application ( which is a small job ) and passing round public keys.

 

[amanwhoisquiet]

Thanks much appreciated!

In terms of what they want - they have no idea - KPMG have come in and said here are your GDPR gaps and so they are saying they need it. (note it is not even a GDPR gap as nowhere does GDPR insist on having encrypted messages within a firewall network)

But they do not really know what benefit it actually gives as they are just box ticking moron's.

Lots of places unencrypt traffic as soon as it gets inside their network. It's about where your controls for such things sit. If a customer fires over a CC number to your site, you'll need to unencrypt it eventually or you'd never be able to process it. And you might want to watch what customers are doing on your site, to check they're not up to any funny business, again, which you can only see if it's in the clear at some point before the servers.
As long as you can demonstrate that the area of the network where those things travel unencrypted is secure, then that's probably enough, but you will get someone trying to score easy audit-points saying that you have to have it encrypted anyway, and because it's possible and the higher-ups will be risk-averse, then you'll end up doing it.

 

[rocketjet]

Cheers for that - when I spoke to our network guys they started banging on about security in the application - but I guess there are two things to consider

1) The application talking to the database.
2) The application talking to another application.

Can you approach both of these in the same way or do they need to be considered differently?

I think you need the client to clarify the requirements. They need to provide more information in regards to what level of encryption is required as there are many ciphers/algorithms AES-128-CBC, AES-256-CBC, AES-128-GCM, etc. Then we come onto the authentication, which can be as simple as a shared key between servers or use advanced PKI x509 certificates, etc.

Not sure what database product you are using but MS SQL Server supports TLS.

https://support.microsoft.com/en-gb/help/3135244/tls-1-2-support-for-microsoft-sql-server

 

[AnotherJohnDoe]

Woo hoo.

So we have done our 'encrypting data at rest' bit of work.

And now we are being told to 'encrypt data in transit'.

Unsurprisingly I am getting a lot of different answer non of which make sense.

So lest assume we want to encrypt a web service - so it needs to be sent as an https message rather than http - I am being told we need to encrypt that somewhere in the application.

However my understand was that it is just a mode of transport for the message - so i could send the same message via either http or https but the one which goes via https is 'more secure' and 'more difficult for someone to intercept and read' than the one going via http.

Appreciate this is a large topic but can anyone shed any light on this?

https is an encrypted form of http
When your web browser connects to a web server using http then nobody asks for encryption. But if you connect to it using https then both parties agree to encrypt the connection
But encryption comes down to what the application is, what the client asks for and if the application offers an encryption protocol
I.E. your web server may support encrypted connections, but if the client asks for an unencrypted one then the connection will be unencrypted
Having said, some web servers these days will redirect an http request to an https one so that encryption is enabled by default