CODEWITHSUNDEEP
securitycloud
Rens Groenveld
Rens Groenveld

Reputation: 982

Cloud combined with in-house database. How good is the security?

I'm currently performing a research on cloud computing. I do this for a company that works with highly private data, and so I'm thinking of this scenario:

A hybrid cloud where the database is still in-house. The application itself could be in the cloud because once a month it can get really busy, so there's definitely some scaling profit to gain. I wonder how security for this would exactly work.

A customer would visit the website (which would be in the cloud) through a secure connection. This means that the data will be passed forward to the cloud website encrypted. From there the data must eventually go to the database but... how is that possible?

Because the database server in-house doesn't know how to handle the already encrypted data (I think?). The database server in-house is not a part of the certificate that has been set up with the customer and the web application. Am I right or am I overseeing something? I'm not an expert on certificates and encryption.

Also, another question: If this could work out, and the data would be encrypted all the time, is it safe to put this in a public cloud environment? or should still a private cloud be used?

Thanks a lot!! in advance!!

Kind regards,

Rens

Upvotes: 2

Views: 562

Answers (3)

Deepa
Deepa

Reputation: 1

The internal database will not get compromised once a secured connection is established with the static Mac ID of the user accessing the database. The administrator can provides access to a Mac id through one time approval and add the user to his windows console.

Upvotes: 0

Geert Schuring
Geert Schuring

Reputation: 2163

The secure connection between the application server and the database server should be fully transparent from the applications point of view. A VPN connection can connect the cloud instance that your application is running on with the onsite database, allowing an administrator to simply define a datasource using the database server's ip address.

Of course this does create a security issue when the cloud instance gets compromised.

Upvotes: 1

Steven
Steven

Reputation: 172646

Both systems can live separately and communicate with each other through a message bus. The web site can publish events for the internal system (or any party) to pick up and the internal system can publish events as well that the web site can process.

This way the web site doesn't need access to the internal database and the internal application doesn't have to share more information than is strictly necessary.

By publishing those events on a transactional message queue (such as MSMQ) you can make sure messages are never lost and you can configure transport level security and message level security to ensure that others aren’t tampering messages.

Upvotes: 1

Related Questions