{"id":5957,"date":"2021-11-11T16:58:31","date_gmt":"2021-11-11T14:58:31","guid":{"rendered":"https:\/\/www.almtoolbox.com\/blog\/?p=5957"},"modified":"2021-11-12T06:48:24","modified_gmt":"2021-11-12T04:48:24","slug":"hashicorp-vault-protect-databases","status":"publish","type":"post","link":"https:\/\/www.almtoolbox.com\/blog\/hashicorp-vault-protect-databases\/","title":{"rendered":"How to Prevent Data Leaks if Hackers Get Access to your Database?"},"content":{"rendered":"

Every week we hear about the latest website to get hacked, and hackers getting access to another database with consumers\u2019 personal data inside.<\/span><\/p>\n

Just in the last week there have been numerous reports of hacking, including stealing the medical records of 290,000 patients of the \u201cMor Medical Institute,\u201d and releasing data of 1 million subscribers of a popular dating app.<\/span><\/p>\n

All of this information was taken from databases containing private and sensitive information, which were stored in the website in an insecure manner.<\/span><\/p>\n

\"security\"<\/p>\n

The hackers allegedly gained access to the IIS server (Microsoft\u2019s <\/span>Internet Information Services<\/span>) by hacking the hosting company, so they got access to all hosted websites. Then they reached out to the code as well as the databases, got all the passwords – which were exposed without hashing (e.g. as a clear text), so they could gain access to all information in the databases.<\/span><\/p>\n

There is a simple solution that could have prevented this<\/h3>\n

One way to solve this, a solution that has already become a de-facto standard in recent years, is to use the <\/span>HashiCorp Vault<\/span><\/i>.<\/span><\/p>\n

This is a popular open source product, and there is even a free edition that is often sufficient, while building the solution does not take too long.<\/span><\/p>\n

Using HashiCorp Vault allows you to:<\/h3>\n
    \n
  1. Prevent entering the database\u2019s username and password to your code – which prevents access to the database even if someone gets access to the code.<\/span><\/li>\n
  2. Encryption mechanism without knowing the key – i.e . When you want to encrypt information before it goes into the database, you can use <\/span>Vault<\/span><\/i> in a manner so that the application isn\u2019t familiar with the encryption key – then the information inside the database is useless for hackers, and even if they get access to the code – they do not know the encryption key!<\/span><\/li>\n<\/ol>\n

    This would prevent access to the data itself even if hackers could reach the database, which in fact prevents the hackers from accessing the important and sensitive information they were trying to obtain.<\/p>\n

     <\/p>\n

    \n

    We (ALM-Toolbox) are the official representative of HashiCorp Vault in many countries including France and Israel, and we offer end-to-end solutions for Vault.<\/em>
    \nWe can inspect your current system, plan a solution that fits your needs and quickly implement it.<\/em>
    \nWe also provide ongoing support including managed service, SLA, Enterprise capabilities and Enterprise subscription licenses.<\/em>
    \nWe also provide HashiCorp Vault training and secure development training.For more details contact us: hashicorp@almtoolbox.com<\/a> or +31 85 064 4633<\/em><\/p>\n<\/div>\n

     <\/p>\n

    Related links<\/b><\/p>\n