Secure Data Encryption

[insomnia]

Hey all,

I'm 100% aware that this is basics for most people but until recently I never stored any sensitive information in a database. In fact I've never stored much sensitive information in general. I'm more coming from data science and personal projects. What are the best ways to securely store sensitive data (such as passwords/bank info/etc)? Here's what I've found so far (PLEASE correct me if anything is wrong):

 - One-way encryption is the best. Save the hash of whatever you are working on in the database, and then verify the input to the database which essentially returns true or false. In the event of a data breach, the data would need to be decrypted which can be mitigated 

 - Salts don't stop things from being decrypted, they just significantly slow down the process for people attempting to crack them

 - Argon2 in Python in general is a really good standard to use in projects. You can store the hash of the string in the database, then when you need to check if a password is correct you can use the verify function.

Plus of course your application needs to have decent security in place to mitigate the possibility of a data breach, but one thing at a time for us noobs haha. I have no idea if this is all that's needed in order to store sensitive data. If you have any reading materials/books/etc that you can recommend I'd be absolutely grateful. Thanks in advance folks!

[MalwareTech]

Is this primarily in regards to password, or sensitive data in general? A good hashing + salting algorithm with per user salts is suffice, but for other kinds of data such a PII, there may be more to consider. 

[insomnia]

1 minute ago, MalwareTech said:

Is this primarily in regards to password, or sensitive data in general? A good hashing + salting algorithm with per user salts is suffice, but for other kinds of data such a PII, there may be more to consider. 

This is more in regards to sensitive data in general. I'm very interested in PII, not just passwords. 

[MalwareTech]

1 minute ago, insomnia said:

This is more in regards to sensitive data in general. I'm very interested in PII, not just passwords. 

For PII there are compliance requirements that give you a basic idea (I'm not well versed in these), but on top of that there is always more you can do. It's a good idea to encrypt PII in the database with an per-account encryption key stored elsewhere. This protects you from issues such as database leaks, and allows you to erase PII data from database backups by simply deleting the account encryption key, rendering the encrypted data unreadable (this provides an easy way to do GDPR Article 17 compliance without having to find all data backups and erase the user's PII).

[insomnia]

21 minutes ago, MalwareTech said:

For PII there are compliance requirements that give you a basic idea (I'm not well versed in these), but on top of that there is always more you can do. It's a good idea to encrypt PII in the database with an per-account encryption key stored elsewhere. This protects you from issues such as database leaks, and allows you to erase PII data from database backups by simply deleting the account encryption key, rendering the encrypted data unreadable (this provides an easy way to do GDPR Article 17 compliance without having to find all data backups and erase the user's PII).

I'll look into those compliance requirements and see what I can find. I'm not sure how the backend would look with keys stored in a separate database on a functional level but I'll explore that as well! Thanks!!